License your cluster¶

Decide which licensing mode to use¶

Decide which licensing mode is better for you:

Licensing mode	Description
Connected	F5 Cluster-Wide Controller (CWC) connects directly to the F5 licensing server via the public internet.
Disconnected	Your cluster is not connected to the public internet. You must manually perform licensing for your cluster.

Create a manifest for the cluster license¶

In a terminal window on your computer, make sure you’re in the release-manifest directory.
Create a file to use as the manifest for the cluster license:
```
touch f5-cne-cluster-license.yaml
```
Open the file in a text editor.

Add the following information to the file:

apiVersion: k8s.f5net.com/v1
kind: License
metadata:
  name: f5-cne-cluster-license
spec:
  operationMode: "connected"
  jwt: "<LICENSE_KEY>"

If you want to use disconnected mode instead of connected mode as your licensing mode, change the value of .spec.operationMode to disconnected.

For help deciding which mode to use, see Decide which licensing mode to use.
Replace <LICENSE_KEY> with the license key (JSON Web Token, or JWT) you downloaded from MyF5.

Note

Make sure the license key is enclosed in quotation marks.
Save and close the file.

Create the cluster license¶

In a terminal window on your computer, make sure you’re in the release-manifest directory.

Trigger F5 CWC (in the f5-cne-core namespace) to create the cluster license:

kubectl apply -f f5-cne-cluster-license.yaml \
  --namespace f5-cne-core

(Disconnected mode only) License your cluster manually¶

In a terminal window on your computer, make sure you’re in the release-manifest directory.

Determine the state of the license:

kubectl get license.k8s.f5net.com f5-cne-cluster-license \
  --namespace f5-cne-core

Is the value of the STATE field PendingVerification?
- Yes:
  - Your cluster is ready to be licensed (it’s not currently licensed). Go to step 4.
- No:
  - Is the value of the STATE field Active?
    - Yes:
      - Stop. Your cluster is already licensed.
    - No:
      - Contact F5 support.
Use port forwarding to create a secure tunnel between your computer and the F5 CWC API:
```
kubectl port-forward service/f5-spk-cwc 38081 \
  --namespace f5-cne-core > /dev/null & disown; \
  CWC_API_PORT_FORWARD_PID=$!
```
Note

This command:
- Forwards port 38081 on your computer to the target port associated with port 38081 of a pod in the f5-spk-cwc service in the f5-cne-core namespace (the F5 CWC API)
- Suppresses normal output (> /dev/null)
- Runs the process in the background (&)
- Detaches the process from the shell to avoid creating an associated job (disown;)
- Saves the process ID so you can later terminate the process

Using the secure tunnel, retrieve your cluster’s digital asset ID and store it in the CNE_ASSET_ID environment variable:

export CNE_ASSET_ID=$(
  curl -s \
      --cacert f5-cwc-api-root.crt \
      --cert f5-cwc-api-client.crt \
      --key f5-cwc-api-client.key \
      --connect-to f5-spk-cwc.f5-cne-core.svc.cluster.local:38081:localhost:38081 \
      -H "Authorization: Bearer $(
        kubectl get secret cwc-auth-token -n f5-cne-core \
          -o jsonpath='{.data.token}' \
          | base64 --decode
      )" \
      https://f5-spk-cwc.f5-cne-core.svc.cluster.local:38081/status | \
  jq -r .InitialRegistrationStatus.LicenseDetails.DigitalAssetID
)

Using the secure tunnel, retrieve your cluster’s configuration report and store it in the CNE_CFG_REPORT environment variable:

export CNE_CFG_REPORT=$(
  curl -s \
      --cacert f5-cwc-api-root.crt \
      --cert f5-cwc-api-client.crt \
      --key f5-cwc-api-client.key \
      --connect-to f5-spk-cwc.f5-cne-core.svc.cluster.local:38081:localhost:38081 \
      -H "Authorization: Bearer $(
        kubectl get secret cwc-auth-token -n f5-cne-core \
          -o jsonpath='{.data.token}' \
          | base64 --decode
      )" \
      https://f5-spk-cwc.f5-cne-core.svc.cluster.local:38081/report
)

Send your cluster’s digital asset ID, license key, and configuration report to the F5 licensing server, making sure to replace <LICENSE_KEY> with the license key (JSON Web Token, or JWT) you downloaded from MyF5:
```
curl -s -X POST https://product.apis.f5.com/ee/v1/entitlements/telemetry \
  -H "Content-Type: application/json" \
  -H "F5-DigitalAssetId: $CNE_ASSET_ID" \
  -H "User-Agent: SPK" \
  -H "Authorization: Bearer <LICENSE_KEY>" \
  -d "$CNE_CFG_REPORT" \
  -o license-manifest.json
```
The F5 licensing server provides you with a file named license-manifest.json, which contains your cluster’s license manifest.

Using the secure tunnel, acknowledge receipt of your cluster’s license manifest:

Note

Do not run this command more than once. It can only succeed the first time.

curl -s -X POST -w "%{http_code}\n" -o /dev/null \
  --cacert f5-cwc-api-root.crt \
  --cert f5-cwc-api-client.crt \
  --key f5-cwc-api-client.key \
  --connect-to f5-spk-cwc.f5-cne-core.svc.cluster.local:38081:localhost:38081 \
  -H "Authorization: Bearer $(
    kubectl get secret cwc-auth-token -n f5-cne-core \
      -o jsonpath='{.data.token}' \
      | base64 --decode
  )" \
  https://f5-spk-cwc.f5-cne-core.svc.cluster.local:38081/receipt \
  -d $(cat license-manifest.json | jq -r .manifest) | jq .

If the output of the previous command is not 200, contact F5 Support.
Terminate the port-forwarding background process:
```
kill $CWC_API_PORT_FORWARD_PID
```

Validate that your cluster is licensed¶

Wait until the state of the license is Active:
```
watch kubectl get license.k8s.f5net.com f5-cne-cluster-license \
  --namespace f5-cne-core
```
Note

When the value of the STATE field becomes Active, your cluster is licensed. If the state never becomes Active, contact F5 support.

Next steps¶

Create custom resources to configure the CNE instance as a working BNK (DPU) instance.