Distributed Active Network Monitoring with nmaas – Insights from an NREN production deployment#

Firat Koyuncu (GIP RENATER), Vojdan Kjorveziroski (UKIM)

• Why: A production case of multi-cluster Kubernetes used to solve a real fleet problem — plus one of the better-documented VMware→Kubernetes migration rationales you'll find.
• What: RENATER's perfSONAR estate had decayed: 40 servers acquired in 2017 had shrunk to ~10 deployed with no software alignment, heterogeneous local credentials (iDRAC, OS), and a perfSONAR service that "globally was not working." After the Broadcom/VMware licensing changes destroyed trust in the hypervisor path, RENATER rebuilt on Kubernetes (Talos Linux immutable nodes with KubeVirt on bare-metal servers) and used nmaas — an open-source multi-tenant PaaS with multi-cluster support — to deploy perfSONAR nationwide, with webhook-driven automation for centralized lifecycle management of edge measurement nodes.
• How: Foundations: NetBox as source of truth, consolidated via Maat; declarative GitOps deployment; Apache Airflow as the workflow engine gluing source-of-truth, ticketing, and the platform ("no significant development required — integration only"). nmaas onboards remote K8s clusters per domain so applications run on-premise at the edge — eliminating site-to-site VPNs and giving local plus external vantage points.
• Where applicable: RENATER/nmaas-specific deployment, but both the platform (open-source nmaas) and the stack pattern (SoT + GitOps + Airflow + immutable K8s at the edge) are directly reusable. The "fleet of identical clusters" observation is the transferable design principle.