Tenant Management

Tenants Overview

A tenant is a guest system running software on the F5OS platform layer (for example, a BIG-IP system). You can run several tenants on most platforms, although the F5 r2000 Series only supports a single tenant. For more information, see Tenant data.

Note: Information about BIG-IP Next is available on my.f5.com and clouddocs.f5.com.

The administrator can connect to the tenant’s webUI, or REST API and have the same experience as on their existing F5 platforms. A tenant on the rSeries platform is managed similarly to how a vCMP guest is managed today on the VIPRION platform. The tenant is assigned dedicated vCPU and memory resources and is restricted to specific VLANs for network connectivity.

The admin is responsible for configuring tenant deployments within the appliance. Once a tenant has been deployed, there is a per-tenant administrator role, whose responsibilities include configuring the services that are available on that tenant.

Important: Tenants inherit certain capabilities, such as the license, VLANs, and management interface speed, from the system. Do not try to install a new license or delete the existing license on the tenants. Tenant admins cannot configure global parameters. You configure these at the platform layer, and values are propagated to all tenants in the system.

Note: - For the F5 r2000/r4000 platforms, you can add the same VLAN ID to multiple interfaces. Adding the same VLAN ID to multiple interfaces could result in L2 loops. Special considerations should be made to the network topology to avoid L2 loops. - Before you can assign a multi-interface VLAN to the tenant, change the value of the db variable <vlan.macassignment> to <unique> inside the tenant.

Also see the knowledge article Overview of the BIG-IP tenant image types.

Tenant data

This table lists tenant data specifications for rSeries systems.

Table 1: Tenant data for F5 rSeries systems

Model Maximum number of tenants Maximum vCPUs per tenant Minimum vCPUs per tenant System memory Memory reserved for tenants Minimum memory per tenant
r2800 1 8 4 32 GB 24 GB 12288 MB
r4600 2 12 4 64 GB 48 GB 12288 MB
r4800 4 16 4 64 GB 48 GB 12288 MB
r5600 8 12 1 128 GB 104 GB 4096 MB
r5800 18 18 1 128 GB 104 GB 4096 MB
r5900 26 26 1 128 GB 104 GB 4096 MB
r10600 24 24 1 256 GB 224 GB 4096 MB
r10800 28 28 1 256 GB 224 GB 4096 MB
r10900 36 36 1 256 GB 224 GB 4096 MB
r12600 44 44 1 512 GB 462 GB 4096 MB
r12800 52 52 1 512 GB 462 GB 4096 MB
r12900 60 60 1 512 GB 462 GB 4096 MB

Tenants example

In this diagram, an rSeries system has eight tenants (red and blue).

../_images/Tenants_on_F5_rSeries.png

Figure 2: Tenants on F5 rSeries

Each tenant has its own IP address, set of users, and software. You can access each tenant via interface, web-based user or API.

After you have configured and deployed a tenant, you can use the tenant management IP address to connect to the tenant’s web-based user interface, API. A BIG-IP tenant is running standard TMOS and is managed like any other BIG-IP instance.

Tenant Image Overview

BIG-IP Tenant Images

These BIG-IP tenant images are available to deploy on F5 rSeries systems:

  • ALL-F5OS

  • T4-F5OS

  • T2-F5OS

  • T1-F5OS (see note)

Note: T1-F5OS has limitations, so using the other images is recommended. Other images must be downloaded from F5 Downloads.

Each image type has different uses, so you need to be sure to use the correct type for your tenant needs. For additional information about BIG-IP tenant image types, see K45191957: Overview of the BIG-IP tenant image types.

BIG-IP Next Tenant Images

Information about BIG-IP Next tenant image types is available on my.f5.com.

Tenant usage

This table lists general use cases for tenant images.

Tenant Image Description of Use
ALL-F5OS - Use case: Needs multi-tenancy, multi-module, and service chaining.
- Supports provisioning rSeries-supported modules (also called all-instance image).
- Live-upgradable.
- The F5 r2000 platform does not support multi-tenancy. See the F5 rSeries data sheet for all currently-supported features.
T4-F5OS - Use case: Single tenant with multiple modules.
- Supports provisioning all modules with increased capacity.
- Live-upgradable.
T2-F5OS - Use case: Needs maximum tenant density, maximum tenants per system.
- Supports provisioning LTM or DNS only.
- Live-upgradable.
T1-F5OS - Use case: Needs maximum tenant density, maximum tenants per system.
- Supports lightweight LTM or DNS only (also called micro-instance).
- You cannot upgrade or apply a hotfix to the system.

