Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

After upgrading to NSX-T 2.4.2, K8S Nodes are unable to communicate with Bosh in NATed Enterprise PKS environment (71364)

Last Updated: 10/27/2020Categories: TroubleshootingTotal Views: 12720Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Symptoms

After upgrading to NSX-T 2.4.2, you see the below issue in VMware Enterprise PKS environment with NAT mode enabled.

K8S nodes are unable to communicate with Bosh which is running behind a different T1 router.

Unable to create any new clusters & add new K8S nodes to existing clusters.

You see this issue under the following conditions:

PKS Management VMs (Bosh,PKS,Harbor) are running behind a logical T1 router with a Service Router(SR) component configured on it.

Tier 0 router and the PKS Management Tier 1 SR component were created on the same edge node.

Enabled the NAT mode in PKS environment and configured SNAT/DNAT rules on the Tier 0 router.

Cause

In earlier versions of NSX-T, the NAT rules were only applied to the uplink by default. With NSX-T 2.4.2, any NAT (SNAT, DNAT) rules configured on the T0 are automatically propagated to all the links if a link is not specified (downlink/uplink). As a result, all existing NAT rules such as SNAT rules defined by PKS at the time of cluster, namespace creation or the DNAT rules that you configured to access the Ent. PKS are applied to all the links on your Tier 0 router.

Since the monitoring agents with each of the Kubernetes nodes need direct routable access to BOSH and this is no longer possible, BOSH is unable to monitor the health status of the cluster nodes.  In addition, you will not be able to create any new clusters / modify the existing clusters.

Resolution

This is a known issue affecting VMware NSX-T 2.4.2 and currently there is no resolution.

Workaround

To work around this issue, choose either of the below options:
Work around 1 : Detach the SR component from PKS Management T1 Router
If you are not using any services (like NAT,Firewall, etc) on PKS Management T1 SR, you can safely detach it from the edge cluster by following the below steps:

Disable the firewall on PKS Management T1 Router:
Navigate to T1 Router > Services > Edge Firewall > DISABLE FIREWALL

Detach the edge cluster from T1 Router:
Navigate to T1 Router > Overview > Click Edit (Next to Summary) > Click on ‘x’ next to edge cluster.

Work around 2: Create a NO_SNAT rule on T0 to allow direct communication between K8S Node network and Bosh.
Note: You need to create this NO_SNAT rule with highest priority so that existing SNAT rules will not be applicable for Node > Bosh communication.

Navigate to T0 Router > Click on Services > NAT > Click Add.

Under Priority, enter a number lower than the other existing SNAT rules.

Under Action, Select NO_SNAT

Under Protocol, choose Any Protocol.

Under source IP, provide the node network subnet.

Under Destination IP, choose Bosh IP.

Click on Save to save the rule.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
NSX Manager と NSX によって準備されたホスト間の通信チャネルの健全性チェックが特定の条件下で「停止」と表示され、NSX Manager の CPU 使用率が高くなることがある (71323)

KB
•
vSAN Health Service - 容量利用率 - 读取缓存预留 (71173)

KB
•
2 台のノードが失われた NSX-T クラスタのリカバリ (74518)

KB
•
core.jsvc.xxx ファイルが生成されて SPS サービスがクラッシュし、vCSA 6.7 U2 の /storage/core がいっぱいになる (71170)

Results 1-4 of 4

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware PKS

Related Versions:

VMware PKS 1.x

VMware NSX-T Data Center 2.x

VMware NSX-T Data Center

Take Our Survey

Support Assistant