NSX Policy Cleanup Script Fails to Delete NCP created NAT Rules in OpenShift

Products

• VMware NSX

Issue/Introduction

When attempting to clean up a decommissioned OCP cluster or when cleaning up NSX objects after failed cluster provisioning, using nsx_policy_cleanup.py, the script executes but leaves behind orphaned NAT rules

The leftover NAT rules exist on NSX, bear the relevant NCP cluster tags, and reflect the correct OCP cluster name.

Initial Command Used:

python nsx_policy_cleanup.py --mgr-ip <NSX-Manager-IP> -u admin -c <cluster-name> --top-tier-router-id <T0-router-id> --no-warning

Environment

VMware NSX 

OpenShift (OCP)

Cause

In OpenShift deployments, the administrator might have designated a pre-created T1 Logical Router as the top_tier_router for the cluster (configured within the nsx-ncp-config ConfigMap).

Because this pre-created T1 Logical Router itself lacks the NCP cluster tag and the cluster's NAT rules are attached directly to this T1 rather than the T0 running the cleanup script against the <T0-router-id> causes the script to miss and bypass the scoped NAT rules entirely.

Since the target OCP cluster is typically already deleted or inaccessible by the time orphaned NAT rules are discovered, you can identify the correct T1 Logical Router ID using one of the following methods:

1. Check Original Deployment Manifests: Review the original YAML manifests used to deploy the OCP cluster. Locate the NCP operator ConfigMap file (nsx-ncp-config) to find the exact top_tier_router ID configured during provisioning.

2. Check a Reference Cluster: If you have another running OCP cluster built with the exact same network topology, query its active ConfigMap using the OpenShift CLI

   oc get cm -n nsx-system nsx-ncp-config -o yaml
   

Resolution

To successfully purge the remaining NAT rules, re-run nsx_policy_cleanup.py by passing the T1 Logical Router ID into the --top-tier-router-id parameter instead of the T0.

Step 1: Dry Run (Validation)

Execute a dry run without the remove flag to confirm the script now detects the orphaned NAT rules:

python nsx_policy_cleanup.py \
  --mgr-ip <NSX-Manager-IP> \
  -u admin \
  -p '<password>' \
  -c <k8s-cluster-name> \
  --top-tier-router-id <T1-router-id> \
  --no-warning

Step 2: Execute Cleanup

Once verified in the dry run output, append the -r flag to permanently delete the NAT rules:

python nsx_policy_cleanup.py \
  --mgr-ip <NSX-Manager-IP> \
  -u admin \
  -p '<password>' \
  -c <k8s-cluster-name> \
  --top-tier-router-id <T1-router-id> \
  --no-warning \
  -r

Note: The nsx_policy_cleanup.py script is included in the NSX Container Plugin installation bundle, available for download from the Broadcom Support Portal.