Install the F5 CRDs and the CNE core using Helm

Introduction

The following instructions describe how to perform a clean installation of the F5 custom resource definitions (CRDs) and the CNE core using Helm.

Note

Follow these guidelines:

  • Install only one CNE core per cluster.

  • Don’t mix BIG-IP Next for Kubernetes (BNK) and CNF instances in the same cluster.

  • Some tasks can be performed in either the CNE core or each CNE instance but not both. If you’re installing BNK instances in your cluster, it’s recommended that you perform the tasks marked “(BNK cluster only)” when installing the CNE core.

Create the namespace for the CNE core and create an image pull secret

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create the namespace for the CNE core:

    kubectl create namespace f5-cne-core

  3. Did you store Helm charts and Docker container images in a private artifact registry?

    • Yes:

      • If your private artifact registry requires authentication, create an image pull secret to allow Kubernetes to pull container images from the registry:

        kubectl apply -f <PRIVATE_REGISTRY_PULL_SECRET_MANIFEST_FILENAME> \
  --namespace f5-cne-core

    • No:

      • Create an image pull secret to allow Kubernetes to pull container images from F5 Artifact Registry:

        kubectl apply -f far-pull-secret.yaml \
  --namespace f5-cne-core

Install the F5 CRDs

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Do you plan to install a BIG-IP Next for Kubernetes (BNK) instance in this cluster?

    • Yes:

      • Install the BNK Legacy common custom resource definitions (CRDs):

        helm install f5-spk-crds-common \
  oci://$CNE_REPO/charts/f5-spk-crds-common \
  --version $(./get-cne-chart-version.sh f5-spk-crds-common) \
  --namespace f5-cne-core \
  --set conversion.namespace=f5-cne-core \
  --wait

      • Install the BNK Legacy service-proxy CRDs:

        helm install f5-spk-crds-service-proxy \
  oci://$CNE_REPO/charts/f5-spk-crds-service-proxy \
  --version $(./get-cne-chart-version.sh f5-spk-crds-service-proxy) \
  --namespace f5-cne-core \
  --set conversion.namespace=f5-cne-core \
  --wait

    • No:

      • Install the CNF CRDs:

        helm install f5-cnf-crds-n6lan \
  oci://$CNE_REPO/charts/f5-cnf-crds-n6lan \
  --version $(./get-cne-chart-version.sh f5-cnf-crds-n6lan) \
  --namespace f5-cne-core \
  --set conversion.namespace=f5-cne-core \
  --wait

Create an override values file for F5 cert-manager

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the override values file for F5 cert-manager:

    touch f5-cert-manager-override-values.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    global:
  imagePullSecrets:
  - name: far-pull-secret

webhook:
  image:
    repository: repo.f5.com/images

startupapicheck:
  image:
    repository: repo.f5.com/images

image:
  repository: repo.f5.com/images

cainjector:
  image:
    repository: repo.f5.com/images

init_container:
  image:
    repository: repo.f5.com/images

serviceAccount:
  create: true
  name: f5-cert-manager

logging_sidecar:
  enabled: true
  image:
    repository: repo.f5.com/images
  fluentd:
    host: f5-toda-fluentd.f5-cne-core.svc.cluster.local.

  5. (Private artifact registry only) Does your private artifact registry require authentication?

    • Yes:

      • Replace all instances of far-pull-secret with the name of the pull secret for your private artifact registry (for example, private-registry-pull-secret).

    • No:

      • Replace all instances of the following:

        imagePullSecrets:
- name: far-pull-secret

        with:

        imagePullSecrets: []

  6. (Private artifact registry only) Replace all instances of repo.f5.com/images with the location of the Docker container images in your private artifact registry (for example, registry.company.com/f5-big-ip-cne/images).

