Manually install the F5 License Proxy

Using the steps below, users can manually install FLP or automate the installation process as part of a CI/CD pipeline or automation tools, leveraging the required tools, configurations, and scripts below.

1. Prepare Working Directories

Create the necessary directories for volume, backup, and restore operations, and assign the appropriate permissions.

mkdir -p \
    $HOME/.flp_spk_volume/postgresql/mtls \
    $HOME/.flp_spk_volume/vault/ssl \
    $HOME/.flp_spk_volume/flp \
    $HOME/.flp_spk_volume/certificates \
    $HOME/.flp_spk_backup \
    $HOME/.flp_spk_restore \
&& chmod -R 0777 $HOME/.flp_spk_volume \
&& chmod 0777 $HOME/.flp_spk_backup \
&& chmod 0777 $HOME/.flp_spk_restore

2. Generate Root Certificates

Customers can either generate root CA certificates using the OpenSSL commands provided below or supply a Certificate Authority-issued root certificate to generate the F5 License Proxy server certificate. To restore an already existing Root CA, see next step. If no existing backup is available, manually create a root certificate. Use the command below to generate the Root CA key and certificate.

openssl req \
   -new \
   -newkey ec:<(openssl ecparam -name prime256v1) \
   -days 3650 -nodes -x509 \
   -subj "/C=US/ST=Washington/L=Seattle/O=F5/emailAddress=flp@f5.com/CN=flp.ca" \
   -keyout $HOME/.flp_spk_volume/certificates/root-ca.key \
   -out $HOME/.flp_spk_volume/certificates/root-ca.crt

3. Backup/Restore Root Certificates

Retaining or taking back up of the root certificate is mandatory as it will be required for any future restoration of the FLP. Restoring or reconfiguring the FLP with the same root certificate is essential to preserve the trust relationship between the FLP and the BNK cluster. Using a different root certificate during restoration may disrupt the trust relationship and cause communication issues.

Backup Root Certificates

tar -czf backup.tgz -C $HOME/.flp_spk_volume/certificates/ root-ca.crt root-ca.key
openssl enc -aes-256-cbc -pbkdf2 -pass pass:<your_password> -in backup.tgz -out backup.tgz.enc
mv backup.tgz.enc $HOME/.flp_spk_backup
rm backup.tgz

Restore Root Certificates

openssl aes-256-cbc -d -pbkdf2 -pass pass:<your_password> \
  -in $HOME/.flp_spk_backup/<backup-file-name>.enc -out backup.tgz
tar -xvf backup.tgz -C $HOME/.flp_spk_volume/certificates
rm backup.tgz

> Note: Never rename or manually move backup files to the restore directory, as this may damage the metadata and result in unsuccessful restorations.

4. Generate Certificates for mTLS

Certificates for mTLS (Mutual TLS) are required to establish secure, authenticated communication between endpoints (e.g., client and server) in a network. In modern cloud-native and distributed architectures, mTLS certificates ensure secure communication and verification, preserving trust across systems. User must generate certificates for all the containers in FLP pod.

4.1 PostgreSQL mTLS

  1. Generate Private Key and Certificate Signing Request (CSR).

    openssl ecparam -out $HOME/.flp_spk_volume/postgresql/mtls/tls.key -name prime256v1 -genkey
openssl req -new \
   -sha512 \
   -key $HOME/.flp_spk_volume/postgresql/mtls/tls.key \
   -out $HOME/.flp_spk_volume/postgresql/mtls/tls.csr \
   -subj "/C=US/ST=Washington/L=Seattle/O=F5/emailAddress=flp@f5.com/CN=postgresql"

  2. Sign the CSR with Root CA.

    openssl x509 -req \
   -sha512 \
   -in $HOME/.flp_spk_volume/postgresql/mtls/tls.csr \
   -CA $HOME/.flp_spk_volume/certificates/root-ca.crt \
   -CAkey $HOME/.flp_spk_volume/certificates/root-ca.key \
   -CAcreateserial \
   -out $HOME/.flp_spk_volume/postgresql/mtls/tls.crt \
   -days 3650 \
   -extfile <(printf "subjectAltName=DNS:postgresql,DNS:localhost")

