BIG-IP Controller¶

Overview¶

The Cloud-Native Network Functions (CNFs) BIG-IP Controller, Edge Firewall, and Traffic Management Microkernel (TMM) Proxy Pods are the primary CNFs software components, and install together using Helm. Once integrated, Edge Firewall and the TMM Proxy Pods can be configured to process and protect high-performance 5G workloads using CNFs CRs.

This document guides you through creating the CNFs installation Helm values file, installing the Pods, and creating TMM’s clientside (upstream) and serverside (downstream) F5BigNetVlan interfaces.

Requirements¶

Ensure you have:

Installed the CNFs Software.
Installed the CNFs Cert Manager.
Completed the CNFs Licensing.
A Linux based workstation with Helm installed.

Procedures¶

Helm values¶

The CNFs Helm values file requires a number of custom parameter values to successfully integrate the CNFs software. Use the steps below to obtain important cluster configuration data, and configure the CNFs parameter values for a successful installation.

TMM values

Use these steps to configure the TMM Proxy Helm values for your environment.

Ensure Helm has the location of your local image registry to download the TMM container:
```
tmm:
  image:
    repository: "local.registry.com"
```
CNFs relies on Kubernetes Topology Manager to dynamically allocate and properly align TMM’s CPU cores. Create a new Helm values file named ingress-values.yaml and add the tmm.topologyManager parameter:
```
tmm:
  topologyManager: "true"
```
Robin ip-pools provide information required to discover and order TMM’s SR-IOV network interface list. The interface numbers will be required later when configuring and installing the F5BigNetVlan Custom Resource (CR). Use the steps below to obtain the Robin ip-pool information:

A. To configure the tmm.cniNetworks parameter, obtain the Names of the clientside (upstream) and serverside (downstream) ip-pools:
```
robin ip-pool list
```
In this example, the clientside ip-pool Name is e801-180 and the serverside ip-pool Name is e810-181:
```
Name       | Driver | Network           | VLAN 
-----------+--------+-------------------+-------
e810-180   | sriov  | 192.168.10.100/24 | -    
e810-181   | sriov  | 10.10.10.100/24   | -   
```
B. To configure the tmm.customEnvVars parameters, obtain the NIC Tags value for the clientside ip-pool:
```
robin ip-pool info e810-180 | grep NIC
```
In this example, the NIC Tags value is p1p1:
```
NIC Tags: [{'name': 'p1p1'}]
```
C. Obtain the NIC Tags value for the serverside ip-pool:
```
robin ip-pool info e810-181 | grep NIC
```
In this example, the NIC Tags value is p1p2:
```
NIC Tags: [{'name': 'p1p2'}]
```
D. Use the ip-pool Name and NIC Tags values to create TMM’s interface list, using the BIG-IP Controller’s Helm values. The interface maximum transmission unit (MTU) size can also be set here:

In this example, TMM’s clientside interface is 1.1, and the serverside interface is 1.2:
```
tmm:
  cniNetworks: '[{"ippool": "e810-180", "mtu": 9000}, {"ippool": "e810-181", "mtu": 9000}]'
    robinNetworks: "true"
    customEnvVars:
     - name: ROBIN_VFIO_RESOURCE_1
       value: "P1P1_VFIOPCI"
     - name: ROBIN_VFIO_RESOURCE_2
       value: "P1P2_VFIOPCI"
```
CNFs supports Ethernet frames over 1500 bytes (Jumbo frames), up to a maxiumum transmission unit (MTU) size of 9000 bytes. To modify the MTU size, adapt theTMM_DEFAULT_MTU parameter:

Important: The same MTU value must be set in each of the installed F5BigNetVlan CRs. CNFs does not currently support different MTU sizes.
```
tmm:
  customEnvVars:
  - name: TMM_DEFAULT_MTU
    value: "9000"
```
To use the Calico CNI, set the TMM_CALICO_ROUTER parameter. If the CNI relies on a router to perform proxy ARP, set the TMM_IGNORE_GATEWAYS parameter to ensure TMM does not configure a default gateway:

Important: Enabling TMM_IGNORE_GATEWAYS may cause cluster (Pod-to-Pod) traffic to fail. To set routes for specific cluster IPs, review Cluster Traffic in the F5BigNetStaticroute CR guide.
```
tmm:
  customEnvVars:
   - name: TMM_CALICO_ROUTER
   value: "default"
   - name: TMM_IGNORE_GATEWAYS
   value: "TRUE"
```

