[Feature] Cilium Egress Gateway with multiple static outbound IPs

Last year, we started using private AKS clusters as our internal application platform within our Azure landing zone. Now that we are moving more workloads onto AKS, we discovered that one critical capability is missing from an infrastructure and NOC/SOC perspective: an egress gateway with multiple static outbound IPs.

Consider an application that requires general outbound access to the internet. You cannot restrict it to a single IP or FQDN, so the firewall must allow port 443 from the node pool to “any.” If another application runs on the same node pool, it automatically inherits the same unrestricted outbound access. While network policies can technically restrict this traffic, our NOC/SOC teams do not accept this approach. From their viewpoint, allowing “443 to any” for the entire node pool is a loss of control. They want AKS to perform outbound calls using specific, predefined IP addresses so the central hub firewall can enforce granular outbound controls per application.

I found that Cilium itself provides a feature for assigning a static egress IP
(https://docs.cilium.io/en/stable/network/egress-gateway/egress-gateway/),
but as far as I can determine, this feature is not currently compatible with Azure AKS.

The goal of this feature request is to enable Cilium Egress Gateway in AKS to support multiple static outbound IPs. An AKS administrator should be able to create a dedicated egress node pool with multiple egress gateways, each with its own static IP. These IPs should automatically be used for SNAT so that the central hub firewall can allow or block traffic based on these specific addresses - without opening outbound access for the entire node pool.

Additionally, Cilium Egress Gateway with multiple static outbound IPs must be resilient. During node upgrades or replacements, all configured static egress IPs should continue to function across all egress gateways without interruption.