F5SPKSnatpool¶

Note

Deprecated as of 2.4.0. Use a GatewaySettings resource instead.

Overview¶

Function¶

Declares a SNAT pool for a CNE instance, defining the addresses used for source network address translation across TMM instances.

Names¶

Singular name	Plural name	Short name
f5-spk-snatpool	f5-spk-snatpools	—

API group and version¶

k8s.f5net.com/v1

Scope¶

Namespace

Specification¶

spec¶

Field	Required	Default	Description
`name` string	No	`""`	Name of the SNAT pool. Must be unique for a specific SNAT pool. Maximum length is 255 characters. This field is immutable after creation.
`addressList` array	No	`[]`	List of address lists configured for the SNAT pool. Each inner list holds one or more IPv4 or IPv6 addresses.
`sharedSnatAddressEnabled` boolean	No	`false`	Turns shared SNAT addresses on or off. When on, `addressList` supports only one element, which applies to all TMM pods. Accepted values: `true`, `false`.
`tenant` string	No	`""`	Name of the tenant that owns the SNAT pool. Maximum length is 255 characters.
`namespace` string	No	`""`	Tenant namespace in which the SNAT pool is created. Maximum length is 255 characters.
`vrf` string	No	`""`	Name of the VRF (tenant) this SNAT pool is in. This is a soft reference to a `Vrf` resource. When you don’t set this, the SNAT pool exists in the default route domain. Maximum length is 255 characters. This field is immutable after creation.

spec.addressList[][]¶

Field	Required	Default	Description
`addressList[][]` string	No	`""`	An address in the SNAT pool. Must be a valid IPv4 or IPv6 address, or empty. Maximum length is 45 characters.

Scaling TMM¶

When scaling BIG-IP Next for Kubernetes TMM beyond a single instance in the Project, configure this resource to provide a SNAT pool to each TMM replica. The first SNAT pool is applied to the first TMM replica, the second snatpool to the second TMM replica, continuing through the list.

Note

When configuring SNAT pools with multiple IP subnets, ensure all TMM replicas receive the same IP subnets.

Example mainfest:

 apiVersion: "k8s.f5net.com/v1"
 kind: F5SPKSnatpool 
 metadata:
   name: "egress-snatpool-cr"
   namespace: f5-bnk
 spec:
   name: "egress_snatpool"
   addressList:
     - - 10.244.10.1
       - 10.244.20.1
     - - 10.244.10.2
       - 10.244.20.2
     - - 10.244.10.3
       - 10.244.20.3

Example deployment:

Referencing the SNAT Pool¶

Once the F5SPKSnatpool is configured, a virtual server is required to process the egress Pod connections, and apply the SNAT IP addresses. The spec.name value must match the spec.egressSnatpool value in the F5SPKEgress custom resource (CR) that references this SNAT pool. The F5SPKSnatpool CR works with the F5SPKEgress CR. First, create the SNAT pool to define the IP addresses. Then create the Egress CR and reference the SNAT pool by spec.name to activate the virtual server that applies the SNAT translations.

The F5SPKEgress CR creates the required virtual server, and is included in the Deployment procedure below:

Deployment¶

Use the following steps to deploy the example F5SPKSnatpool CR, the required F5SPKEgress CR, and to verify the configurations.

Configure SNAT Pools using the example CR, and deploy to the same Project as the Ingress Controller. For example:

In this example, the CR installs to the default Project:

apiVersion: "k8s.f5net.com/v1"
kind: F5SPKSnatpool
metadata:
  name: "egress-snatpool-cr"
  namespace: f5-bnk
spec:
  name: "egress_snatpool"
  addressList:
    - - 10.244.10.1
      - 10.244.20.1
      - 2002::10:244:10:1
      - 2002::10:244:20:1
    - - 10.244.10.2
      - 10.244.20.2
      - 2002::10:244:10:2
      - 2002::10:244:20:2

Install the F5SPKSnatpool CR:
```
kubectl apply -f spk-snatpool-cr.yaml
```
To verify the SNAT pool IP address mappings on the TMMs:

For individual TMMs, log in to the debug sidecar and run the following command to view the SNAT pool members:
```
tmctl -w 120 -d blade pool_member_stat -s pool_name,addr
```
The addresses will be displayed as IPv6 address in hexadecimal format. For example, 10.200.3.4 address is displayed as 00:00:00:00:00:00:00:00:00:00:FF:FF:0A:C8:03:04:00:00:00:00.

Configure the F5SPKEgress CR, and install to the same Project as the Ingress Controller. For example:

apiVersion: "k8s.f5net.com/v3"
kind: F5SPKEgress
metadata:
  name: egress-cr
  namespace: f5-bnk
spec:
  egressSnatpool: "egress_snatpool"

Install the F5SPKEgress CR:

In this example, the CR file is named spk-egress-cr.yaml:
```
kubectl apply -f spk-egress-cr.yaml
```

Verify the status of the installed CR:

kubectl get f5-spk-snatpools -n f5-bnk

In this example, the CR has installed successfully.

NAME                 READY   MESSAGE                                AGE
egress-snatpool-cr   True    CR config sent to all grpc endpoints   10s

To verify connectivity statistics, log in to the Debug Sidecar:
```
kubectl exec -it deploy/f5-tmm -c debug -n <project>
```
In this example, the debug sidecar is in the default Project:
```
kubectl exec -it deploy/f5-tmm -c debug -n f5-bnk
```

Verify the internal virtual servers have been configured:

tmctl -f /var/tmstat/blade/tmm0 virtual_server_stat -s name,serverside.tot_conns

In this example, 3 IPv4 connections, and 2 IPv6 connections have been initiated by internal Pods:

name              serverside.tot_conns
----------------- --------------------
egress-ipv6                          2
egress-ipv4                          3