Configure VRF isolation

Overview

This guide explains how to create tenant-specific routing domains using VRFs in F5 BIG-IP Next for Kubernetes (BNK). A VRF isolates routing for each tenant, so traffic from one tenant cannot leak into another tenant’s network.

Before you begin

  • You have a running F5 BIG-IP Next for Kubernetes deployment.

  • You have kubectl access with permissions to create custom resources.

Procedure

  1. Create a VRF. Create a VRF resource for the tenant:

    apiVersion: k8s.f5net.com/v1alpha1
kind: VRF
metadata:
  name: tenant-1

    When you create this resource, the system generates a deterministic route domain ID. Other CRDs reference this VRF by its metadata.name.

  2. Associate a VLAN with the VRF. Add the vrf field to your VLAN resource to bind it to the tenant’s routing domain.

    apiVersion: k8s.f5net.com/v1alpha1
kind: F5SPKVlan
metadata:
  name: tmm-client-1
spec:
  name: tmm-client-1
  interfaces:
    - "1.1"
  selfip_v4s:
    - "11.11.11.150"
    - "11.11.11.151"
  prefixlen_v4: 24
  tag: 3710
  vrf: tenant-1

  3. Associate a static route with the VRF (optional). If you need static routes within the tenant’s routing domain, add the vrf field to your F5SPKStaticRoute resource.

    apiVersion: k8s.f5net.com/v1alpha1
kind: F5SPKStaticRoute
metadata:
  name: test-staticroute
spec:
  destination: 10.1.10.100
  type: "gateway"
  gateway: 10.1.10.1
  vrf: tenant-1

  4. Verify VRF configuration on TMM. To confirm your VRF and VLAN associations, run the following command in the TMM debug sidecar:

    ip a

Look for the VRF device and confirm the VLAN shows master :

```
7: l3-int: <NOARP,MASTER,UP,LOWER_UP> mtu 65575 qdisc noqueue state UP
8: int_vlan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master l3-int state UNKNOWN
    inet 10.0.0.167/24 brd 10.0.0.255 scope global int_vlan
```

  1. Test connectivity across VRFs. To ping an IP address in a non-default VRF, specify the VLAN or VRF interface name:

    ping -I int_vlan 10.0.0.231

Or use the VRF device name:

```shell
ping -I l3-int 10.0.0.231
```