Tenant sizing

Each image has different sizing requirements. You will need to understand the system and the tenant requirements to determine the number and type of tenants you can deploy. The amount of memory and disk space that a tenant actually needs is dependent on the number of modules provisioned and its use.

Tenant Image Disk Size Minimum Memory Minimum # vCPUs Max Tenants per System
T1-F5OS 22 GB 4 GB 1 36
T2-F5OS 45 GB 8 GB 2 18
ALL-F5OS 77/86 GB 8 GB 2 11
T4-F5OS 142 GB 8 GB 2 6

Tenant resource allocation overview

These are recommended resource considerations for determining the amount of memory (RAM) and disk space to allocate when planning tenant deployments on F5 rSeries systems.

Memory allocation

These are recommendations for determining the amount of memory (RAM) to allocate when planning tenant deployments on rSeries systems based on the number of vCPUs assigned.

Platform Memory Default Memory Allocation Formula
r2000 32 GB min-memory = (3.5 * 1024 * vcpu-cores-per-node)
r4000 64 GB min-memory = (3.5 * 1024 * vcpu-cores-per-node)
r5000 128 GB min-memory = (3.5 * 1024 * vcpu-cores-per-node) + 512
r10000 256 GB min-memory = (3.5 * 1024 * vcpu-cores-per-node) + 512
r12000 512 GB min-memory = (3.5 * 1024 * vcpu-cores-per-node) + 512

Tenant Configuration Notes

Note: The formula for finding vcpu-cores-per-node is: multiples of 4 in the range of [4, max-cores]. The default value for vcpu-cores-per-node is 4, and the default value for memory is 12288.

There is also an advanced setting through which additional memory can be assigned out of the pool to a tenant. You can specify more than the minimum amount of memory when configuring a tenant, if needed.

Disk Space

These are recommendations for determining the amount of disk space when planning tenant deployments on rSeries systems:

  • The amount of disk space that a tenant actually needs is dependent on the number of modules provisioned and its use.

  • As the aggregate disk usage within deployed tenants increases, the host disk can start to reach capacity on systems with many large tenants. The administrator will need to monitor disk usage to make sure there is sufficient space for the tenants.

Tenant Management from the webUI

Manage Tenant Images from the webUI

You can add or delete tenant images from the webUI. You must use HTTPS image import or export. Note that tenant images are specific to the rSeries system, and the software version must be compatible with it.

  1. Log in to the webUI using an account with admin access.

  2. On the left, click Tenant Management > Tenant Images.

  3. To upload an image, click Upload and browse to the image location.

  4. To import an image:

    a) Click Import.
    A popup opens.

    b) For URL, enter the URL of the remote image server.

    F5 recommends that the remote host be an HTTPS server with PUT/POST enabled and have a valid CA-signed certificate. You can opt to select the Ignore Certificate Warnings check box if you want to skip the certificate check.

    c) For Username, type the user name for an account on the remote image server, if required.

    d) For Password, type the password for the account, if required.

    e) Select Ignore Certificate Warnings to skip the certificate check.

    f) Click Import Image.

Note: Depending on the image file size and network availability, the import might take a few minutes. When the import is successful, the software image is listed in the webUI.

  1. To delete a tenant image, select the image and click Delete.

After you have added the tenant images that you want to use to the system, you can create and deploy tenants that will use that software image. The tenant image must be one that is listed as compatible with the rSeries system.

Create and Deploy Tenants from the webUI

You must have imported the tenant images that you want to use for the tenant deployments into the system. You must also have previously created any required VLANs. Before you can create and deploy tenants, you also need to estimate resource requirements so you know how many vCPUs, memory, and other resources to assign to the tenant.

An administrator can deploy tenants from the webUI. You can open a preview pane with tenant details by clicking anywhere in a row. You can resize the preview pane to show more or less information. To close the preview pane, click Close or click again anywhere in the row.

  1. Log in to the webUI using an account with admin access.

  2. On the left, click Tenant Management> Tenant Deployments. The Tenant Deployment screen displays showing the existing tenant deployments and associated details.

  3. To add a tenant deployment, click Add. The Add Tenant Deployment drawer displays.

  4. For Name, enter a name for the tenant deployment (up to 49 characters).

    Note: The first character in the name cannot be a number. After that, only lowercase alphanumeric characters and hyphens are allowed.

  5. For Type, select the tenant type: BIG-IP, BIG-IP Next, Generic.

    • If you select BIG-IP Next, the Deployment file field displays. Select the deployment file.

    • If you select Generic, the DHCP field displays. Select Enabled, if the management port is getting addresses from a DHCP server or select Disabled to configure the addresses manually.

    Note: Generic tenant type is supported only on the F5 r5000/r10000/r12000 platforms.

