Importing a Kubernetes cluster can take some time and requires locking down the cluster (no create, update, or delete operations allowed). It is recommended that you import one cluster at a time so that you do not need to lock down all clusters.

Before starting the import process, you must perform a backup of NSX Manager. This ensures that if an unrecoverable failure occurs, you can restore NSX Manager to its state before the import.

The Python3 script that performs the import, mp_to_policy_importer.py, is located in the directory scripts/mp_to_policy_import. You must run it on the Kubernetes master node that is running the cluster.

For limitations and workarounds, see Limitations and Workarounds. For information on how to handle errors, see Failure and Recovery.

The workflow to import Manager objects to Policy:
  1. Upgrade NSX-T to 3.0.0 or later.
  2. Upgrade NCP to 3.1.
  3. In the NCP YAML file, make sure that policy_nsxapi is set to false.
  4. Start the migration coordinator on any of the NSX Managers with the following command:

    /etc/init.d/migration-coordinator start

    Verify that it is successfully running with the following command:

    /etc/init.d/migration-coordinator status

    Be sure to use this Manager's IP address when importing Manager objects to Policy.

  5. Create a backup.
  6. Import shared resources. See Importing Shared Resources.
  7. Lock the Kubernetes cluster. The Kubernetes API server will be in read-only mode. Do not perform any create, update, or delete operations on Kubernetes resources. Wait at least 10 minutes before proceeding to the next step.
  8. Stop NCP.
  9. Create a backup.
  10. Import the Kubernetes cluster. See Importing a Kubernetes Cluster.
  11. Update ncp.ini if required for this cluster. See Importing Shared Resources.
  12. In the NCP YAML file, make sure that policy_nsxapi is set to true and start NCP.
  13. Unlock the cluster. You can now perform create, update, or delete operations on Kubernetes resources.
  14. Repeat steps 4 - 12 for the next cluster.
  15. Switch PKS automation and BOSH CPI to use the Policy API once all clusters in the deployment are imported.