Defining Network Profiles

About Network Profiles
Network Profile Format
Network Profile Parameters
Network Profile Creation

Page last updated:

Warning: VMware Enterprise PKS v1.6 is no longer supported because it has reached the End of General Support (EOGS) phase as defined by the Support Lifecycle Policy. To stay up to date with the latest software and security updates, upgrade to a supported version.

This topic describes how to define network profiles for Kubernetes clusters provisioned with VMware Enterprise PKS on vSphere with NSX-T.

About Network Profiles

Network profiles let you customize NSX-T configuration parameters at the time of cluster creation. Use cases for network profiles include the following:

Profile Type	Description
Load Balancer Sizing	Customize the size of the NSX-T load balancer service that is created when a Kubernetes cluster is provisioned.
Custom Node Networks	Customize Kubernetes Node Networks, including the IP addresses, subnet size, and routability.
Custom Pod Networks	Customize Kubernetes Pod Networks, including IP addresses, subnet size, and routability.
Custom Floating IP Pool	Specify a custom floating IP pool.
Security Groups Namespace	Specify an NSX-T Namespace Group where Kubernetes master nodes will be added to during cluster creation.
Edge Router Selection	Specify the NSX-T Tier-0 router where Kubernetes node and Pod networks will be connected to.
Nodes DNS Configuration	Specify one or more DNS servers for Kubernetes clusters.
DNS Lookup of Pre-Provisioned IPs	Configure DNS lookup of the Kubernetes API load balancer or ingress controller.
Load Balancer Configuration	Configure layer 4 TCP load balancer settings; use third-party load balancer.
Ingress Configuration	Configure layer 7 HTTP/S ingress controller settings; use third-party ingress controller.
FW Section Marking	Configure top or bottom section markers for explicit DFW rule placement.
Shared Tier-1 Router	Use a single Shared Tier-1 Router for each Kubernetes cluster.
NCP Logging	Configure NCP logging.

Network Profile Format

Network profiles are defined using JSON. Here is an example network profile that includes all available parameters.

Note: This example network profile is for illustration purposes only. It is not intended to be used as a template for network profile definition.

{
    "name": "example-network-profile",
    "description": "Example Network Profile with All Available Parameters -- FOR ILLUSTRATION PURPOSES ONLY",
    "parameters": {
        "lb_size": "large",
        "pod_ip_block_ids": [
            "ebe78a74-a5d5-4dde-ba76-9cf4067eee55",
            "ebe78a74-a5d5-4dde-ba76-9cf4067eee56" ],
        "pod_subnet_prefix": 27,
        "pod_routable": true,
        "fip_pool_ids": [
            "e50e8f6e-1a7a-45dc-ad49-3a607baa7fa0",
            "ebe78a74-a5d5-4dde-ba76-9cf4067eee55" ],
        "t0_router_id": "5a7a82b2-37e2-4d73-9cb1-97a8329e1a90",
        "master_vms_nsgroup_id": "9b8d535a-d3b6-4735-9fd0-56305c4a5293",
        "node_ip_block_ids": [
            "2250dc43-63c8-4bb8-b8cf-c6e12ccfb7de", "3d577e5c-dcaf-4921-9458-d12b0e1318e6" ],
        "node_routable": true,
        "node_subnet_prefix": 20,
        "nodes_dns": [
            "8.8.8.8", "192.168.115.1", "192.168.116.1" ],      
        "dns_lookup_mode": "API_INGRESS",
        "ingress_prefix": "ingress",
        "single_tier_topology": true,
        "infrastructure_networks": [
            "30.0.0.0/24",
            "192.168.111.0/24",
            "192.168.115.1" ],
        "cni_configurations": {
            "type": "nsxt",
            "parameters": {
                "nsx_lb": false,
                "nsx_ingress_controller": true,         
                "x_forwarded_for": "insert",
                "ingress_ip": "192.168.160.212",
                "log_settings": {
                    "log_level": "DEBUG",
                "ingress_persistence_settings": {
                    "persistence_type": "cookie",
                    "persistence_timeout": 1 },
                "max_l4_lb_service": 10,
                "l4_persistence_type": "source_ip",
                "l4_lb_algorithm": "weighted_round_robin",
                "top_firewall_section_marker":"section-id",
                "bottom_firewall_section_marker":"section-id"                         
            }
        }
    }
}

WARNING: None of the parameters defined under cni_configurations can be updated.

