A Supervisor Cluster can either use the vSphere networking stack or VMware NSX-T™ Data Center to provide connectivity to Kubernetes control plane VMs, services, and workloads. When a Supervisor Cluster is configured with the vSphere networking stack, all hosts from the cluster are connected to a vSphere Distributed Switch that provides connectivity to Kubernetes workloads and control plane VMs. A Supervisor Cluster that uses the vSphere networking stack requires a third-party load balancer that provides connectivity to DevOps useres and external services. A Supervisor Cluster that is configured with VMware NSX-T™ Data Center, uses the software-based networks of the solution as well as an NSX Edge load balancer to provide connectivity to external services and DevOps users.

Supervisor Cluster Networking with NSX-T Data Center

VMware NSX-T™ Data Center provides network connectivity to the objects inside the Supervisor Cluster and external networks. Connectivity to the ESXi hosts comprising the cluster is handled by the standard vSphere networks.

Figure 1. Supervisor Cluster Networking with NSX-T Data Center
Supervisor Cluster Networking
  • NSX Container Plug-in (NCP) provides integration between NSX-T Data Center and Kubernetes. The main component of NCP runs in a container and communicates with NSX Manager and with the Kubernetes control plane. NCP monitors changes to containers and other resources and manages networking resources such as logical ports, segments, routers, and security groups for the containers by calling the NSX API.
  • NSX Edge provides connectivity from external networks to Supervisor Cluster objects. The NSX Edge cluster has a load balancer that provides a redundancy to the Kubernetes API servers residing on the control plane VMs and any application that must be published and be accessible from outside the Supervisor Cluster.
  • A tier-0 gateway is associated with the NSX Edge cluster to provide routing to the external network. The uplink interface uses either the dynamic routing protocol, BGP, or static routing.
  • A tier-1 gateway is required per Supervisor Cluster that provides southbound traffic from the cluster to the tier-0 gateway.
  • Segments are associated with each namespace within the Supervisor Cluster to provide connectivity to vSphere Pods.
  • The control plane VM segment provides connectivity between the control plane VMs and vSphere Pods.

To learn more about Supervisor Cluster networking, watch the video vSphere 7 with Kubernetes Network Service - Part 1 - The Supervisor Cluster.

Figure 2. Namespaces Networking with NSX-T Data Center
Namespaces Networking

The segments for each namespace reside on the vSphere Distributed Switch (VDS) functioning in Standard mode that is associated with the NSX Edge cluster. The segment provides an overlay network to the Supervisor Cluster.

Each vSphere Pod connects through an interface to the segment that is associated with the namespace where the pod resides.

The Spherelet processes on each ESXi hosts communicate with vCenter Server through an interface on the Management Network.

Networking Configuration Methods with NSX-T Data Center

The Supervisor Cluster uses an opinionated networking configuration. Two methods exist to configure the Supervisor Cluster networking with NSX-T Data Center that result in deploying the same networking model:
  • The simplest way to configure the Supervisor Cluster networking is by using the VMware Cloud Foundation SDDC Manager. For more information, see the VMware Cloud Foundation SDDC Manager documentation. For information, see Working with Workload Management.
  • You can also configure the Supervisor Cluster networking manually by using an existing NSX-T Data Center deployment or by deploying a new instance of NSX-T Data Center. See Install and Configure NSX-T Data Center for vSphere with Tanzu for more information.

Supervisor Cluster Networking with vSphere Distributed Switch

A Supervisor Cluster that is backed by a vSphere Distributed Switch uses distributed port groups as Workload Networks for namespaces.

Figure 3. Namespace Networking with vSphere Distributed Switch

Namespace Networking with vSphere Distributed Switch

Depending on the topology that you implement for the Supervisor Cluster, you can use one or more distributed port groups as Workload Networks. The network that provides connectivity to the Kubernetes Control Plane VMs is called Primary Workload Network. You can assign this network to all the namespaces on the Supervisor Cluster, or you can use different networks for each namespace. The Tanzu Kubernetes clusters connect to the Workload Network that is assigned to the namespace where the clusters reside.

A Supervisor Cluster that is backed by a vSphere Distributed Switch uses an external load balancer for providing connectivity to DevOps users and external services. HAProxy is the currently supported load balancer.

For more information on the possible topologies, see System Requirements and Topologies for Setting Up a Supervisor Cluster with vSphere Networking.