To advertise routing information between networks, or to scale TMM beyond a single instance, the f5-tmm-routing container must be enabled, and a Border Gateway Protocol (BGP) session must be established with an external neighbor. The parameters below configure an external BGP peering session:

_images/spk_info.png Note: For additional BGP configuration parameters, refer to the BGP Overview guide.

tmm:
  dynamicRouting:
    enabled: true
    exportZebosLogs: true
    tmmRouting:
      image:
        repository: "local.registry.com"
      config:
        bgp:
          asn: 123
          neighbors:
          - ip: "192.168.10.200"
            asn: 456
            acceptsIPv4: true

    tmrouted:
      image:
        repository: "local.registry.com"

Be default, the TMM container uses the default Kubernetes serviceAccount. Use the parameter below to modify the serviceAccount used by TMM:
```
tmm:
  serviceAccount:
    create: false
    name: tmm_sa
```
The Fluentd Logging collector is enabled by default, and requires setting the f5-toda-logging.fluentd.host parameter:

A. When Fluentd is enabled, ensure the fluentd.host parameter targets the Fluentd Pod’s namespace:

In this example, the host value includes the Fluentd Pod’s cnf-gateway namespace.
```
f5-toda-logging:
  fluentd:
    host: "f5-toda-fluentd.cnf-gateway.svc.cluster.local."
  sidecar:
    image:
      repository: "local.registry.com"
```
B. When Fluentd is disabled, set the f5-toda-logging.enabled parameter to false:
```
f5-toda-logging:
  enabled: false
```

AFM values

Use these steps to enable and configure the Edge Firewall Helm values for your environment.

To enable the Edge Firewall feature, and to ensure Helm can obtain the image from the local image registry, add the following Helm values:

global:
   afm:
     enabled: true
     pccd:
       enabled: true 

f5-afm:
   enabled: true
   cert-orchestrator:
     enabled: true
   afm:
     pccd:  
       enabled: true
       image:
        repository: "local.registry.com"

The Edge Firewall’s default firewall mode accepts all network packets not matching an F5BigFwPolicy firewall rule. You can modify this behavior using the F5BigContextGlobal Custom Resource (CR). For addition details about the default firewall mode and logging parameters, refer to the Firewall mode section of the F5BigFwPolicy overview:

The Fluentd Logging collector is enabled by default, and requires setting the f5-toda-logging.fluentd.host parameter. If you installed Fluentd, ensure the host parameter targets the Fluentd Pod’s namespace:

In this example, the host value includes the Fluentd Pod’s cnf-gateway Namespace.

f5-afm:
  afm:
    fluentbit_sidecar:
      fluentd:
        host: 'f5-toda-fluentd.cnf-gateway.svc.cluster.local.'
      image:
        repository: "registry.com"

global:
  afm:
    enabled: true
    pccd:
      enabled: true

IPSD values

Use these steps to enable and configure the Intrusion Prevention System Helm values for your environment.

To enable the IPSD Pod, and to ensure Helm can obtain the image from the local image registry, add the following Helm values:
```
f5-ipsd:
  enabled: true
  ipsd:
    image:
      repository: "local.registry.com"
```
The Fluentd Logging collector is enabled by default, and requires setting the f5-toda-logging.fluentd.host parameter. If you installed Fluentd, ensure the host parameter targets the Fluentd Pod’s namespace:

In this example, the host value includes the cnf-gateway Namespace.
```
f5-ipsd:
  ipsd:
    fluentbit_sidecar:
      fluentd:
        host: "f5-toda-fluentd.cnf-gateway.svc.cluster.local."
      image:
          repository: "local.registry.com"
```

Downloader values

Use these steps to enable and configure the Downloader Helm values for your environment.

To enable the Downloader Pod, and to ensure Helm can obtain the image from the local image registry, add the following Helm values:
```
f5-downloader:
  enabled: true
  downloader:
    image:
      repository: "local.registry.com"
```
The Fluentd Logging collector is enabled by default, and requires setting the f5-toda-logging.fluentd.host parameter. If you installed Fluentd, ensure the host parameter targets the Fluentd Pod’s Namespace:

In this example, the host value includes the cnf-gateway Namespace.
```
f5-downloader:
  downloader:
    fluentbit_sidecar:
      image:
        repository: "local.registry.com"
      fluentd:
        host: "f5-toda-fluentd.cnf-gateway.svc.cluster.local."
```

Controller values

Use these steps to configure the BIG-IP Controller Helm values for your environment.

