VM Migration to Kubernetes
Move VMs to Kubernetes without breaking everything around them. Connect, secure, and observe your VMs the way you do today. Preserve VM network identity, translate existing security policy, and run VMs and containers on the same cluster.
A VM’s network identity is embedded across dozens of systems.
When a VM migrates to Kubernetes with default pod networking, it gets a new IP from the cluster CIDR. The original IP is gone. Every system that referenced it is now pointing at nothing.
A migration budgeted as a lift-and-shift gets delivered as a network redesign — per VM. At scale, the coordination cost makes migration impractical.
Benefits
Preserve VM network identity
VMs retain their original IP and VLAN membership. Nothing upstream changes. Firewalls stay the same. DNS stays the same. Peer services don’t notice.
One platform for VMs and containers
Run both migration paths on the same cluster, with the same policy model and the same observability tooling.
Move now. Modernise later.
Migrate with L2 to preserve identity and avoid cross-team coordination. Modernise to Services and label-based policy when the organisation is ready.
Features
What Calico provides for VM migration to Kubernetes.
Calico L2 Bridge Mode
Calico L2 Bridge Mode is designed to extend existing VLANs into Kubernetes so VMs retain their original IP and VLAN membership by supporting live migration — the IP and VLAN follow the workload when it moves between nodes, with no NAT and no enforcement gap.
The upstream network sees no change. payments-api is still 10.10.5.42 on VLAN 100. The firewall doesn’t know it moved.
Both L2 and L3, on the same cluster
Calico offers both L3 (BGP, VXLAN, IPIP) and L2 (L2 Bridge Mode) networking. Some VMs need L2 now and L3 later. Some can go straight to L3.
Calico supports both on the same cluster, with the same policy model and the same observability tooling. The choice is a per-workload scoping exercise — not a platform-wide decision.
Tiered and staged policies
Calico supports tiered/hierarchical policies and staged policy validation, useful for teams translating NSX rules.
Staged policies evaluate real production traffic but don’t enforce decisions — they log what would have been allowed or denied. Deploy a translated rule in staging mode, observe its impact for days or weeks, and promote it to enforcement only with production evidence.
eBPF-based observability for every workload
Flow logs show source, destination, port, protocol, and whether traffic was allowed or denied by policy. Some flows include L7 visibility (HTTP method, path, response code), service topology graphs, and policy hit-count metrics.
Invest in flow logs early — they’re the single most valuable data source for network troubleshooting and compliance.
Runs on any Kubernetes distribution
Calico runs on any Kubernetes distribution. The same CNI, the same policy model, and the same operational tooling — wherever your VMs land.
Network concept translation
How traditional VM-networking concepts map to Kubernetes equivalents.
| VM world | Kubernetes equivalent | What changes |
|---|---|---|
| VLAN | L2 bridge / L2 overlay / VLAN underlay (CNI-dependent) | Depends on CNI and L2/L3 choice |
| VM NIC (fixed IP) | Secondary interface via Multus | Preservation depends on CNI |
| Distributed firewall / NSX | Kubernetes NetworkPolicy + CNI extensions | Model shifts: IP-based → label-based |
| Firewall sections (ordered) | Tiered/hierarchical policies (if CNI supports) | Requires CNI with tier support |
| vMotion | KubeVirt live migration | IP changes by default — CNI must handle |
| NSX microsegmentation | eBPF or OVN ACL-based policy | Applied at hypervisor level, no agents in VM |
| Flow logs / SIEM feeds | CNI flow logs + Prometheus metrics | Different sources, same compliance purpose |
| Port groups / vDS | NetworkAttachmentDefinition + Multus | Declarative K8s resources replace GUI config |
Resources
Practitioner-built resources for VM migration to Kubernetes.
Lift and Shift VMs to Kubernetes with Calico L2 Bridge Networks
Calico L2 Bridge Networks demonstrated — live migration, policy enforcement, and VLAN extension. By Aadhil Abdul Majeed.
Read MoreCalico L2 bridge networking for virtual machines
An on-demand technical demonstration of L2 Bridge Mode, live migration, policy enforcement, and VLAN extension.
Watch the WebinarMove now. Modernise later. On your own timeline.
When you’re ready to discuss migrations against your own VM estate, contact our team for a technical walkthrough.