  7. Save and close the file.

Install F5 cert-manager

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-cert-manager service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-cert-manager

  3. Install F5 cert-manager:

    helm install f5-cert-manager \
  oci://$CNE_REPO/charts/f5-cert-manager \
  --version $(./get-cne-chart-version.sh f5-cert-manager) \
  --namespace f5-cne-core \
  --values f5-cert-manager-override-values.yaml \
  --wait

Create an override values file for F5 CRD Conversion

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the override values file for F5 CRD Conversion:

    touch f5-crdconversion-override-values.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    global:
  imagePullSecrets:
  - name: far-pull-secret

crdconversion:
  image:
    repository: repo.f5.com/images
  fluentbit_sidecar:
    image:
      repository: repo.f5.com/images
  serviceAccount:
    create: true
    name: f5-crdconversion

  5. (Private artifact registry only) Does your private artifact registry require authentication?

    • Yes:

      • Replace all instances of far-pull-secret with the name of the pull secret for your private artifact registry (for example, private-registry-pull-secret).

    • No:

      • Replace all instances of the following:

        imagePullSecrets:
- name: far-pull-secret

        with:

        imagePullSecrets: []

  6. (Private artifact registry only) Replace all instances of repo.f5.com/images with the location of the Docker container images in your private artifact registry (for example, registry.company.com/f5-big-ip-cne/images).

  7. Save and close the file.

Install F5 CRD Conversion

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-crdconversion service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-crdconversion

  3. Install F5 CRD Conversion:

    helm install f5-crdconversion \
  oci://$CNE_REPO/charts/f5-crdconversion \
  --version $(./get-cne-chart-version.sh f5-crdconversion) \
  --namespace f5-cne-core \
  --values f5-crdconversion-override-values.yaml \
  --wait

Create an override values file for F5 Core-File Collector

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the override values file for F5 Core-File Collector:

    touch f5-coremond-override-values.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    imagePullSecrets:
- name: far-pull-secret

image:
  repository: repo.f5.com/images

fluentbit_sidecar:
  image:
    repository: repo.f5.com/images
  fluentd:
    host: f5-toda-fluentd.f5-cne-core.svc.cluster.local.

persistence:
  enabled: true
  storageClass: <STORAGE_CLASS_NAME>

serviceAccount:
  create: true
  name: f5-coremond

  5. Replace <STORAGE_CLASS_NAME> with the name of one of your storage classes.

    Note

    The storage class you specify must define a type of storage that supports:

    • Simultaneous mounting by multiple workloads across different nodes

    • The ReadWriteMany (RWX) access mode

  6. (Private artifact registry only) Does your private artifact registry require authentication?

    • Yes:

      • Replace all instances of far-pull-secret with the name of the pull secret for your private artifact registry (for example, private-registry-pull-secret).

    • No:

      • Replace all instances of the following:

        imagePullSecrets:
- name: far-pull-secret

        with:

        imagePullSecrets: []

  7. (Private artifact registry only) Replace all instances of repo.f5.com/images with the location of the Docker container images in your private artifact registry (for example, registry.company.com/f5-big-ip-cne/images).

  8. Save and close the file.

Install F5 Core-File Collector

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-coremond service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-coremond

  3. Install F5 Core-File Collector:

    helm install f5-coremond \
  oci://$CNE_REPO/charts/coremond \
  --version $(./get-cne-chart-version.sh coremond) \
  --namespace f5-cne-core \
  --values f5-coremond-override-values.yaml \
  --wait

Create an override values file for F5 TODA Fluentd

Note

F5 TODA Fluentd is one of several components in the F5 Telemetry, Observability, Debugging, and Analytics (TODA) software.

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the override values file for F5 TODA Fluentd:

    touch f5-toda-fluentd-override-values.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    imageCredentials:
  name: far-pull-secret

image:
  repository: repo.f5.com/images

persistence:
  enabled: true
  storageClass: <STORAGE_CLASS_NAME>

f5ingress_logs:
  enabled: true
  stdout: true

dssm_logs:
  enabled: true
  stdout: true

dssm_sentinel_logs:
  enabled: true
  stdout: true

cm_logs:
  enabled: true
  stdout: true

serviceAccount:
  create: true
  name: f5-toda-fluentd

tls:
  enabled: true

  5. Replace <STORAGE_CLASS_NAME> with the name of one of your storage classes.

    Note

    The storage class you specify must define a type of storage that supports:

    • Simultaneous mounting by multiple workloads across different nodes

    • The ReadWriteMany (RWX) access mode

  6. (Private artifact registry only) Does your private artifact registry require authentication?