To ensure Helm can obtain the image from the local image registry, add the following Helm values:

The example below also includes the CNFs CWC values.

controller:
  image:
    repository: "local.registry.com"

  f5_lic_helper:
    enabled: true
    rabbitmqNamespace: "cnf-telemetry"
    image:
      repository: "local.registry.com"

The Fluentd Logging collector is enabled by default, and requires setting the f5-toda-logging.fluentd.host parameter. If you installed Fluentd, ensure the host parameter targets the Fluentd Pod’s namespace:

In this example, the host value includes the cnf-gateway Namespace.
```
controller:
  fluentbit_sidecar:
    fluentd:
      host: 'f5-toda-fluentd.cnf-gateway.svc.cluster.local.'
    image:
      repository: "local.registry.com"
```

Completed values

The completed Helm values file should appear similar to the following:

tmm:
  image:
    repository: "local.registry.com"

  hugepages:
    enabled: true

  sessiondb:
    useExternalStorage: "true"

  topologyManager: true

  cniNetworks: '[{"ippool": "e810-180", "mtu": 9000}, {"ippool": "e810-181", "mtu": 9000}]'
  robinNetworks: "true"
  customEnvVars:
    - name: ROBIN_VFIO_RESOURCE_1
      value: "P1P1_VFIOPCI"
    - name: ROBIN_VFIO_RESOURCE_2
      value: "P1P2_VFIOPCI"
    - name: TMM_DEFAULT_MTU
      value: "9000"
    - name: TMM_IGNORE_GATEWAYS
      value: "TRUE"
    - name: TMM_CALICO_ROUTER
      value: "default"
    - name: SESSIONDB_DISCOVERY_SENTINEL
      value: "true"
    - name: SESSIONDB_EXTERNAL_SERVICE
      value: "f5-dssm-sentinel.cnf-gateway"
    - name: SSL_SERVERSIDE_STORE
      value: "/tls/tmm/mds/clt"
    - name: SSL_TRUSTED_CA_STORE
      value: "/tls/tmm/mds/clt"

  dynamicRouting:
    enabled: true
    exportZebosLogs: true
    tmmRouting:
      image:
        repository: "local.registry.com"
      config:
        bgp:
          asn: 123
          neighbors:
          - ip: "192.168.10.200"
            asn: 456
            acceptsIPv4: true

    tmrouted:
      image:
        repository: "local.registry.com"

global:
  afm:
    enabled: true
    pccd:
      enabled: true 

f5-afm:
  enabled: true
  cert-orchestrator:
    enabled: true
  afm:
    pccd:  
      enabled: true
      image:
        repository: "local.registry.com"
    fluentbit_sidecar:
      fluentd:
        host: 'f5-toda-fluentd.cnf-gateway.svc.cluster.local.'
      image:
        repository: "local.registry.com"

f5-ipsd:
  enabled: true
  ipsd:
    image:
      repository: "local.registry.com"
    fluentbit_sidecar:
      fluentd:
        host: 'f5-toda-fluentd.cnf-gateway.svc.cluster.local.'
      image:
         repository: "local.registry.com"

controller:
  image:
    repository: "local.registry.com"

  f5_lic_helper:
    enabled: true
    rabbitmqNamespace: "cnf-telemetry"
    image:
      repository: "local.registry.com"

  fluentbit_sidecar:
    enabled: true
    image:
      repository: "local.registry.com"
    fluentd:
      host: 'f5-toda-fluentd.cnf-gateway.svc.cluster.local.'

f5-toda-logging:
  fluentd:
    host: "f5-toda-fluentd.cnf-gateway.svc.cluster.local."
  sidecar:
    image:
      repository: "local.registry.com"

debug:
  rabbitmqNamespace: "cnf-telemetry"
  image: 
    repository: "local.registry.com"

Installation¶

Change into the directory containing the latest CNFs Software, and obtain the f5ingress Helm chart version:

