A managed NAT gateway charges by the hour and for every gigabyte it processes. Natterjack moves that job onto egress gateways that run as pods on your existing nodes: active-active within each availability zone, zone-local by default, and failing over in under a second.
No per-gigabyte processing charge
Traffic leaves through Elastic IPs on interfaces your infrastructure-as-code already owns. No new nodes, no new load balancers, a handful of small pods.
Active-active, zone-aware
Every gateway in a zone carries traffic at once. Flows prefer gateways in their own zone, so they never pay for cross-zone transfer unless a zone has none left.
Sub-second failover
Health is probed every 100 ms over the tunnel. When a gateway dies, only its flows move; established connections on healthy gateways are untouched.
Secure without extra configuration
Each egress interface lives in an isolated network namespace that drops all inbound connections and never forwards into your cluster, even when the surrounding infrastructure is misconfigured.
Your IaC stays in charge
Interfaces, addresses and routes are declared in Terraform or CloudFormation. Natterjack discovers them by tag and never creates, retags or deletes them, so there is no drift to fight.
Works with your CNI and mesh
Built on the Linux kernel’s own NAT and tunnelling, with an eBPF fast path for eBPF-based CNIs. Designed to sit underneath Istio, Linkerd and Cilium meshes.
Open source under Apache-2.0. Every release is signed, ships with an SBOM and
build provenance, and is built from a reviewed commit on main.