    • Yes:

      • Replace all instances of far-pull-secret with the name of the pull secret for your private artifact registry (for example, private-registry-pull-secret).

    • No:

      • Replace all instances of the following:

        imageCredentials:
  name: far-pull-secret

        with:

        imageCredentials:
  name: ""

  7. (Private artifact registry only) Replace all instances of repo.f5.com/images with the location of the Docker container images in your private artifact registry (for example, registry.company.com/f5-big-ip-cne/images).

  8. Save and close the file.

Install F5 TODA Fluentd

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-toda-fluentd service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-toda-fluentd

  3. Install F5 TODA Fluentd:

    helm install f5-toda-fluentd \
  oci://$CNE_REPO/charts/f5-toda-fluentd \
  --version $(./get-cne-chart-version.sh f5-toda-fluentd) \
  --namespace f5-cne-core \
  --values f5-toda-fluentd-override-values.yaml \
  --wait

(BNK cluster only) Create an override values file for F5 TODA Stats Observer

Note

  • Perform this task only if you’re installing BNK instances in your cluster.

  • F5 TODA Stats Observer is one of several components in the F5 Telemetry, Observability, Debugging, and Analytics (TODA) software.

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the override values file for F5 TODA Stats Observer:

    touch f5-toda-observer-override-values.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    imagePullSecrets:
- name: far-pull-secret

image:
  repository: repo.f5.com/images

persistence:
  storageClassName: <STORAGE_CLASS_NAME>
  size: 3Gi

global:
  imageCredentials:
    name: far-pull-secret
  core:
    coremonAddr: f5-coremond.f5-cne-core:8088

fluentbit_sidecar:
  image:
    repository: repo.f5.com/images
  fluentbit:
    tls:
      enabled: true
  fluentd:
    host: f5-toda-fluentd.f5-cne-core.svc.cluster.local.

  5. Replace <STORAGE_CLASS_NAME> with the name of one of your storage classes.

    Note

    The storage class you specify must define a type of storage that supports:

    • Simultaneous mounting by multiple workloads across different nodes

    • The ReadWriteMany (RWX) access mode

  6. (Private artifact registry only) Does your private artifact registry require authentication?

    • Yes:

      • Replace all instances of far-pull-secret with the name of the pull secret for your private artifact registry (for example, private-registry-pull-secret).

    • No:

      • Replace all instances of the following:

        imagePullSecrets:
- name: far-pull-secret

        with:

        imagePullSecrets: []

      • Replace all instances of the following:

        imageCredentials:
  name: far-pull-secret

        with:

        imageCredentials:
  name: ""

  7. (Private artifact registry only) Replace all instances of repo.f5.com/images with the location of the Docker container images in your private artifact registry (for example, registry.company.com/f5-big-ip-cne/images).

  8. Save and close the file.

(BNK cluster only) Install F5 TODA Stats Observer

Note

Perform this task only if you’re installing BNK instances in your cluster.

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-observer service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-observer

  3. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-observer-operator service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-observer-operator

  4. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-observer-receiver service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-observer-receiver

  5. Install F5 TODA Stats Observer:

    helm install f5-toda-observer \
  oci://$CNE_REPO/charts/f5-toda-observer \
  --version $(./get-cne-chart-version.sh f5-toda-observer) \
  --namespace f5-cne-core \
  --values f5-toda-observer-override-values.yaml \
  --wait

(BNK cluster only) Create the certificates for the Prometheus-scraping endpoint

Note

Perform this task only if you’re installing BNK instances in your cluster.

