Configure network infrastructure with the Infra CRD

Overview

The Infra Custom Resource (CR) defines the underlay network configuration for your F5 BIG-IP Next for Kubernetes (BNK) installation. This includes IP Address Management (IPAM) pools, network attachments, Virtual Routing and Forwarding (VRF) instances, VLAN and VXLAN networks, and static routes.

Complete this task before you create GatewaySettings, Gateway, or EgressGateway resources.

Before you begin

Make sure you have the following:

  • BNK is installed.

  • A GatewayClass resource exists that references the CNE controller.

  • You have the required permissions to create resources in the BNK namespace.

  • You have collected the following information from your network environment:

    • Kubernetes NetworkAttachmentDefinition names for each network interface

    • IP address pools (CIDR ranges or explicit start/end ranges) for VLANs, VXLANs, SNAT pools, and listener addresses

    • VLAN tags for each VLAN network

    • VXLAN Network Identifiers (VNIs) for each VXLAN network

    • Static route destinations and next-hop addresses (if applicable)

    • VRF names and isolation requirements (if you need tenant isolation)

Create the Infra CR

  1. Define IPAM pools

The ipams section manages IP address allocation. Define one or more named IPAM configurations, each with one or more IP pools.

You can define pools using either CIDR notation or an explicit address range. These two modes are mutually exclusive within a single pool entry.

spec:
  ipams:
    - name: client-pool
      infobloxNetview: "default"
      ipPools:
        - cidr: 11.11.11.0/24
    - name: server-pool
      infobloxNetview: "default"
      ipPools:
        - cidr: 22.22.22.0/24
        - cidr: 2002::22:22:22:0/112
    - name: listener-pool
      infobloxNetview: "default"
      ipPools:
        - rangeStart: 10.20.30.100
          rangeEnd: 10.20.30.200

Note

  • Give each IPAM entry a descriptive name. You will reference these names in network definitions and in GatewaySettings CRs.

  • Use the availabilityZone field when you need zone-aware address allocation (for example, us-east-1a).

  • The infobloxNetview field defaults to "default". Set a different value if you use multiple Infoblox network views to partition address allocation by tenant.

  1. Define network attachments

The networkAttachments section maps logical names to Kubernetes NetworkAttachmentDefinition resources. Networks reference these logical names instead of pointing directly to NetworkAttachmentDefinitions.

spec:
  networkAttachments:
    - name: client-attach
      networkAttachmentDefinitions:
        - name: sriov-client-netattach
    - name: server-attach
      networkAttachmentDefinitions:
        - name: sriov-server-netattach

  1. Configure VRFs (optional)

If you need network isolation between tenants, define one or more VRF instances. Networks and static routes can reference these VRFs to create separate routing domains.

spec:
  vrfs:
    - name: tenant-a-vrf
      strictIsolation: true
    - name: tenant-b-vrf
      strictIsolation: true

When strictIsolation is true (the default), route leaking and shared interfaces are not permitted across VRFs.

Skip this step if you don’t need tenant isolation. Networks and routes that don’t reference a VRF use the default routing domain.

  1. Step 4: Define networks

The networks section configures VLAN and VXLAN network definitions. Each entry must specify a type of either vlan or vxlan, along with the corresponding settings.

VLAN example:

spec:
  networks:
    - name: tmm-client
      type: vlan
      vlan:
        tag: 20
        mtu: 1500
        networkAttachmentRef:
          name: client-attach
        ipamRefs:
          - name: client-pool
        vrfRef:
          name: tenant-a-vrf

VXLAN example:

spec:
  networks:
    - name: tmm-tunnel
      type: vxlan
      vxlan:
        vni: 102
        mtu: 1450
        port: 4789
        ipamRefs:
          - name: server-pool
        vtepIpamRefs:
          - name: vtep-pool
        vrfRef:
          name: tenant-a-vrf

Note

  • Set tag to 0 (or omit it) for an untagged VLAN.

  • For VXLAN, use vtepIpamRefs to allocate tunnel endpoint (VTEP) IP addresses separately from the VXLAN self IP addresses in ipamRefs.

  • Each network name must be unique across the entire Infra CR.

  1. Add static routes (optional)

Define static routes to direct traffic to specific destinations. Each route must specify either a nextHop IP address or a networkRef for directly connected routes. These options are mutually exclusive.

spec:
  staticRoutes:
    - name: default-route
      destination: 0.0.0.0/0
      nextHop: 22.22.22.1
    - name: connected-route
      destination: 10.100.0.0/16
      networkRefs:
        - name: tmm-client
      vrfRef:
        name: tenant-a-vrf

  1. Apply the Infra CR

Save the complete Infra CR to a YAML file and apply it in the BNK namespace:

kubectl apply -f infra.yaml -n bnk-system

Verify the configuration

Check that the controller accepted and programmed the Infra CR:

kubectl get infra -n bnk-system

The output should show Programmed as True:

NAME    PROGRAMMED   MESSAGE                              AGE
infra   True         Configuration successfully sent ...   30s

For detailed status, inspect the CR:

kubectl describe infra infra -n bnk-system

Review the following status conditions:

Condition

Expected status

What it means

Accepted

True

The CR is syntactically valid and accepted by the controller.

ResolvedRefs

True

All referenced resources (network attachments, IPAM pools) have been resolved.

Programmed

True

The configuration has been sent to TMM.

If any condition shows False or Unknown, check the message and reason fields for details about the issue.

Also review per-resource status sections (networks, ipams, staticRoutes, vrfs, networkAttachments) to confirm that each individual resource was configured correctly.

Complete example

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: Infra
metadata:
  name: infra
  namespace: bnk-system
spec:
  ipams:
    - name: client-pool
      infobloxNetview: "default"
      ipPools:
        - cidr: 11.11.11.0/24
    - name: server-pool
      infobloxNetview: "default"
      ipPools:
        - cidr: 22.22.22.0/24
        - cidr: 2002::22:22:22:0/112
    - name: listener-pool
      infobloxNetview: "default"
      ipPools:
        - cidr: 22.22.22.0/24

  networkAttachments:
    - name: client-attach
      networkAttachmentDefinitions:
        - name: sriov-client-netattach
    - name: server-attach
      networkAttachmentDefinitions:
        - name: sriov-server-netattach

  networks:
    - name: tmm-client
      type: vlan
      vlan:
        tag: 20
        mtu: 1500
        networkAttachmentRef:
          name: client-attach
        ipamRefs:
          - name: client-pool
    - name: tmm-server
      type: vlan
      vlan:
        tag: 0
        mtu: 1500
        networkAttachmentRef:
          name: server-attach
        ipamRefs:
          - name: server-pool

  staticRoutes:
    - name: default-route
      destination: 0.0.0.0/0
      nextHop: 22.22.22.1