Configure Load Balance Traffic to External Resources

Overview

F5 BIG-IP Next for Kubernetes can route traffic to application endpoints that run outside your Kubernetes cluster. These external resources might include virtual machines (VMs), bare-metal servers, or services in a different cluster.

This guide explains how to configure external resource load balancing using the following method:

  • Pool Custom Resource (CR): Specify external pool members by defining an Pool CR and associating it with your Gateway Route.

Before you begin

Make sure you have the following:

  • A running F5 BIG-IP Next for Kubernetes deployment with the CNE controller installed

  • Network connectivity: external endpoints must be Layer 3 (L3) routable from your TMM pods, with Static Routes configured, if required.

Important: The CNE controller does not configure the routes on TMM to reach the external endpoints. Set up the required Static Routes on TMM to reach the external endpoints before you proceed. Refer F5 documentation about Static Routes: https://clouddocs.f5networks.net/bigip-next-for-kubernetes/rananth-techdocs-4462/custom-resource-definitions/spk-static-Route-crd.html .

Set up a Pool CR with External Endpoints

Use this method to define external pool members and health monitors in a single custom resource.

Step 1: Create the Pool CR

  1. Create a YAML file named pool-external.yaml with the following content:

    apiVersion: "k8s.f5net.com/v1"
kind: Pool
metadata:
  name: infra-backend-pool
  namespace: spk-app-1
spec:
  members:
    - address: "10.10.10.8"
      port: 3868
    - address: "10.10.10.58"
      port: 4888
  monitors:
    tcp:
      - interval: 10
        timeout: 30
        sendString: ""
        receiveString: ""

Note: This is an example pool. Create your own pools with multiple monitors, as required.

  1. Replace the address and port values under members with the IP addresses and ports of your external endpoints.

  2. Adjust the monitors section to match your health check requirements. See section [Monitor external endpoints] (#monitor-external-endpoints) for more details.

Step 2: Apply the Pool CR

Apply the custom resource to your cluster:

`kubectl apply -f pool-external.yaml`

Step 3: Attach the Pool CR to a Gateway Route

Update your Gateway Route’s backendRefs configuration to reference the Pool CR:

Note

The Pool CR can be deployed in the same namespace as the route or in a different application namespace. If deployed in a different namespace, a ReferenceGrant resource must exist to allow the route to reference the Pool.

For more information, see: https://gateway-api.sigs.k8s.io/api-types/referencegrant/

When referencing a Pool in backendRefs, you must specify both group and kind.

Example: Gateway Route with external backendRefs

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: http-route
  namespace: spk-app-1
spec:
  parentRefs:
    - name: gateway
      sectionName: http
  rules:
    - backendRefs:
        - name: http-pool
          kind: Pool
          group: k8s.f5net.com

Monitor External Endpoints

Monitors are used to verify the availability of individual pool members. The Pool CR supports multiple monitor types, including http2, http, icmp, tcp, dns, inband, and tcpHalfOpen.

Monitor

Description

dns

Specifies the dns monitors to monitor the health of the dns service of your server pools.

http

Specifies the HTTP monitors to monitor the health of the HTTP service of your server pools.

http2

Specifies the HTTP/2 monitors to monitor the health of the HTTP/2 service of your server pools.

icmp

Specifies the icmp monitors to monitor the health of the icmp service of your server pools.

inband

Specifies the inband monitors to monitor the health of the server pools using passive monitoring based on actual traffic.

tcp

Specifies the tcp monitors to monitor the health of the tcp service of your server pools.

tcpHalfOpen

Specifies the tcp half-open monitors to monitor the health of the tcp service of your server pools.

Note: If more than one Pool CR is referenced by a Route rule, the monitor configuration must be identical across those Pool CRs. Pool CRs referenced by different route rules, or by different routes, can use different monitor configurations.

Note: Monitors configured in a Pool CR apply to all endpoints for all backendRefs in the rule. This includes internal endpoints if the rule references both a Pool CR and a Service.

Deploy Internal and External Endpoints together

You can configure Gateway Routes to direct traffic to internal endpoints (within the cluster), external endpoints, or a combination of both, depending on your deployment model.

External-only Deployments

For deployments where application endpoints are external to the cluster, a route rule can reference only a Pool CR.

Hybrid Deployments

For deployments where application endpoints exist both inside and outside the cluster, a route rule can reference both:

  • a Service (for internal endpoints), and

  • a Pool CR (for external endpoints).

Example: Gateway Route with hybrid backendRefs (internal and external)

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: http-route
  namespace: spk-app-1
spec:
  parentRefs:
    - name: gateway
      sectionName: http
  rules:
    - backendRefs:
        - name: http-pool
          kind: Pool
          group: k8s.f5net.com
        - name: http-service
          port: 8000

Load balancing across Internal and External Endpoints

To distribute traffic across both internal and external endpoints, configure a single route rule that references both a Service and a Pool CR.

Conditional Routing between Internal and External Endpoints

If traffic must be routed differently based on specific conditions, you can define separate route rules:

  • One rule references a Service (internal endpoints)

  • Another rule references a Pool CR (external endpoints)

These rules can exist within the same route or across different routes.

For more information about configuring route rule matching, see:
https://clouddocs.f5networks.net/bigip-next-for-kubernetes/rananth-techdocs-4462/how-tos/Configure-HTTP-traffic-steering-with-Gateway-API-HTTPRoute.html