F5SPKIngressTCP

Overview

This overview discusses the F5SPKIngressTCP CR. For the full list of CRs, refer to the SPK CRs overview. The F5SPKIngressTCP Custom Resource (CR) configures the Service Proxy Traffic Management Microkernel (TMM) to proxy and load balance low-latency TCP application traffic between networks using a virtual server and load balancing pool. The F5SPKIngressTCP CR also provides options to tune how connections are processed, and to monitor the health of Service object Endpoints.

This document guides you through understanding, configuring and installing a simple F5SPKIngressTCP CR.

CR integration

SPK CRs should be integrated into the cluster after the Kubernetes application Deployment and application Service object have been installed. The SPK Controller uses the CR service.name to discover the application Endpoints, and use them to create TMM’s load balancing pool. The recommended method for installing SPK CRs is to include them in the application’s Helm release. Refer to the Helm CR Integration guide for more information.

CR parameters

The table below describes the CR parameters used in this document, refer to the F5SPKIngressTCP Reference for the full list of parameters.

service

The table below describes the CR service parameters.

Parameter	Description
name	Selects the Service object name for the internal applications (Pods), and creates a round-robin load balancing pool using the Service Endpoints.
port	Selects the Service object port value.

spec

The table below describes the CR spec parameters.

Parameter	Description
destinationAddress	Creates an IPv4 virtual server address for ingress connections.
destinationPort	Defines the service port for inbound connections. When the Kubernetes service being load balanced has multiple ports, install one CR per service, or use port 0 for all ports.
ipv6destinationAddress	Creates an IPv6 virtual server address for ingress connections.
idleTimeout	The TCP connection idle timeout period in seconds (1-4294967295). The default value is 300 seconds.
loadBalancingMethod	Specifies the load balancing method used to distribute traffic across pool members: ROUND_ROBIN distributes connections evenly across all pool members (default), and RATIO_LEAST_CONN_MEMBER distributes connections first to members with the least number of active connections.
snat	Enables translating the source IP address of ingress packets to TMM's self IP addresses: SRC_TRANS_AUTOMAP to enable, or SRC_TRANS_NONE to disable (default).
vlans.vlanList	Specifies a list of F5SPKVlan CRs to listen for ingress traffic, using the CR's metadata.name. The list can also be disabled using disableListedVlans.
vlans.category	Specifies an F5SPKVlan CR category to listen for ingress traffic. The category can also be disabled using disableListedVlans.

monitors

The table below describes the CR monitors parameters.

Parameter	Description
tcp.interval	Specifies in seconds the monitor check frequency: 1 to 86400. The default is 5.
tcp.timeout	Specifies in seconds the time in which the target must respond: 1 to 86400. The default is 16.

CR example

apiVersion: "ingresstcp.k8s.f5net.com/v1"
kind: F5SPKIngressTCP
metadata:
  name: "nginx-web-cr"
  namespace: "web-apps"

service:
  name: nginx-web-app
  port: 80
spec:
  destinationAddress: "192.168.1.123"
  destinationPort: 80
  ipv6destinationAddress: "2001::100:100"
  idleTimeout: 30
  loadBalancingMethod: "ROUND_ROBIN"
  snat: "SRC_TRANS_AUTOMAP"
  vlans:
    vlanList:
    - vlan-external
monitors:
  tcp:
    - interval: 3
    - timeout: 10

Application Project

The SPK Controller and Service Proxy TMM Pods install to a different Project than the TCP application (Pods). When installing the SPK Controller, set the controller.watchNamespace parameter to the TCP Pod Project in the Helm values file. For example:

Important: Ensure the Project currently exists in the cluster, the SPK Controller does not discover Projects created after installation.

controller:
  watchNamespace: "web-apps"

Dual-Stack environments

Service Proxy TMM’s load balancing pool is created by discovering the Kubernetes Service Endpoints in the Project. In IPv4/IPv6 dual-stack environments, to populate the load balancing pool with IPv6 members, set the Service PreferDualStack parameter to IPv6. For example:

kind: Service
metadata:
  name: nginx-web-app
  namespace: web-apps
  labels:
    app: nginx-web-app
spec:
  ipFamilyPolicy: PreferDualStack
  ipFamilies:
  - IPv6
  - IPv4

Important: When enabling PreferDualStack, ensure TMM’s internal F5SPKVlan interface configuration includes both IPv4 and IPv6 addresses.

Ingress traffic

To enable ingress network traffic, Service Proxy TMM must be configured to advertise virtual server IP addresses to external networks using the BGP dynamic routing protocol. Alternatively, you can configure appropriate routes on upstream devices. For BGP configuration assistance, refer to the BGP Overview.

Requirements

Ensure you have:

• Installed a K8S Service object and application.
• Installed the SPK Controller.
• A Linux based workstation.

Installation

Use the following steps to obtain the application’s Service object configuration, and configure and install the F5SPKIngressTCP CR.

1. Switch to the application Project:

   oc project <project>
   

   In this example, the application is in the web-apps Project:

   oc project web-apps
   

2. Use the Service object NAME and PORT to configure the CR service.name and service.port parameters:

   oc get service 
   

   In this example, the Service object NAME is nginx-web-app and the PORT is 80:

   NAME           TYPE       CLUSTER-IP    EXTERNAL-IP   PORT(S) 
   nginx-web-app  NodePort   10.99.99.99   <none>        80:30714/TCP
   

3. Copy the example CR into a YAML file:

   apiVersion: "ingresstcp.k8s.f5net.com/v1"
   kind: F5SPKIngressTCP
   metadata:
     name: "nginx-web-cr"
     namespace: "web-apps"
   service:
     name: "nginx-web-app"
     port: 80
   spec:
     destinationAddress: "192.168.1.123"
     destinationPort: 80
     ipv6destinationAddress: "2001::100:100"
     idleTimeout: 30
     loadBalancingMethod: "ROUND_ROBIN"
     snat: "SRC_TRANS_AUTOMAP"
     vlans:
       vlanList:
       - vlan-external
   monitors:
     tcp:
       - interval: 3
       - timeout: 10
   

4. Install the F5SPKIngressTCP CR:

   oc apply -f spk-ingress-tcp.yaml
   

5. Web clients should now be able to connect to the application through the Service Proxy TMM.

Connection statistics

If you installed the SPK Controller with the Debug Sidecar enabled, connect to the sidecar to view virtual server and pool member connecitivy statistics.

1. Log in to the Service Proxy Debug container:

   oc exec -it deploy/f5-tmm -c debug -n spk-ingress -- bash
   

2. View the virtual server connection statistics:

   tmctl -f /var/tmstat/blade/tmm0 virtual_server_stat -s name,serverside.tot_conns 
   

   For example:

   name                                serverside.tot_conns
   ----------------------------------- --------------------
   spk-apps-nginx-web-crd-virtual-server                 31
   

3. View the load balancing pool connection statistics:

   tmctl -f /var/tmstat/blade/tmm0 pool_member_stat -s pool_name,serverside.tot_conns 
   

   For example:

   web-apps-nginx-web-crd-pool                        15
   web-apps-nginx-web-crd-pool                        16
   

Feedback

Provide feedback to improve this document by emailing spkdocs@f5.com.

Supplemental

• Kubernetes Service