This is unreleased documentation for SUSE® Virtualization v1.9 (Dev).

Underlay and Overlay Networking for Guest Clusters

SUSE® Rancher Prime provides centralized management for Kubernetes clusters across multiple environments. When integrated with SUSE Virtualization, Rancher can provision guest Kubernetes clusters directly on virtual machine infrastructure managed by SUSE Virtualization.

Using the Harvester Node Driver, Rancher automatically creates virtual machines that serve as control plane and worker nodes. This simplifies cluster deployment and lifecycle management by providing a single interface for infrastructure and Kubernetes operations.

While guest clusters can use traditional virtual machine networking, they can also leverage Kube-OVN overlay or underlay networking to provide a flexible and Kubernetes-native networking model for workloads.

Guest cluster deployment on underlay networks

Deploying guest clusters on pure underlay networks is functionally similar to using traditional virtual machine VLAN networks, but with the added advantages of Kube-OVN features such as network policies and tenant-isolated VPCs.

For information about setting up the overlay infrastructure, see Underlay configuration.

Guest cluster deployment on overlay networks

Deploying guest clusters on overlay networks requires configuring a VPC NAT gateway to provide inbound and outbound connectivity to the virtual machines through DNAT and SNAT.

The key architectural features are as follows:

  • SUSE Virtualization provides the virtual machine infrastructure where the guest cluster control plane and worker nodes run.

  • Rancher is responsible for provisioning and managing the lifecycle of the guest Kubernetes cluster.

  • Kube-OVN provides the network connectivity for the virtual machines hosting the guest nodes through its overlay network between SUSE Virtualization hosts.

  • The guest cluster CNI (for example, Calico) manages pod networking, while pod traffic is transported over the underlying Kube-OVN-provided VM network.

Kube-OVN overlay networking enables guest clusters to manage pod networking independently of the underlying SUSE Virtualization infrastructure network. This provides the following operational benefits:

  • Simplified cluster deployment

  • Reduced dependence on physical network configuration

  • Dynamic cluster scaling without additional VLAN planning

  • Consistent networking model across environments

For information about setting up the overlay infrastructure, see Creating a VPC NAT gateway.

Guest cluster provisioning

Importing SUSE Virtualization clusters into Rancher

SUSE Virtualization clusters are imported through Rancher’s Virtualization Management interface.

The following occur after a cluster is imported:

  • Rancher recognizes the cluster as a SUSE Virtualization provider.

  • Virtual machine resources become available through Rancher.

  • SUSE Virtualization can be selected as an infrastructure provider when creating downstream clusters.

For detailed instructions, see Virtualization Management.

Provisioning a guest cluster

Rancher uses the Harvester Node Driver to automatically provision the required virtual machines and bootstrap Kubernetes on them.

For detailed instructions, see Creating an RKE2 Kubernetes Cluster.

In the Networks section of the cluster creation screen, you must specify the correct underlay or overlay network.

For virtual machines provisioned as downstream cluster nodes, ensure external connectivity by enabling DHCP, specifying a valid dns_server IP address (for example, 8.8.8.8), and setting natOutgoing=true on the subnet. This configuration ensures that nodes obtain a default route, perform DNS resolution, and access external networks.
Guest cluster deployment on overlay network
Virtual machine provisioned as a downstream cluster node

Because guest cluster nodes on Kube-OVN overlay networks use private IP addresses, you must configure a route to the virtual machine node subnet on the Rancher virtual machine, specifying the Kube-OVN EIP (configured during VPC NAT gateway EIP setup) as the next hop. This ensures network reachability between the Rancher virtual machine and guest cluster nodes, enabling SSH access through the Rancher UI for debugging.