  6. For Image, select the software image that was previously imported onto the system. Ensure that the image you selected meets your tenant deployment needs.

  7. For IP Address, enter the IPv4 address, IPv6 address, or Fully Qualified Domain Name (FQDN) for the tenant.

  8. For Prefix Length, enter a number for the length of the prefix. The maximum prefix length is 32 for IPv4 and 128 for IPv6.

  9. For Gateway, enter the IPv4 address or IPv6 address of the gateway.

  10. For VLANs, select one or more VLANs that are available to the tenant. You can assign VLANs to more than one tenant.

  11. For Virtual Wires, select configured virtual wires for the tenant.

    Note: This field displays only when virtual wires are configured on the system.

    Note: Virtual Wires configuration is only supported for BIG-IP tenant types.

  12. For MAC Data/MAC Block Size, select one of these options:

| Option  | Description                                                                                  |
|---------|----------------------------------------------------------------------------------------------|
| One     | Represents a block with one MAC. This is used when a contiguous block of MAC addresses is needed. This is the default value. |
| Small   | Represents a block of 8 MACs. When this value is used, the tenant gets a block of 8 contiguous MACs. |
| Medium  | Represents a block of 16 MACs. When this value is used, the tenant gets a block of 16 contiguous MACs. |
| Large   | Represents a block of 32 MACs. When this value is used, the tenant gets a block of 32 contiguous MACs.                                                              |

Note:

  • For optimized performance, you can select the option One for BIG-IP Next tenants.

  • If you select the Generic tenant type, then you must select the option larger than “One” for valid MAC Data/MAC Block Size.

  1. For DAG IPv6 Prefix Length, enter the prefix length used by disaggregator algorithms.

    The range is from 1 to 128, with a default value of 128. For more information about the prefix length, see Configure DAG IPv6 prefix length from the CLI

  2. For Resource Provisioning, select one of these options:

Option Description
Recommended Recommended values for vCPUs and memory for the tenant.
Advanced Enables you to configure custom values for vCPUs and memory on the tenant. For example, if you want to configure a single vCPU tenant, or a tenant that uses more than the recommended amount of memory.

  1. For vCPUs, select the number of vCPUs to provide to the tenant.

    The minimum recommended number of vCPUs per typical tenant is two (one vCPU is sufficient only for lightweight tenants that cannot be updated). The number of vCPUs needed depends on the amount of traffic the tenant will be handling. More vCPUs provide faster throughput.

Note: If you select Generic or BIG-IP Next tenant type, then the minimum recommended number of vCPUs is four.

  1. For Memory, specify the amount of RAM, in MB, to allocate to the tenant.

    The amount of memory needed depends on the number of vCPUs assigned. The minimum amount of memory needed is determined by the formula [(3.5 * 1024 * #ofvCPUs) + 512].

Note:

  • If you do not allocate sufficient memory, you may receive a warning message.

  • If you select Generic tenant type, then the amount of memory needed is 14 GB.

  1. For Virtual Disk Size, specify the storage quota, in GB, for the tenant virtual disk.

    The default size depends on the image type used. The default size for the ALL image is 82 GB.

    The minimum recommended disk size is 45 GB.

  2. For Metadata, enter the metadata.

    This field only displays when you select the Generic tenant type. The metadata consists of a list of key-value pairs, with each entry following the key:value format. Spaces must be included between each entry.

Note:

  • For the primary-vlan, the VLANs must be chosen from the list of VLANs configured in Step 10.

  • For the token, enter the token obtained from the Secure Mesh Sites.

  1. For State, select one of these options:

Options Description
Configured The tenant configuration exists on the system, but the tenant is not running, and no hardware resources (CPU, memory) are allocated to it. This is the initial state and the default.
Provisioned Moves the tenant into the Provisioned state, which causes the system to install the software, assign the tenant to nodes, and create virtual disks for the tenant on those nodes. If you choose this option, it takes a few minutes to complete the provisioning. The tenant does not run while in this state.
Deployed Changes the tenant to the Deployed state. The tenant is set up, resources are allocated to the tenant, the image is moved onto the system, the software is installed, and after those tasks are complete, the tenant is fully deployed and running. If you choose this option, it takes a few minutes to complete the deployment and bring up the system.
Note: Once a tenant is Deployed (and is up and running), changing its state back to Configured or Provisioned stops the tenant. You will receive a warning message before this occurs.

  1. For Crypto/Compression Acceleration, select Enabled if the tenant requires high-performance crypto processing and compression.

    When this option is enabled, the tenant receives dedicated crypto devices proportional to the number of vCPU cores. Crypto processing and compression are off-loaded to the hardware. When the option is disabled, the tenant receives no crypto devices.

