VM Migration to Kubernetes
Move VMs to Kubernetes without breaking everything around them. Preserve VM network identity, translate existing security policy, and run VMs and containers on the same cluster.
Your connectivity and security model lives in NSX constructs Kubernetes doesn’t have.
When VMs land on Kubernetes with default pod networking, the NSX constructs they depended on such as segments, gateways and the distributed firewall have no default equivalent. Teams are looking at rebuilding each NSX outcome by hand, or even re-architecting their network.
A VM’s network identity is embedded across dozens of systems.
When a VM migrates to Kubernetes with default pod networking, it gets a new IP from the cluster CIDR. The original IP is gone. Every system that referenced it is now pointing at nothing.
A migration budgeted as a lift-and-shift gets delivered as a network redesign — per VM. At scale, the coordination cost makes migration impractical.
Benefits
Migrate VMs to Kubernetes with their network identity, security model, and operational continuity intact.
Preserve VM network identity
VMs retain their original IP and VLAN membership. Nothing upstream changes. Firewalls stay the same. DNS stays the same. Peer services don’t notice.
One platform for VMs and containers
Run both migration paths on the same cluster, with the same policy model and the same observability tooling.
Move now. Modernise later.
Migrate with L2 to preserve identity and avoid cross-team coordination. Modernise to Services and label-based policy when the organisation is ready.
Features
What Calico provides for VM migration to Kubernetes.
Calico L2 Bridge Mode
Calico L2 Bridge Mode is designed to extend existing VLANs into Kubernetes so VMs retain their original IP and VLAN membership by supporting live migration — the IP and VLAN follow the workload when it moves between nodes, with no NAT and no enforcement gap.
The upstream network sees no change. payments-api is still 10.10.5.42 on VLAN 100. The firewall doesn’t know it moved.
Both L2 and L3, on the same cluster
Calico offers both L3 (BGP, VXLAN, IPIP) and L2 (L2 Bridge Mode) networking. Some VMs need L2 now and L3 later. Some can go straight to L3.
Calico supports both on the same cluster, with the same policy model and the same observability tooling. The choice is a per-workload scoping exercise — not a platform-wide decision.
Tiered and staged policies
Calico supports tiered/hierarchical policies and staged policy validation, useful for teams translating NSX rules.
Staged policies evaluate real production traffic but don’t enforce decisions — they log what would have been allowed or denied. Deploy a translated rule in staging mode, observe its impact for days or weeks, and promote it to enforcement only with production evidence.
eBPF-based observability for every workload
Flow logs show source, destination, port, protocol, and whether traffic was allowed or denied by policy. Some flows include L7 visibility (HTTP method, path, response code), service topology graphs, and policy hit-count metrics.
Invest in flow logs early — they’re the single most valuable data source for network troubleshooting and compliance.
Runs on any Kubernetes distribution
Calico runs on any Kubernetes distribution. The same CNI, the same policy model, and the same operational tooling — wherever your VMs land.
Your NSX design already has a Calico equivalent
NSX concepts like segments, gateways, and the distributed firewall map cleanly to Calico primitives. This table shows what each becomes; the migration itself is still phased work, done segment by segment.
| NSX concept | Calico Enterprise / Kubernetes capability | Architectural outcome |
|---|---|---|
| Segment | Calico Networks | Workloads attach to defined networks with clear connectivity and policy intent. |
| Segment subnet / CIDR | Calico IPPool | Workload addresses are allocated from a defined IP address pool or range. |
| VLAN-backed Segment | Calico L2 Bridge | Existing underlay VLANs can be extended into Kubernetes for VMs that require L2 continuity (network stretching). |
| Overlay Segment | Calico Overlay Network | Create dedicated virtual networks for tenants, applications, business units, etc. without depending on the physical network. |
| Tier-0 Gateway | Calico BGP | Kubernetes-hosted workload networks can exchange routes with the external network. |
| Tier-1 Gateway | Calico Multi-VRF (tenant routing domain), Routing Policies, and Egress Gateway | Tenant or application routing domains can be isolated and advertised independently. |
| Distributed Firewall | Calico NetworkPolicy, DNS Policies, Tiers, and Staged Network Policies | East-west traffic can be controlled close to workloads using workload identity and selectors. |
| Gateway Firewall and NAT | Calico Egress Gateways and DNS Policies | North-south traffic can be controlled with predictable source identity and policy enforcement. |
| NSX Advanced Load Balancer / AVI | Calico Load Balancer and Calico Ingress Gateway | Kubernetes-native application delivery can provide stable VIPs, L4 load distribution, L7 routing, and upstream reachability. |
| QoS | Calico QoS | Bandwidth, packet rate, connection limits, and traffic markings can be applied to workloads. This guarantees network performance. |
| Traceflow and Flow Visibility | Calico Service Graph, Dashboards, and Packet Capture | Architects and operators can validate application flows with Kubernetes workload context. |
Network concept translation
How traditional VM-networking concepts map to Kubernetes equivalents.
| VM world | Kubernetes equivalent | What changes |
|---|---|---|
| VLAN | L2 bridge / L2 overlay / VLAN underlay (CNI-dependent) | Depends on CNI and L2/L3 choice |
| VM NIC (fixed IP) | Secondary interface via Multus | Preservation depends on CNI |
| Distributed firewall / NSX | Kubernetes NetworkPolicy + CNI extensions | Model shifts: IP-based → label-based |
| Firewall sections (ordered) | Tiered/hierarchical policies (if CNI supports) | Requires CNI with tier support |
| vMotion | KubeVirt live migration | IP changes by default — CNI must handle |
| NSX microsegmentation | eBPF or OVN ACL-based policy | Applied at hypervisor level, no agents in VM |
| Flow logs / SIEM feeds | CNI flow logs + Prometheus metrics | Different sources, same compliance purpose |
| Port groups / vDS | NetworkAttachmentDefinition + Multus | Declarative K8s resources replace GUI config |
Resources
Practitioner-built resources for VM migration to Kubernetes.
The complete guide to VM networking for Kubernetes
A practitioner’s guide to migrating, securing, and operating VM networking on Kubernetes — told through one VM’s journey.
Read MoreLift and Shift VMs to Kubernetes with Calico L2 Bridge Networks
Calico L2 Bridge Networks demonstrated — live migration, policy enforcement, and VLAN extension. By Aadhil Abdul Majeed.
Read MoreCalico L2 bridge networking for virtual machines
An on-demand technical demonstration of L2 Bridge Mode, live migration, policy enforcement, and VLAN extension.
Watch the WebinarMove now. Modernise later. On your own timeline.
When you’re ready to discuss migrations against your own VM estate, contact our team for a technical walkthrough.
