Configure tenant BGP routing

Overview

This guide explains how to create tenant-specific BGP routing configurations in F5 BIG-IP Next for Kubernetes (BNK). Each tenant gets its own RoutingConfig resource with BGP neighbors and VXLAN/VRF associations.

Before you begin

  • The GlobalRoutingConfig resource exists and shows a successful status.

  • You have created any required Vrf and Vxlan resources for the tenant (see related how-to guides).

  • You have kubectl access with permissions to create custom resources.

Procedure

  1. Create a tenant routing template. If the tenant requires a different template from the global configuration, create a tenant-specific RoutingTemplate:

    apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingTemplate
metadata:
  name: ocnos-tenant-template
spec:
  body: |
    {{- $t := .tenant.spec -}}
    router bgp {{ .global.spec.bgp.startASN }}
    {{- range $nbr := default (list) $t.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} remote-as {{ $nbr.remoteAs }}
    {{- end }}
    exit

    If the global template works for your tenant, you can reference it instead.

  2. Create a tenant RoutingConfig (Option 1 — vxlanRef). This is the preferred approach. Reference an existing VXLAN CR:

    apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingConfig
metadata:
  name: tenant-a
spec:
  templateRef:
    name: ocnos-tenant-template
  vxlanRef: vxlan-tenant-a
  neighbors:
    - ip: 198.51.100.1
      remoteAs: 65100
      families: ["ipv4-unicast"]
  neighborSecrets:
    - address: 198.51.100.1
      secretRef:
        name: tenant-a-bgp-auth
        key: slot0

  3. Verify the configuration

    kubectl get routingconfig tenant-a -o yaml

Updating a tenant configuration

You cannot update RoutingConfig resources. To make changes:

  • Delete the existing RoutingConfig

    kubectl delete routingconfig tenant-a

  • Create a new RoutingConfig with the updated values.

Important

If you delete the GlobalRoutingConfig, all associated RoutingConfig resources are also deleted.