  2. To restrict usage of the Bash shell for tenant administrators, set Appliance Mode to Enabled (this is Disabled by default).

  3. Click Save & Close.

    The tenant is now configured and in the Deployed state. When the status says Running, the tenant administrator can log in to the tenant webUI using the management IP address (with HTTPS or SSH) and continue configuring the tenant system.

    Note: If the Status says Pending instead of Running, this may mean that there are not enough resources (vCPUs, memory, or other resources) for the tenant to be deployed. See the Tenant Details screen in the webUI for more information about the specific tenant.

Modify Tenant Deployments from the webUI

Depending on the state that the tenant is in, you can change certain tenant settings from the webUI. The settings which cannot be modified will be disabled.

  • Deployed: Tenants must be active in order for you to modify the State.

    Note: Once a tenant is Deployed (and is up and running), changing its state back to Provisioned or Configured stops the tenant. You will receive a warning message before this occurs.

  • Provisioned: You can change all settings except Image.

  • Configured: You can change all settings except Image.

    Note: If the selected Generic tenant type and tenant is in deployed state:

    • You cannot change the dhcp-enabled flag.

    • You cannot change the metadata.

Steps to Modify Tenant Deployments

  1. Log in to the webUI using an account with admin access.

  2. On the left, click Tenant Management > Tenant Deployments.

The Tenant Deployment screen displays showing the existing tenant deployments and associated details.

  1. Click the name of the tenant deployment you want to modify. The Edit Tenant Deployment drawer displays. Click edit icon on the drawer.

  2. For Image, only BIG-IP Next Tenant image can be modifed when the tenant is in deployed state, which essentially upgrades the tenant.

  3. You can change the IP Address, Prefix Length (1-32), and Gateway for the tenant if in Configured or Provisioned state. Enter an IPv4 address or IPv6 address.

  4. For VLANs, you can select different VLANs for the tenant if in Configured or Provisioned state.

  5. For Virtual Wires, select configured virtual wires for the tenant.

    Note:

    • This field displays only when virtual wires are configured on the system.

    • Virtual Wires configuration is only supported for BIG-IP tenant types.

  6. For MAC Data/MAC Block Size, select One, Small, Medium, or Large.

| Option  | Description                                                                                                                                                     |
|---------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| One     | Represents a block with one MAC. This is used when l2-inline-device functionality is not needed. This is the default value.                                   |
| Small   | Represents a block of 8 MACs. When this value is used, the l2-inline-device is enabled, and the tenant gets a block of 8 contiguous MACs.                    |
| Medium  | Represents a block of 16 MACs. When this value is used, the l2-inline-device is enabled, and the tenant gets a block of 16 contiguous MACs.                  |
| Large   | Represents a block of 32 MACs. When this value is used, the l2-inline-device is enabled, and the tenant gets a block of 32 contiguous MACs.                  |

  1. For Resource Provisioning, if changing resources, select either: Recommended (to use recommended values) or Advanced (to customize values), if in Configured or Provisioned state.

  2. For vCPUs, select the number of vCPUs for the tenant, if in Configured or Provisioned state.

    The minimum recommended number of vCPUs per typical tenant is two (one vCPU is sufficient only for lightweight tenants that cannot be updated). The number of vCPUs needed depends on the amount of traffic the tenant will be handling. More vCPUs provide faster throughput.

    Note: If you select Generic or BIG-IP Next tenant type, then the minimum recommended number of vCPUs is four.

  3. For Memory, specify the amount of RAM in MB to allocate to the tenant, if in Configured or Provisioned state.

    The amount of memory needed depends on the number of vCPUs assigned. The minimum amount of memory needed is determined by the formula [(3.5 * 1024 * #ofvCPUs) + 512], so a two vCPU tenant needs a minimum of 7680 MB, and a four vCPU tenant needs a minimum of 14,848 MB.

  4. Change State (with caution!):

| Option      | Description                                                                                                                                                    |
|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Configured  | If the tenant has been Provisioned or Deployed, the virtual disk is deleted.                                                                                  |
| Deployed    | Directly deploys the tenant. This sets up the tenant, allocates resources, moves the image onto the system, and installs the software. When these tasks are complete, the tenant is fully deployed and running. |

  1. Change Crypto/Compression Acceleration only if the tenant is in either the Configured or Provisioned state.

  2. To restrict usage of the Bash shell for tenant administrators, set Appliance Mode to Enabled (this is Disabled by default).

  3. Click Save.

    The tenant is reconfigured according to the changes made.