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the manifest for the certificates:

    touch otel-certs.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    apiVersion: cm.f5co.k8s.f5net.com/v1
kind: Certificate
metadata:
    name: external-otelsvr
spec:
    commonName: otel.cluster.local
    secretName: external-otelsvr-secret
    issuerRef:
        name: default-cert-issuer
        kind: ClusterIssuer
    duration: 8640h
    privateKey:
        rotationPolicy: Always
        encoding: PKCS1
        algorithm: RSA
        size: 4096
    revisionHistoryLimit: 10    
---
apiVersion: cm.f5co.k8s.f5net.com/v1
kind: Certificate
metadata:
    name: external-f5ingotelsvr
spec:
    commonName: otel.cluster.local
    secretName: external-f5ingotelsvr-secret
    issuerRef:
        name: default-cert-issuer
        kind: ClusterIssuer
    duration: 8640h
    privateKey:
        rotationPolicy: Always
        encoding: PKCS1
        algorithm: RSA
        size: 4096
    revisionHistoryLimit: 10

  5. Save and close the file.

  6. Create the certificates:

    kubectl apply -f otel-certs.yaml \
  --namespace f5-cne-core

    Kubernetes creates the following certificates in the f5-cne-core namespace:

    • external-otelsvr

    • external-f5ingotelsvr

(BNK cluster only) Create an override values file for F5 TODA OpenTelemetry Collector

Note

  • Perform this task only if you’re installing BNK instances in your cluster.

  • F5 TODA OpenTelemetry Collector is one of several components in the F5 Telemetry, Observability, Debugging, and Analytics (TODA) software.

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the override values file for F5 TODA OpenTelemetry Collector:

    touch f5-stats-collector-override-values.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    enabled: true

global:
  imageCredentials:
    name: far-pull-secret

image:
  repository: repo.f5.com/images

serviceAccount:
  create: true
  name: f5-stats-collector

  5. (Private artifact registry only) Does your private artifact registry require authentication?

    • Yes:

      • Replace all instances of far-pull-secret with the name of the pull secret for your private artifact registry (for example, private-registry-pull-secret).

    • No:

      • Replace all instances of the following:

        imageCredentials:
  name: far-pull-secret

        with:

        imageCredentials:
  name: ""

  6. (Private artifact registry only) Replace all instances of repo.f5.com/images with the location of the Docker container images in your private artifact registry (for example, registry.company.com/f5-big-ip-cne/images).

  7. Save and close the file.

(BNK cluster only) Install F5 TODA OpenTelemetry Collector

Note

Perform this task only if you’re installing BNK instances in your cluster.

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-stats-collector service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-stats-collector

  3. Install F5 TODA OpenTelemetry Collector:

    helm install f5-stats-collector \
  oci://$CNE_REPO/charts/f5-stats_collector \
  --version $(./get-cne-chart-version.sh f5-stats_collector) \
  --namespace f5-cne-core \
  --values f5-stats-collector-override-values.yaml \
  --wait

Create an override values file for F5 dSSM

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the override values file for F5 Distributed Session State Management (dSSM):

    touch f5-dssm-override-values.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    # Note: In BIG-IP CNE 2.4, imageCredentials will revert to imagePullSecrets
imageCredentials:
- name: far-pull-secret

dssmUpgrader:
  image:
    repository: repo.f5.com/images

image:
  repository: repo.f5.com/images

cert_client_sidecar:
  image:
    repository: repo.f5.com/images

sentinel:
  fluentbit_sidecar:
    image:
      repository: repo.f5.com/images
    fluentd:
      host: f5-toda-fluentd.f5-cne-core.svc.cluster.local.

db:
  fluentbit_sidecar:
    image:
      repository: repo.f5.com/images
    fluentd:
      host: f5-toda-fluentd.f5-cne-core.svc.cluster.local.

serviceAccount:
  create: true
  name: f5-dssm

  5. (Private artifact registry only) Does your private artifact registry require authentication?

    • Yes:

      • Replace all instances of far-pull-secret with the name of the pull secret for your private artifact registry (for example, private-registry-pull-secret).

    • No:

      • Replace all instances of the following:

        imageCredentials:
- name: far-pull-secret

        with:

        imageCredentials: []

  6. (Private artifact registry only) Replace all instances of repo.f5.com/images with the location of the Docker container images in your private artifact registry (for example, registry.company.com/f5-big-ip-cne/images).

