Tigera ads

Moving VMs to Kubernetes shouldn't mean rebuilding your security posture from zero. Migrate NSX distributed firewall policies to Calico tiers — stage them first, monitor, then enforce.

Your VMs are first-class citizens of existing VLANs — with firewall, load balancer, and DNS config you can't just discard. Calico L2 Bridge extends those VLANs into Kubernetes with IPs and L2 adjacency intact.

Segment, Tier-0/Tier-1, distributed firewall, QoS — every NSX construct maps to a Kubernetes-native outcome in Calico. Your networking knowledge is an asset in this migration, not something you leave behind.

Running separate policy models for VMs and containers is a networking tax — it multiplies your operational surface area. One Calico model spans both, across on-prem, cloud, and edge, with eBPF-powered L3-L7 visibility.

When you migrate a VM to Kubernetes, compute and storage are the easy part. The network is where migrations stall. That's because a VM's IP isn't just an address. It's referenced by firewalls, DNS, monitoring, load balancers, peer services, compliance docs. Lose it during migration and a one-team lift-and-shift turns into a multi-team network redesign per VM. Our new practitioner's guide, The Complete Guide to VM Networking for Kubernetes, is a 60-page playbook for getting this right. It follows one VM (payments-api) from current hypervisor to Kubernetes, with "try it yourself" exercises throughout. What you'll take away: ✅ A clear understanding of where KubeVirt's built-in networking falls short for real migrations — and how the secondary interface pattern (via Multus) preserves VM identity end-to-end. ✅ A framework for choosing L2 vs L3 per workload, evaluating CNI options against real requirements, and rebuilding your security posture in Kubernetes-native terms. ✅ A step-by-step migration playbook — discover, prepare, migrate, validate — plus troubleshooting recipes, observability guidance, and the anti-patterns that derail scale-up. If VM-to-Kubernetes is on your roadmap, this is the foundation worth getting right. 🔗 https://lnkd.in/ewy5k5ZH #KubeVirt #Kubernetes #VMwareMigration #NetworkSecurity Dillon Barry

Instead of building out your platform, your engineers are busy constantly reassembling a host of moving parts. Between Kubernetes minor releases, CNI updates, and service mesh upgrades, all on different schedules, the infrastructure is in constant flux. When an ingress controller breaks a CRD or the observability stack loses track of policy flows, the cost is high: your platform team spends their week writing glue code just to keep the lights on, while your application teams wait indefinitely for new features. That's the integration tax. It compounds with every cluster you add, and it doesn't show up on any invoice. It shows up in roadmap slippage and burned-out platform engineers. Veronika Smolik and Dillon Barry are running a workshop that walks you through a production reference architecture for Kubernetes networking, security, and observability. Real scenarios: multi-cluster connectivity with cluster mesh, egress gateway configuration for per-tenant IP identity, tiered network policy for microsegmentation with separation of duties, Gateway API migration, and unified observability across clusters and workload types. Each scenario maps to the maturity assessments in our reference architecture whitepaper so you leave knowing exactly where your environment stands today and what to prioritize next. From Reference Architecture to Production: A Kubernetes Workshop 🗓 May 7, 2026 · 10–11am PST | Register Now: https://lnkd.in/gdH-D_4v 🗓 May 13, 2026 · 10–11am BST | Register Now: https://lnkd.in/gFrr7cPM What does the integration tax look like in your org? Drop a comment below.