"Error code: 289" in NSX UI when attempting to disable a gateway firewall on a VKS / NCP created tier-1 gateway.

Products

• VMware NSX
• VMware vSphere Kubernetes Service

Issue/Introduction

• The below error is observed in the NSX UI when attempting to disable a gateway firewall on a vSphere Kubernetes Service (VKS) / NSX Container Plugin (NCP) created tier-1 gateway.
  "Error: Principal '<Enterprise Admin Account Username>' with role '[enterprise_admin]' attempts to delete or modify an object of type nsx$Network it doesn't own. (createUser=wcp-cluster-user-<Principal Identy UUID>, allowOverwrite=null) (Error code: 289)"
• VKS is using NCP as its Container Network Interface (CNI).

Environment

VMware NSX
vSphere Kubernetes Service

Cause

This is an expected security behavior in the NSX UI to block the modification of objects created by VKS / NCP (owned by a Principal Identity). 

Resolution

This is a condition that may occur in a VMware NSX environment.

It is currently NOT supported to configure VKS or NCP to automatically create new tier-1 gateways with gateway firewall disabled. When NCP creates a tier-1 gateway, it does not explicitly pass the "disable_firewall" parameter in the API payload, so NSX defaults it to enabled (disable_firewall: false). There is currently no ncp.ini option to alter this default behavior.

Workaround
If required, the gateway firewall can be disabled for a VKS / NCP created tier-1 gateway via API if the CNI is NCP . 

1. Confirm that the tier-1 gateway being modified was created by NCP:
   This can be confirmed by checking if the tier-1 has NCP tags (ncp/cluster, ncp/system etc).
   
   
2. Retrieve current gateway configuration using the below API call:
   GET   https://<NSX-Manager-IP>/policy/api/v1/infra/tier-1s/<Tier-1-ID>
   
   NB:  Save a copy of the above output as a backup. 
   
   
3. Disable the gateway firewall on the tier-1:
   PUT https://<NSX-Manager-IP>/policy/api/v1/infra/tier-1s/<Tier-1-ID>
   

   Headers
   Content-Type: application/json  and  X-Allow-Overwrite: true
   
   Body 
   Body to contain GET output with "disable_firewall" set to true as below:

   "disable_firewall": true,

   
   Example screenshots below from Postman:
   
   
   
   
   
4. Verify that gateway firewall has been disabled for the tier-1 gateway via NSX API and UI:
   NSX API:  GET   https://<NSX-Manager-IP>/policy/api/v1/infra/tier-1s/<Tier-1-ID>     (Confirm that "disable_firewall" is set to true)
   NSX UI:    Security > Policy Management > Gateway Firewall > Settings > Gateway Specific Settings     (Confirm that gateway firewall is toggled to off for tier-1)  
   
   NB:  NCP will not check or reconcile this field during its subsequent runs.

Additional Information

VMware NSX REST API Guide