Configure global BGP routing

Overview

F5 BIG-IP Next for Kubernetes (BNK) supports BGP Unnumbered, which simplifies BGP peering by using IPv6 link-local addresses (LLAs) instead of assigned IP addresses.

This guide explains how to create the global BGP configuration for your cluster. The GlobalRoutingConfig resource is a singleton — you create it once, and all tenant routing configurations depend on it.

Before you begin

  • You have a running F5 BIG-IP Next for Kubernetes deployment.

  • You have kubectl access to the cluster with permissions to create custom resources.

  • You understand basic BGP concepts such as Autonomous System Numbers (ASNs), neighbors, and address families.

Procedure

  1. Create a RoutingTemplate that defines how the controller renders your BGP configuration. The template uses Go template syntax.

    apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingTemplate
metadata:
  name: ocnos-routing-template
spec:
  body: |
    router bgp {{ .global.spec.bgp.startASN }}
    {{- if .global.spec.bgp.neighbors }}
    {{- range $nbr := .global.spec.bgp.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} remote-as {{ $nbr.remoteAs }}
    {{- end }}
    {{- range $nbr := .global.spec.bgp.neighbors }}
    {{- $peerId := (or $nbr.ip $nbr.interface) }}
    {{- if $nbr.families }}
    {{- range $fam := $nbr.families }}
    address-family {{ $fam }}
      neighbor {{ $peerId }} activate
    exit-address-family
    {{- end }}
    {{- else }}
    address-family ipv4-unicast
      neighbor {{ $peerId }} activate
    exit-address-family
    {{- end }}
    {{- end }}
    {{- end }}
    exit

  2. Create a BGP neighbor secret. If your BGP neighbors require authentication, create a Kubernetes Secret to store the password.

    apiVersion: k8s.f5net.com/v1alpha1
kind: Secret
metadata:
  name: bgp-global-auth
type: Opaque
stringData:
  slot0: "your-bgp-password"

  3. Create the GlobalRoutingConfig. Define your global BGP settings, including the ASN range, IP subnet, neighbors, and authentication secrets.

    apiVersion: k8s.f5net.com/v1alpha1
kind: GlobalRoutingConfig
metadata:
  name: global-config
spec:
  templateRef:
    name: ocnos-routing-template
  bgp:
    startASN: 65001
    endASN: 65002
    routerIdSubnet: 22.22.22.0
    routerIdPrefix: 24
    neighbors:
      - ip: 198.51.100.10
        remoteAs: 65110
        families: ["ipv4-unicast", "l2vpn-evpn"]
  neighborSecrets:
    - address: 198.51.100.10
      secretRef:
        name: bgp-global-auth
        key: slot0

  4. Verify the configuration status. Check that the GlobalRoutingConfig was delivered successfully:

    kubectl get globalroutingconfig global-config -o yaml

Look for a status indicating the configuration was delivered to the TMM routing container.

Important

Do not create RoutingConfig resources until the GlobalRoutingConfig shows success status.

Sample EVPN files

You can download these sample EVPN configuration files.