Network Profile Parameters

The network profile JSON accepts the following top-level parameters:

Parameter	Type	Description
`name`	String	Name of the network profile.
`description`	String	Description of the network profile.
`parameters`	Map	One or more name-value pairs.
`lb_size`	String	Size of the NSX-T load balancer service: `small` (default), `medium`, and `large`.
`pod_ip_block_ids`	String	Array of Pod IP Block UUIDs.
`pod_subnet_prefix`	Integer	Size of the Pods IP Block subnet.
`pod_routable`	Boolean	Make routable the Pods subnet. Default is `false`.
`fip_pool_ids`	String	Array of floating IP pool UUIDs defined in NSX-T.
`t0_router_id`	String	Tenant Tier-0 Router UUID defined in NSX-T.
`master_vms_nsgroup_id`	String	Namespace Group UUID as defined in NSX-T.
`nodes_dns`	String	Array (up to 3) of DNS server IP addresses for lookup of Kubernetes nodes and pods.
`dns_lookup_mode`	String	DNS lookup mode for Kubernetes API load balancer (`API`) and ingress controller (`API_INGRESS`).
`ingress_prefix`	String	Ingress controller hostname prefix for DNS lookup.
`single_tier_topology`	Boolean	Use a single Tier-1 Router per cluster (shared). Default is `false`.
`infrastructure_networks`	String	Array of IP addresses and subnets for Node Networks for use with a Shared Tier-1 topology in a Multi-Tier-0 environment.
`cni_configurations`	Map	Map containing key-value pairs for configuring NCP (see table below).

The network profile JSON accepts the following parameters for cni_configurations:

Parameter	Type	Description
`type`	String	Only the constant `nsxt` is accepted.
`parameters`	Map	One or more name-value pairs for NCP settings.
`x_forwarded_for`	String	Use the same source IP for calling clients. Accepts `"insert"` and `"replace"`.
`nsx_lb`	Boolean	Use NSX-T layer 4 virtual server for each Kubernetes service of type LoadBalancer. Default is `true`.
`nsx_ingress_controller`	Boolean	Use NSX-T layer 7 virtual server as the ingress controller for the Kubernetes cluster. Default is `true`.
`ingress_ip`	String	IP address to use for the ingress controller.
`log_settings`	Map	Parameters for configuring NCP logging.
`log_level`	String	Accepted values: “INFO”, “WARNING”, “DEBUG”, “ERROR”, and “CRITICAL”.
`log_dropped_traffic`	Boolean	Log dropped firewall traffic. Default is `false`.
`ingress_persistence_settings`	String	Parameters for customizing Layer 7 persistence.
`persistence_type`	String	Specify the ingress persistence type: `none`, `cookie`, or `source_ip`.
`persistence_timeout`	Integer	Persistence timeout interval in seconds.
`max_l4_lb_service`	Integer	Limit the maximum number of layer 4 virtual servers per cluster. Minimum is `1`.
`l4_persistence_type`	String	Connection stickiness based on `source_ip`.
`l4_lb_algorithm`	String	Layer 4 load balancer behavior: `round_robin` (default), `least_connection`, `ip_hash`, `weighted_round_robin`.
`top_firewall_section_marker`	String	UUID of the top `section-id` for the distributed firewall (DFW) section as defined in NSX-T.
`bottom_firewall_section_marker`	String	UUID of the bottom `section-id` for the distributed firewall (DFW) section as defined in NSX-T.

Network Profile Creation

After the network profile is defined in a JSON file, an Enterprise PKS administrator can create the network profile using the PKS CLI. The Kubernetes administrator can use the network profile when creating a cluster.

After you define your network profile configuration as described in Defining Network Profiles, run the following command:

pks create-network-profile PATH-TO-YOUR-NETWORK-PROFILE-CONFIGURATION

Where PATH-TO-YOUR-NETWORK-PROFILE-CONFIGURATION is the path to the JSON file you created when defining the network profile.

For example:

$ pks create-network-profile np-routable-pods.json

Network profile small-routable-pod successfully created

Only cluster administrators, pks.clusters.admin, can create network profiles. If a cluster manager, pks.clusters.manage, attempts to create a network profile, the following error occurs:

You do not have enough privileges to perform this action. Please contact the PKS administrator.

For more information, see the Create and Use Network Profiles section of Using Network Profiles (NSX-T Only).

Please send any feedback you have to pks-feedback@pivotal.io.

Create a pull request or raise an issue on the source for this page in GitHub