Display Tenant Status and Statistics from the webUI

You can monitor data and metrics related to the usage, performance, and behavior of the tenant from the webUI. These statistics are crucial for monitoring, managing, and optimizing the tenant. You can monitor the following tenant details:

  • Tenant CPU Usage: Shows the measurement of CPU utilization by the tenant.

  • Tenant Memory Usage: Shows the measurement of memory utilization by the tenant.

  • Tenant Disk Usage: Shows the measurement of disk utilization by the tenant.

Steps to View Tenant Status and Statistics

  1. Log in to the webUI using an account with admin access.

  2. On the left, click Tenant Management> Tenant Details.

  3. Select a tenant from the Tenant Name dropdown.

    You can now see the following statistics and status of the tenant:

    • Tenant CPU Usage: Displays the tenant’s vCPU’s current utilization by default. However, if multiple vCPUs are available, you can select a vCPU and change the time series to view the historical data and analyze the vCPU utilization.

    • Tenant Memory Usage: Displays the tenant’s current memory utilization by default. However, you can change the time series to view historical data and analyze memory utilization.

    • Tenant Disk Usage: Displays the overall tenant disk current utilization by default. However, if you need the utilization stats of a specific disk, select the disk, data type, and change the time series to view the historical data and analyze the disk utilization.

    • Tenant Status: Shows the overall status of the tenant image such as Node, Instance ID, Phase, Pod name, Creation time, Ready time, Status, and Management MAC details.

  4. Select the auto refresh interval from the dropdown to refresh the data displayed or click the refresh icon to update the tenant data immediately. The utilization data does not depend on the refresh interval. It will continue to collect utilization statistics for the tenant regardless of the selected reload interval.

Tenant high availability (HA) overview

You can configure tenants for high-availability (HA) on an rSeries system similar to how it is done on a BIG-IP system or for vCMP guests. To implement high-availability, you set up device service clustering or DSC. DSC provides synchronization and failover of BIG-IP configuration data and traffic groups on two or more tenants. The tenant administrator sets up DSC on the tenants. For information on BIG-IP Next tenant configuration, see my.f5.com.

If you plan to set up mirroring, you must use an additional system. Connection mirroring requires that both rSeries systems have identical hardware platforms.

**Important: **Tenants must have identical resources to ensure seamless HA failover. F5 does not support HA between tenants on disparate platforms.

For more information, see these guides at K000130285: F5 Product Manuals Index:

Configure High Availability (HA) for BIG-IP Tenants

Before you begin, you must set up two rSeries systems with initial configuration, management IP addresses, gateways, DNS servers, and licensing. For more information, see F5 rSeries Systems: Software Installation and Upgrade and other sections in this guide.

Note:
The F5 r2000/r4000 systems require that MAC masquerade (MM) is configured for high availability (HA). MAC masquerade can only be configured on trusted tenants. Ensure that you have enabled trust-mode for any tenant on which you plan to configure HA. For more information about configuring MM, see K13502: Configuring MAC masquerade (11.x - 16.x).

You can set up high availability for two BIG-IP tenants that reside on two separate rSeries systems.

  1. Log in to the system and deploy a BIG-IP tenant.

Note: Make sure that both tenants are running the same BIG-IP software version and that it is compatible with rSeries systems.

  1. On the tenants, set up L2 network connectivity between the two tenants, including setting up VLANs and self-IPs for ConfigSync, failover, and mirroring.
    For example, create the same VLAN on both tenants with management IP addresses that can communicate with each other.

  2. Log in to each tenant and set the failover ConfigSync address to the self IP addresses on both sides.

  3. Establish device trust: On one of the tenants, go to Device Management > Device Trust, create a device trust, and add the management IP of the other tenant.

  4. Create a Sync-Failover device group: On the tenants, go to Device Management > Device Group and create a device group with the Group Type option set to Sync-Failover.
    For more information, see the “Working with Device Groups” section in BIG-IP Device Service Clustering: Administration at K000130285: F5 Product Manuals Index.

  5. On the tenants, go to Device Management > Devices, select the device, and initiate the first ConfigSync manually.

  6. For tenants on the F5 r2000/r4000 platforms, configure MAC masquerade.
    For more information, see the “Managing Failover” section in BIG-IP Device Service Clustering: Administration at K000130285: F5 Product Manuals Index.
    For information about configuring MAC masquerade, see K13502: Configuring MAC masquerade (11.x - 17.x).

After setting up HA for tenants, you can optionally create traffic groups, enable mirroring on the virtual servers, and sync the configurations.

Understand that there are many ways to configure HA, and this summary explains the general workflow for how to approach tenant HA. Your environment might require additional steps.