Control Plane Nodes Lose Manually Assigned NSX Tags After Certificate Renewal
Article ID: 443782
Updated On:
Products
Issue/Introduction
When performing a certificate renewal on Tanzu Kubernetes Grid (TKG) control plane nodes deployed via Telco Cloud Automation (TCA), redeployed node virtual machines are missing their previously assigned NSX tags. Network policies or Distributed Firewall (DFW) rules relying on these static tags fail to apply to the newly provisioned nodes.
Environment
TCA 3.4
NSX 4.2.2.1
Cause
TCA utilizes an immutable infrastructure methodology for lifecycle management (LCM) operations such as certificate renewals. During a rolling update, the Machine Controller completely destroys the existing virtual machines and provisions entirely new virtual machines with new UUIDs. Manually assigned out-of-band NSX tags are bound to the previous virtual machines and do not persist on the newly generated resources.
Resolution
To resolve this issue and maintain continuous security policy enforcement, replace static NSX tagging with Dynamic NSX Security Groups based on declarative VM naming conventions.
Log in to the active NSX Manager with Enterprise Administrator privileges.
Navigate to Inventory > Groups.
Click Add Group and define a name (e.g., abc-tkg-control-plane-dynamic).
Click Set under the Members column.
In the Set Members window, ensure the Group Type is set to
Generic.Select the Membership Criteria tab and click Add Criterion.
Configure the dynamic matching logic:
Member Type: Select
Virtual Machine.Attribute: Select
Name.Operator: Select
Contains.Value: Enter the consistent naming string assigned by the TCA CaaS cluster specification (e.g.,
-control-plane).
Click Apply to lock the membership criterion, then click Save.
Navigate to Security > Distributed Firewall and update the required DFW rules to use the newly created Dynamic Group in the Source or Destination fields instead of static tags.
Publish the DFW changes.
Additional Information
Feedback
