NSX-T Data Center REST API

Import K8s network policies to DFW Security Policies

This is used to import a set of K8s network policies into DFW security
policies
This API is only available when using VMware NSX.

Request:

Method:

POST

URI Path(s):

/policy/api/v1/infra/import-k8s-np-to-dfw
/policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/import-k8s-np-to-dfw

Request Headers:

n/a

Query Parameters:

NetworkPolicyImportRequestParameters+

NetworkPolicyImportRequestParameters (schema)

Name	Description	Type	Notes
on_error	Action to take when error occurs	string	Enum: ABORT, CONTINUE Default: "ABORT"

Request Body:

NetworkPolicyImportRequest+

NetworkPolicyImportRequest (schema)

Name	Description	Type	Notes
network_policy_ids	Set of K8s Network policy identifiers A set of network policy UUIDs that has to be imported to NSX SecurityPolicy	array of string	Required Maximum items: 5000
sequence_number_lower	The sequence number at which the drop policy is placed This is an optional field. If specified, the "drop" action policy will be placed at this position. If unspecified, the drop policy will be created after its corresponding allow policy. The default-drop policies' sequence_number = last existing policy sequence_number + 2. If you specify the sequence numbers explicitly, you must specify both sequence_number_upper and sequence_number_lower at the same time. The sequence_number_lower must be greater than sequence_number_upper.	int
sequence_number_upper	The sequence number at which the allow policy is placed This is an optional field. If specified, the "allow" action policy will be placed at this position. If unspecified, the import API should find the lowest existing copy-span security policy applied to the original container cluster, and put the imported policies behind it. The allow policies' sequence_number=last existing copy-span policy sequence_number + 1	int

Example Request:

{ "network_policy_ids" : ["550e8400-e29b-41d4-a716-446655440000", "123e4567-e89b-12d3-a456-426655440000"], "sequence_number_upper" : 100, "sequence_number_lower" : 200 }

Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

NetworkPolicyImportResponse+

NetworkPolicyImportResponse (schema)

Name	Description	Type	Notes
errors	List of errors, if any specific to networkpolicy Contains a list of errors against each of the network policy id that failed during import.	array of ImportErrorMessage
errors_general	List of general errors contains a list of errors agains general errors	array of ImportErrorMessage
request_count	The total number of network policies in the import request This is the count of the network policies that were contained in the import request	int
success_count	The count of successfully imported policies The count of the successfully imported network policies.	int

Example Response:

{ "request_count": 2, "success_count": 1, "errors_general": [ {"error_code": "err-2100", "error_message": ["general error when calling ImportK8SNPtoDFW"]} ] "errors": [ { "network_policy_id": "123e4567-e89b-12d3-a456-426655440000", "errors": { {"error_code": "err-1234", "error_message": ["Network Policy rule name "rule1": feature A is not supported"]}, {"error_code": "err-1235", "error_message": ["Network Policy rule name "rule2": feature B is not supported"]} } } ] }

Required Permissions:

crud

Feature:

policy_dfw

Additional Errors:

• 404 Not Found
• 301 Moved Permanently
• 307 Temporary Redirect
• 400 Bad Request
• 403 Forbidden
• 409 Conflict
• 412 Precondition Failed
• 500 Internal Server Error
• 503 Service Unavailable