In this example, the CNF files are in the cnfinstall directory:
```
cd cnfinstall
```
```
ls -1 tar | grep f5ingress
```
The example output should appear similar to the following:
```
f5ingress-9.2.11.tgz
```
If you haven’t already, create a new namespace for the CNFs Pods using the following command syntax:
```
kubectl create ns <namespace>
```
For example:
```
kubectl create ns cnf-gateway
```

Install the BIG-IP Controller using the following command syntax:

helm install f5ingress tar/<helm chart> \
-f <values file> -n <namespace>

For example:

helm install f5ingress tar/f5ingress-9.2.11.tgz \
-f ingress-values.yaml -n cnf-gateway

Verify the Pods have installed successfully, and all containers are Running:

kubectl get pods -n cnf-gateway

In this example, all containers have a STATUS of Running as expected:

NAME                                    READY   STATUS    
f5-afm-5bb5cd989b-b8qpf                 2/2     Running  
f5-ingress-f5ingress-7965947785-b8f5c   2/2     Running
f5-ipsd-74f5754b5d-kjzft                1/1     Running 
f5-tmm-576df78f88-mpzbq                 4/4     Running

Verify the f5ingress Pod has successfully licensed:

kubectl logs f5ingress-f5ingress-7965947785-b8f5c  -c f5-lic-helper \
-n cnf-gateway | grep -i LicenseVerified

In this example, the f5ingress Pod’s f5-lic-helper indicates Entitlement: paid.

2023-02-03 22:00:44.221|A|informational|1|Message="Payload type:
ResponseCM20LicenseVerified Entitlement: paid Expiry Date: 2024-01-29T00:01:03Z"

Interfaces¶

The F5BigNetVlan Custom Resource (CR) applies TMM’s interface configuration; IP addresses, VLAN tags, MTU, etc. Use the steps below to configure and install clientside and serverside F5BigNetVlan CRs:

Configure external and internal F5BigNetVlan CRs. You can place both of the example CRs into a single YAML file:

_images/spk_warn.png Important: Set the cmp_hash parameter values to SRC_ADDR on the clientside (upstream) VLAN, and DST_ADDR on the serverside (downstream) VLAN.

apiVersion: "k8s.f5net.com/v1"
kind: F5BigNetVlan
metadata:
  name: "subscriber-vlan"
  namespace: "cnf-gateway"
spec:
  name: clientside
  interfaces:
    - "1.1"
  selfip_v4s:
    - 10.10.10.100
    - 10.10.10.101
  prefixlen_v4: 24
  selfip_v6s:
    - 2002::10:10:10:100
    - 2002::10:10:10:101
  prefixlen_v6: 116
  mtu: 9000
  cmp_hash: SRC_ADDR
---
apiVersion: "k8s.f5net.com/v1"
kind: F5BigNetVlan
metadata:
  name: "application-vlan"
  namespace: "cnf-gateway"
spec:
  name: serverside
  interfaces:
    - "1.2"
  selfip_v4s:
    - 192.168.10.100
    - 192.168.10.101
  prefixlen_v4: 24
  selfip_v6s:
    - 2002::192:168:10:100
    - 2002::192:168:10:101
  prefixlen_v6: 116
  mtu: 9000
  cmp_hash: DST_ADDR

Install the VLAN CRs:
```
kubectl apply -f cnf_vlans.yaml
```

List the VLAN CRs:

kubectl get f5-big-net-vlan -n cnf-gateway

In this example, the VLAN CRs are installed:

NAME           
vlan-client
vlan-server

If the Debug Sidecar is enabled (the default), you can verify the f5-tmm container’s interface configuration:

kubectl exec -it deploy/f5-tmm -c debug -n cnf-gateway -- ip a

The interfaces should appear at the bottom of the list:

8: clientside: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000
    inet 10.10.10.100/24 brd 192.168.10.0 scope global client
       valid_lft forever preferred_lft forever
    inet6 2002::192:168:10:100/112 scope global
       valid_lft forever preferred_lft forever
9: serverside: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000
    link/ether 1e:80:c1:e8:81:15 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.100/24 brd 10.10.10.0 scope global server
       valid_lft forever preferred_lft forever
    inet6 2002::10:10:10:100/112 scope global
       valid_lft forever preferred_lft forever

Feedback¶

Provide feedback to improve this document by emailing cnfdocs@f5.com.

Supplemental¶

Calico router

Previous Next