An administrator is preparing to deploy a new workload domain that will host vSphere Kubernetes Service (VKS) clusters. Before configuring the network for the Kubernetes clusters, the administrator…

Question

Options

• AThe Tier-0 Gateway route map must contain an IP prefix with only a deny rule.
• BThe Tier-0 Gateway must be configured in Non-Preemptive failover mode.
• CThe Tier-0 Gateway must be configured in Active/Standby mode.
• DThe Tier-0 Gateway must have IPv6 enabled.

• A
  13% (3)
• B
  4% (1)
• C
  78% (18)
• D
  4% (1)

Explanation

When deploying vSphere Kubernetes Service (VKS)--often referred to as Tanzu with VCF--within a Virtual Private Cloud (VPC) consumption model, the networking requirements are more stringent than a standard VM-only environment. This is because VKS relies on stateful services such as Load Balancing (via the NSX Advanced Load Balancer or the native NSX LB) and NAT to provide ingress and egress for Kubernetes pods and services. In NSX architecture, any gateway that provides stateful services must be configured in Active/Standby mode. While an Active/Active Tier-0 gateway is excellent for high-throughput ECMP routing, it cannot support stateful features because return traffic might arrive at the "Standby" (or alternative Active) node which does not share the same session state table, resulting in dropped connections. Specifically, for VKS clusters integrated with the VPC model in VCF 5.x and 9.0, the Tier-0 gateway acts as the provider-side gateway. To ensure that the Kubernetes LoadBalancer service types and SNAT/DNAT for pods function correctly and maintain session persistence, the gateway must be anchored to a specific Service Router (SR) on an Edge node. This is only possible in an Active/Standby configuration.

No community discussion yet for this question.