AWS zone names are logical and can identify different physical zones across accounts. That is, Account A's us-east-1a is not guaranteed to be Account B's us-east-1a.
AWS also has physical IDs that are consistent across accounts. Account A's use1-az1 is guaranteed to be Account B's use1-az1. These physical IDs are part of AWS EKS nodes from EKS 1.30+ in the node label: topology.k8s.aws/zone-id.
Envoy Gateway currently uses the AWS zone name populated in the standard Kubernetes node label: topology.kubernetes.io/zone when comparing for locality routing, which can route cross-account traffic to the wrong physical zone.
Fixed in #9960
AWS zone names are logical and can identify different physical zones across accounts. That is, Account A's us-east-1a is not guaranteed to be Account B's us-east-1a.
AWS also has physical IDs that are consistent across accounts. Account A's use1-az1 is guaranteed to be Account B's use1-az1. These physical IDs are part of AWS EKS nodes from EKS 1.30+ in the node label: topology.k8s.aws/zone-id.
Envoy Gateway currently uses the AWS zone name populated in the standard Kubernetes node label: topology.kubernetes.io/zone when comparing for locality routing, which can route cross-account traffic to the wrong physical zone.
Fixed in #9960