VMware NSX Container Plugin 3.0

4.2 4.1 4.0 3.2 3.1 3.0
简体中文 Deutsch Español Français Italiano 日本語 한국어 繁體中文 English

Load Balancer and Network Policy

When traffic is forwarded to the pods from the NSX load balancer virtual server, the source IP is the tier-1 router's uplink port's IP address. This address is on the private tier-1 transit network, and can cause the CIDR-based network policies to disallow traffic that should be allowed.
To avoid this issue, the network policy must be configured such that the tier-1 router's uplink port's IP address is part of the allowed CIDR block. This internal IP address will be visible as an annotation (
ncp/internal_ip_for_policy
) on the Ingress and Service resources.
For example, if the external IP address of the virtual server is 4.4.0.5 and the IP address of the internal tier-1 router's uplink port is 100.64.224.11, the status will be: 
    status:
      loadBalancer:
      ingress:
      - ip: 4.4.0.5
The annotation on the Ingress and service of type LoadBalancer resource will be: 
    ncp/internal_ip_for_policy: 100.64.224.11
The IP address 100.64.224.11 must belong to the allowed CIDR in the
ipBlock
 selector of the network policy. For example, 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    ...
    ingress:
    - from:
      - ipBlock:
         cidr: 100.64.224.11/32

Content feedback and comments