  7. Save and close the file.

Install F5 dSSM

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-dssm service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-dssm

  3. Install F5 dSSM:

    helm install f5-dssm \
  oci://$CNE_REPO/charts/f5-dssm \
  --version $(./get-cne-chart-version.sh f5-dssm) \
  --namespace f5-cne-core \
  --values f5-dssm-override-values.yaml \
  --timeout 7m0s \
  --wait

    Note

    Because the pods in the F5 dSSM stateful-set workloads are installed serially, the default Helm timeout of 5 minutes is often not enough.

Create an override values file for RabbitMQ

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the override values file for RabbitMQ:

    touch rabbitmq-override-values.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    imageCredentials:
  name: far-pull-secret

image:
  repository: repo.f5.com/images

fluentbit_sidecar:
  image:
    repository: repo.f5.com/images

serviceAccount:
  create: true
  name: rabbitmq

  5. (Private artifact registry only) Does your private artifact registry require authentication?

    • Yes:

      • Replace all instances of far-pull-secret with the name of the pull secret for your private artifact registry (for example, private-registry-pull-secret).

    • No:

      • Replace all instances of the following:

        imageCredentials:
  name: far-pull-secret

        with:

        imageCredentials:
  name: ""

  6. (Private artifact registry only) Replace all instances of repo.f5.com/images with the location of the Docker container images in your private artifact registry (for example, registry.company.com/f5-big-ip-cne/images).

  7. Save and close the file.

Install RabbitMQ

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. (OpenShift only) Assign the privileged security context constraint (SCC) to the rabbitmq service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount rabbitmq

  3. Install RabbitMQ:

    helm install rabbitmq \
  oci://$CNE_REPO/charts/rabbitmq \
  --version $(./get-cne-chart-version.sh rabbitmq) \
  --namespace f5-cne-core \
  --values rabbitmq-override-values.yaml \
  --wait

Download and extract the archive file for the f5-cert-gen chart

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Set the CNE_CHART environment variable to f5-cert-gen:

    export CNE_CHART=f5-cert-gen

  3. Download the archive file for the f5-cert-gen chart:

    helm pull oci://$CNE_REPO/utils/$CNE_CHART \
  --version $(./get-cne-chart-version.sh utils/$CNE_CHART)

  4. Extract the archive file:

    tar zxvf ${CNE_CHART}-$(./get-cne-chart-version.sh utils/$CNE_CHART).tgz

    Extracting the archive file creates a directory named cert-gen in the release-manifest directory.

Create the TLS credentials required to authenticate with the F5 CWC API

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create two manifests that describe secrets for use with the F5 Cluster-Wide Controller (CWC) API—one for the client and one for the server (CWC)—each of which contains a private key, the corresponding certificate, and the signing certificate:

    sh cert-gen/gen_cert.sh \
  -s=api-server \
  -a=f5-spk-cwc.f5-cne-core.svc.cluster.local \
  -n=1

    The script creates the following manifests in the release-manifest directory:

    • cwc-license-certs.yaml

    • cwc-license-client-certs.yaml

  3. Create the secrets:

    kubectl create \
  -f cwc-license-certs.yaml \
  -f cwc-license-client-certs.yaml \
  --namespace f5-cne-core

    The command creates the following secrets in the f5-cne-core namespace:

    • cwc-license-certs

    • cwc-license-client-certs

  4. Extract the F5 Cluster-Wide Controller (CWC) API client key from the cwc-license-client-certs secret and store it in f5-cwc-api-client.key:

    kubectl get secret cwc-license-client-certs \
  --namespace f5-cne-core -o json | \
  jq -r '.data["client-key"]' | \
  base64 -d > f5-cwc-api-client.key

  5. Extract the F5 CWC API client certificate from the cwc-license-client-certs secret and store it in f5-cwc-api-client.crt:

    kubectl get secret cwc-license-client-certs \
  --namespace f5-cne-core -o json | \
  jq -r '.data["client-cert"]' | \
  base64 -d > f5-cwc-api-client.crt

