This topic provides considerations for using the NSX Policy API with VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) on vSphere.
Warning: The NSX Policy API feature is available at 50% of NSX Management Plane API scale. For detailed scale numbers, see NSX-T Data Center 3.2.1 Configuration Limits or NSX 4.0.1 Configuration Limits.
NSX-T Policy API Support
The NSX-T Policy API is the next-generation interface for integrating with the NSX-T networking and security framework.
In addition to supporting the NSX-T Management API, TKGI supports using the NSX-T Policy API to deploy Tanzu Kubernetes Grid Integrated Edition on vSphere.
If you are planning on using the NSX-T Policy API, keep in mind that only new deployments of TKGI are supported. You cannot configure an existing installation of TKGI to use the NSX-T Policy API.
In addition, while all TKGI functionality is supported in both NSX-T modes, Policy and Management, there are some differences to be aware of when configuring NSX-T objects for TKGI, and when configuring the BOSH and TKGI tiles. These differences are described in more detail below.
NSX-T Versions
To use the NSX-T Policy API with your TKGI installation, you must use a supported NSX-T version. Refer to the Release Notes.
NSX-T Deployment Topologies
Tanzu Kubernetes Grid Integrated Edition on vSphere with NSX-T supports several deployment topologies.
Currently Tanzu Kubernetes Grid Integrated Edition on vSphere with NSX-T Policy API supports all network topologies except the VSS/VDS topology.
NSX-T Installation
To use the NSX-T Policy API, there are no changes required to the installation of the main NSX-T components, including NSX Manager and Edge Nodes.
For installation instructions, see Installing Tanzu Kubernetes Grid Integrated Edition on vSphere with NSX-T Data Center.
NSX-T Objects for Kubernetes Clusters
To use the NSX-T Policy API, you must configure the required NSX-T control plane objects using the NSX-T Policy API or UI. Specifically, you must configure the Tier-0 Router (called Gateway in the Policy terminology), the Nodes IP Block, the Pods IP Block, and the Floating IP Pool need to be created using the Policy API or UI.
For specific instructions on creating the required objects, see Create the NSX-T Objects for Kubernetes Clusters Provisioned by TKGI.
TKGI Configuration
When you configure the BOSH Director tile for Tanzu Kubernetes Grid Integrated Edition, you must enable the option vCenter Config > NSX-T Networking > Use NSX-T Policy API. See Configure NSX-T Networking.
Also, when you configure the TKGI tile in Ops Manager, you must enabled Settings > Networking > NSX-T > Policy API mode. See Configure TKGI Networking.
Management Console
If you are using the TKGI Management Console, you need to select the Policy API in the TKGI configuration section.
Network Profile
Tanzu Kubernetes Grid Integrated Edition on vSphere with NSX-T supports the use of Network Profile for modifying specific NSX-T settings post-installation. A limited number of network profile use cases are not supported when using TKGI with the NSX-T Policy API.
The Tanzu Kubernetes Grid Integrated Edition on vSphere with NSX-T Policy API does not support either the “Top Firewall” or the “Bottom Firewall” DFW Section Markers. For more information, see DFW Section Markers.
The Tanzu Kubernetes Grid Integrated Edition on vSphere with NSX-T Policy API does not support NSGroups if you create the group in a domain other than the default. With the Policy API, a group must be part of a domain. The default domain is supported, and if you create the group using the NSX-T Policy interface, the group is automatically put in the default domain. However, if you use the Policy REST API to create a group in a domain other than the default, it is not supported.
