In the this section of documentation:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/networking/ovn-kubernetes-network-plugin#nw-egress-ips-multi-nic-considerations_configuring-egress-ips-ovn

There is a cosmetic error where it says:
"In OpenShift Container Platform, egress IPs provide administrators a way to control network traffic. Egress IPs can be used with the br-ex, or primary, network interface, which is a Linux bridge interface associated with Open vSwitch, or they can be used with additional network interfaces."

br-ex is a linux interface, but it is not a linux "bridge" interface.


More importantly, the document states:
"IP forwarding must be enabled for the network interface. To enable IP forwarding, you can use the oc edit network.operator command and edit the object like the following example:

# ...
spec:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  defaultNetwork:
    ovnKubernetesConfig:
      gatewayConfig:
        ipForwarding: Global
# ...
"

While it is true that you can enable global IP forwarding to allow Egress IP on the secondary NIC, it isn't required and is undesirable from a security perspective. Rather than recommending this, we should recommend only enabling IP forwarding on the secondary NIC that will be acting as the Egress IP interface. That can be done with the node/tuning operator.

    4.14 and later

    1.
    2.
    3.