  6. Extract the F5 CWC API root certificate from the cwc-license-client-certs secret and store it in f5-cwc-api-root.crt:

    kubectl get secret cwc-license-client-certs \
  --namespace f5-cne-core -o json | \
  jq -r '.data["ca-root-cert"]' | \
  base64 -d > f5-cwc-api-root.crt

Create an override values file for F5 CWC

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. Create a file to use as the override values file for F5 Cluster-Wide Controller (CWC):

    touch f5-cwc-override-values.yaml

  3. Open the file in a text editor.

  4. Add the following information to the file:

    imageCredentials:
  name: far-pull-secret

rabbitmqNamespace: "f5-cne-core"

cert-orchestrator:
  enabled: true

fluentbit_sidecar:
  enabled: true
  image:
    repository: repo.f5.com/images

cwc:
  image:
    repository: repo.f5.com/images

orch:
  enabled: true
  image:
    repository: repo.f5.com/images

persistence:
  enabled: true
  storageClass: <STORAGE_CLASS_NAME>

serviceAccount:
  create: true
  name: f5-cwc

  5. Replace <STORAGE_CLASS_NAME> with the name of one of your storage classes.

    Note

    The storage class you specify must define a type of storage that supports:

    • Simultaneous mounting by multiple workloads across different nodes

    • The ReadWriteMany (RWX) access mode

  6. (Private artifact registry only) Does your private artifact registry require authentication?

    • Yes:

      • Replace all instances of far-pull-secret with the name of the pull secret for your private artifact registry (for example, private-registry-pull-secret).

    • No:

      • Replace all instances of the following:

        imageCredentials:
  name: far-pull-secret

        with:

        imageCredentials:
  name: ""

  7. (Private artifact registry only) Replace all instances of repo.f5.com/images with the location of the Docker container images in your private artifact registry (for example, registry.company.com/f5-big-ip-cne/images).

  8. Save and close the file.

Install F5 CWC

  1. In a terminal window on your computer, make sure you’re in the release-manifest directory.

  2. (OpenShift only) Assign the privileged security context constraint (SCC) to the f5-cwc service account, which will be created by Helm:

    oc adm policy add-scc-to-user privileged \
  --namespace f5-cne-core \
  --serviceaccount f5-cwc

  3. Install F5 CWC:

    helm install f5-cwc oci://$CNE_REPO/charts/cwc \
  --version $(./get-cne-chart-version.sh cwc) \
  --namespace f5-cne-core \
  --values f5-cwc-override-values.yaml \
  --wait

Verify the installation

  • Wait until the status of each CNE-core pod is Running:

    watch kubectl get pods \
  --namespace f5-cne-core -o wide

    Expected pods

    Pod

    Containers

    Description

    f5-cert-manager-xxx

    2/2

    F5 cert-manager

    f5-cert-manager-cainjector-xxxx

    1/1

    F5 cert-manager CA Injector

    f5-cert-manager-webhook-xxxx

    1/1

    F5 cert-manager Webhook

    f5-coremond-xxxx (one pod per node)

    2/2

    F5 Core-File Collector

    f5-crdconversion-xxxx

    2/2

    F5 CRD Conversion

    f5-dssm-db-x (3 replicas)

    3/3

    F5 dSSM Database

    f5-dssm-sentinel-x (3 replicas)

    3/3

    F5 dSSM Sentinel

    f5-observer-x (3 replicas)
    (BNK cluster only)

    2/2

    F5 TODA Stats Observer Aggregator

    f5-observer-operator-xxxx
    (BNK cluster only)

    2/2

    F5 TODA Stats Observer Operator

    f5-observer-receiver-x (3 replicas)
    (BNK cluster only)

    2/2

    F5 TODA Stats Observer Receiver

    f5-rabbit-xxxx

    2/2

    RabbitMQ

    f5-spk-cwc-xxxx

    3/3

    F5 Cluster-Wide Controller (CWC)

    f5-toda-fluentd-xxxx

    1/1

    F5 TODA Fluentd

    otel-collector-xxxx
    (BNK cluster only)

    1/1

    F5 TODA OpenTelemetry Collector

Next steps

To continue installing, go to License your cluster.