F5SPKSnatpool¶

The F5SPKSnatpool Custom Resource (CR) configures the BIG-IP Next for Kubernetes Traffic Management Microkernel (TMM) to perform source network address translations (SNAT) on egress network traffic. When internal Pods connect to external resources, their internal cluster IP addresses are translated to one of the available IP address in the SNAT pool. For the full list of CRs, refer to the BIG-IP Next for Kubernetes CRs.

Note

In clusters with multiple BIG-IP Next for Kubernetes Controller instances, ensure the IP addresses defined in each F5SPKSnatpool CR do not overlap.

CR Parameters¶

This section provides a description and default value of the parameters in the F5SPKSnatpool CR.

metadata¶

Parameter	Description
name	The unique name identifying the resource. For example, egress-snatpool-cr
namespace	The namespace of Kubernetes in which the policy is applied.

spec¶

Parameter	Description	Default value
`name` string	The name of the snatpool. It must be unique for a specific snatpool. The maximum length is 255 characters.	“”
`addressList` array	The list of multiple addresses configured for the specific snatpool. You can specify ipv4 or ipv6 address. The maximum lentgh is 45. Note The `addressList` is a nested array. Each outer element maps to a TMM replica (for example, the first element maps to the first TMM). Each inner array lists the SNAT IP addresses assigned to that replica. You can mix IPv4 and IPv6 addresses within the same inner array.	[]
`sharedSnatAddressEnabled` boolean	Indicates if shared snat addresses is enabled. If enabled, the addressList supports one element which is applied on all TMM pods.	false

Scaling TMM¶

When scaling BIG-IP Next for Kubernetes TMM beyond a single instance in the Project, the F5SPKSnatpool CR must be configured to provide a SNAT pool to each TMM replica. The first SNAT pool is applied to the first TMM replica, the second snatpool to the second TMM replica, continuing through the list.

Note

When configuring SNAT pools with multiple IP subnets, ensure all TMM replicas receive the same IP subnets.

Example CR:

 apiVersion: "k8s.f5net.com/v1"
 kind: F5SPKSnatpool 
 metadata:
   name: "egress-snatpool-cr"
   namespace: f5-bnk
 spec:
   name: "egress_snatpool"
   addressList:
     - - 10.244.10.1
       - 10.244.20.1
     - - 10.244.10.2
       - 10.244.20.2
     - - 10.244.10.3
       - 10.244.20.3

Example deployment:

Referencing the SNAT Pool¶

Once the F5SPKSnatpool is configured, a virtual server is required to process the egress Pod connections, and apply the SNAT IP addresses. The spec.name value must match the spec.egressSnatpool value in the F5SPKEgress custom resource (CR) that references this SNAT pool. The F5SPKSnatpool CR works with the F5SPKEgress CR. First, create the SNAT pool to define the IP addresses. Then create the Egress CR and reference the SNAT pool by spec.name to activate the virtual server that applies the SNAT translations.

The F5SPKEgress CR creates the required virtual server, and is included in the Deployment procedure below:

Requirements¶

Make sure you have:

Installed BNK (DPU)

Deployment¶

Use the following steps to deploy the example F5SPKSnatpool CR, the required F5SPKEgress CR, and to verify the configurations.

Configure SNAT Pools using the example CR, and deploy to the same Project as the Ingress Controller. For example:

In this example, the CR installs to the default Project:

apiVersion: "k8s.f5net.com/v1"
kind: F5SPKSnatpool
metadata:
  name: "egress-snatpool-cr"
  namespace: f5-bnk
spec:
  name: "egress_snatpool"
  addressList:
    - - 10.244.10.1
      - 10.244.20.1
      - 2002::10:244:10:1
      - 2002::10:244:20:1
    - - 10.244.10.2
      - 10.244.20.2
      - 2002::10:244:10:2
      - 2002::10:244:20:2

Install the F5SPKSnatpool CR:
```
kubectl apply -f spk-snatpool-cr.yaml
```
To verify the SNAT pool IP address mappings on the TMMs:

For individual TMMs, log in to the debug sidecar and run the following command to view the SNAT pool members:
```
tmctl -w 120 -d blade pool_member_stat -s pool_name,addr
```
The addresses will be displayed as IPv6 address in hexadecimal format. For example, 10.200.3.4 address is displayed as 00:00:00:00:00:00:00:00:00:00:FF:FF:0A:C8:03:04:00:00:00:00.

Configure the F5SPKEgress CR, and install to the same Project as the Ingress Controller. For example:

apiVersion: "k8s.f5net.com/v3"
kind: F5SPKEgress
metadata:
  name: egress-cr
  namespace: f5-bnk
spec:
  egressSnatpool: "egress_snatpool"

Install the F5SPKEgress CR:

In this example, the CR file is named spk-egress-cr.yaml:
```
kubectl apply -f spk-egress-cr.yaml
```

Verify the status of the installed CR:

kubectl get f5-spk-snatpools -n f5-bnk

In this example, the CR has installed successfully.

NAME                 READY   MESSAGE                                AGE
egress-snatpool-cr   True    CR config sent to all grpc endpoints   10s

To verify connectivity statistics, log in to the Debug Sidecar:
```
kubectl exec -it deploy/f5-tmm -c debug -n <project>
```
In this example, the debug sidecar is in the default Project:
```
kubectl exec -it deploy/f5-tmm -c debug -n f5-bnk
```

Verify the internal virtual servers have been configured:

tmctl -f /var/tmstat/blade/tmm0 virtual_server_stat -s name,serverside.tot_conns

In this example, 3 IPv4 connections, and 2 IPv6 connections have been initiated by internal Pods:

name              serverside.tot_conns
----------------- --------------------
egress-ipv6                          2
egress-ipv4                          3