Activate BIG-IP Next for Kubernetes License¶

Prerequisites

Ensure that you have:

Installed the BIG-IP Next for Kubernetes software.
Installed the BIG-IP Next for Kubernetes CWC.
Obtained the JWT for this cluster from your MyF5 account.

Collect REST API info¶

Licensing the BIG-IP Next for Kubernetes software requires querying the CWC REST API to determine the cluster’s licensing status, and uploading a valid license. To authenticate the CWC REST API, the SSL/TLS certificates and the IP address of the API interface must first be obtained. Use the steps below to obtain the REST API information.

Note: All requests to the CWC and QKView API require authentication using the Admin Token. For more information on retrieving and using the token, see the Admin Access and API Restrictions.

Create a new directory for the CWC REST API certificates:
```
mkdir -p $HOME/cwc/cwc_api
```

Copy each of the certificates into the new directory (see Create CWC REST API certificates section in Create Cluster Wide Controller Certificates):

cp api-server-secrets/ssl/client/certs/client_certificate.pem $HOME/cwc/cwc_api

cp api-server-secrets/ssl/ca/certs/ca_certificate.pem $HOME/cwc/cwc_api

cp api-server-secrets/ssl/client/secrets/client_key.pem $HOME/cwc/cwc_api

Create a bash file with the below code.

Note: All requests to the CWC and QKView API require authentication using the Admin Token. For more information on retrieving and using the token, see the Admin Access and API Restrictions.

CWC_CERT_PATH="${CWC_CERTS:-$HOME/cwc/cwc_api}"

NODE=$(kubectl -n f5-utils get pod -l app=cwc -o jsonpath='{.items[0].status.hostIP}')

CURL_CMD=(
   curl --cacert "$CWC_CERT_PATH"/ca_certificate.pem \
      --cert "$CWC_CERT_PATH"/client_certificate.pem \
      --key "$CWC_CERT_PATH"/client_key.pem \
      -H "Authorization: Bearer [admin_token]" \
      --resolve f5-spk-cwc.f5-utils:30881:"$NODE"
)

"${CURL_CMD[@]}" https://f5-spk-cwc.f5-utils:30881/"$@"

Run the bash script using the file you have created.

./cwc-api.sh status | jq

Sample Output

{
"Status": {
   "ClusterDetails": {
      "Name": "My Cluster"
   },
   "LicenseDetails": {
      "DigitalAssetID": "5c367e83-b6cf-4a28-9899-8a3a98b65460",
      "EntitlementType": "eval",
      "LicenseExpiryDate": "2025-02-21T20:01:18Z",
      "LicenseExpiryInDays": "0"
   },
   "LicenseStatus": {
      "State": "Verification Complete"
   }
},
"TelemetryStatus": {
   "NextReport": {
      "StartDate": "2025-02-22 19:55:43 +0000 UTC",
      "EndDate": "2025-02-28 19:55:43 +0000 UTC",
      "State": "Telemetry In Progress"
   }
}
}

Obtain the name of the CWC Pod in the cluster:

In this example, the CWC is in the f5-utils Project.
```
kubectl get pods -n f5-utils | grep f5-spk-cwc
```
In this example, the CWC Pod is named f5-spk-cwc-86d89c4548-fmwpl.
```
f5-spk-cwc-86d89c4548-fmwpl   2/2     Running
```
Obtain the IP address of the node the CWC Pod is scheduled on:

In this example, the CWC is in the f5-utils Project.
```
kubectl describe pod f5-spk-cwc-86d89c4548-fmwpl -n f5-utils | grep Node:
```
In this example, the CWC Pod is running on arm64-sm-3 node with IP address 10.144.47.147.
```
Node:             arm64-sm-3/10.144.47.147
```
Edit the hosts file on your system, or setup DNS resolution mapping the node IP address to the CWC’s hostname:

Important: The CWC hostname is required for SSL/TLS certiicate validation.
```
10.144.47.147 f5-spk-cwc.<project>
```
In this example, the CWC is in the f5-utils Project.
```
10.144.47.147 f5-spk-cwc.f5-utils
```

License the cluster in Connected Mode¶

Once you choose to install BIG-IP Next for Kubernetes with the configured as “connected mode”, the clusters will be licensed in Connected Mode without any additional steps. For more information, see . To verify the cluster’s license, use the following command:

Note: All requests to the CWC and QKView API require authentication using the Admin Token. For more information on retrieving and using the token, see the Admin Access and API Restrictions.

curl --key cwc_api/client_key.pem \
   --cert cwc_api/client_certificate.pem \
   --cacert cwc_api/ca_certificate.pem \
   -H "Authorization: Bearer [admin_token]" \
   https://f5-spk-cwc.f5-utils:30881/status | jq

The command output indicates the EntitlementType is paid and the LicenseExpiryDate is 2024-03-05. The LicenseExpiryInDays shows expiration occurs in 362 days.

{
"Status": {
   "ClusterDetails": {
      "Name": "My Cluster"
   },
   "LicenseDetails": {
      "DigitalAssetID": "5c367e83-b6cf-4a28-9899-8a3a98b65460",
      "EntitlementType": "eval",
      "LicenseExpiryDate": "2025-02-21T20:01:18Z",
      "LicenseExpiryInDays": "0"
   },
   "LicenseStatus": {
      "State": "Verification Complete"
   }
},
"TelemetryStatus": {
   "NextReport": {
      "StartDate": "2025-02-22 19:55:43 +0000 UTC",
      "EndDate": "2025-02-28 19:55:43 +0000 UTC",
      "State": "Telemetry In Progress"
   }
}
}

License the cluster in FLP Mode¶

Use the following instructions to license a cluster in FLP Mode:

Install and configure F5 License Proxy (FLP), see Install and configure F5 License Proxy (FLP).

Update license.licenseserverrootca parameter with FLP RootCA in flo-value.yaml, see Install F5 Lifecycle Operator. The BNK cluster needs FLP RootCA to trust server cert of F5 License Proxy.

Note: Ensure you login to the FLP on VM and execute the below command.

setup --print-ca

Sample Output

Secret 'flp-mtls-secret' exists.
CA certificate found, decoding from Base64...
-----BEGIN CERTIFICATE-----
MIICLzCCAdWgAwIBAgIUA48LLaJoJeOQ9WGYMqGRY2CGfkcwCgYIKoZIzj0EAwIw
bTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1Nl
YXR0bGAgEGCCqGSM49AwEHA0IABFWNOAU5ieEIasdsfNUfnkRajgsdySjyhmPnbat
-----END CERTIFICATE-----

Set the license.operationMode to f5licenseproxy in flo-value.yaml, see Install F5 Lifecycle Operator.