  3. Create Kubernetes Secrets.

    cp .flp_spk_volume/certificates/root-ca.crt .flp_spk_volume/postgresql/mtls/ca.crt
cp .flp_spk_volume/certificates/root-ca.key .flp_spk_volume/postgresql/mtls/ca.key
kubectl create secret generic postgresql-mtls-secret \
   --from-file=ca.crt=$HOME/.flp_spk_volume/postgresql/mtls/ca.crt \
   --from-file=tls.crt=$HOME/.flp_spk_volume/postgresql/mtls/tls.crt \
   --from-file=tls.key=$HOME/.flp_spk_volume/postgresql/mtls/tls.key \
   --dry-run=client -o yaml | kubectl apply -f -

4.2 Vault SSL

  1. Generate Private Key and Certificate Signing Request (CSR).

    openssl genrsa -out "$HOME/.flp_spk_volume/vault/ssl/tls.key" 8192
openssl req \
   -newkey rsa:8192 \
   -sha512 \
   -nodes \
   -out "$HOME/.flp_spk_volume/vault/ssl/tls.csr" \
   -key "$HOME/.flp_spk_volume/vault/ssl/tls.key" \
   -subj "/C=US/ST=Washington/L=Seattle/O=F5/emailAddress=flp@f5.com/CN=vault"

  2. Sign the CSR with Root CA.

    cp .flp_spk_volume/certificates/root-ca.crt .flp_spk_volume/vault/ssl/ca.crt
cp .flp_spk_volume/certificates/root-ca.key .flp_spk_volume/vault/ssl/ca.key
openssl x509 \
   -req \
   -sha512 \
   -days 3650 \
   -in "$HOME/.flp_spk_volume/vault/ssl/tls.csr" \
   -CA "$HOME/.flp_spk_volume/vault/ssl/ca.crt" \
   -CAkey "$HOME/.flp_spk_volume/vault/ssl/ca.key"\
   -set_serial 01 \
   -out "$HOME/.flp_spk_volume/vault/ssl/tls.crt" \
   -extfile <(printf "subjectAltName=DNS:vault,DNS:localhost,DNS:vault-postgresql-service,DNS:localhost")

  3. Create Secrets in Kubernetes.

    kubectl create secret generic vault-ssl-secret \
   --from-file=ca.crt=$HOME/.flp_spk_volume/vault/ssl/ca.crt \
   --from-file=tls.crt=$HOME/.flp_spk_volume/vault/ssl/tls.crt \
   --from-file=tls.key=$HOME/.flp_spk_volume/vault/ssl/tls.key \
   --dry-run=client -o yaml | kubectl apply -f -

4.3 FLP

  1. Generate Private Key and Certificate Signing Request (CSR).

    openssl genrsa -out "$HOME/.flp_spk_volume/flp/tls.key" 8192
openssl req \
   -newkey rsa:8192 \
   -sha512 \
   -nodes \
   -out "$HOME/.flp_spk_volume/flp/tls.csr" \
   -key "$HOME/.flp_spk_volume/flp/tls.key" \
   -subj "/C=US/ST=Washington/L=Seattle/O=F5/emailAddress=flp@f5.com/CN=flp"

  2. Sign the CSR with Root CA.

    cp .flp_spk_volume/certificates/root-ca.crt .flp_spk_volume/flp/ca.crt
cp .flp_spk_volume/certificates/root-ca.key .flp_spk_volume/flp/ca.key
openssl x509 \
   -req \
   -sha512 \
   -days 3650 \
   -in "$HOME/.flp_spk_volume/flp/tls.csr" \
   -CA "$HOME/.flp_spk_volume/flp/ca.crt" \
   -CAkey "$HOME/.flp_spk_volume/flp/ca.key"\
   -set_serial 01 \
   -out "$HOME/.flp_spk_volume/flp/tls.crt" \
   -extfile <(printf "subjectAltName=DNS:flp,DNS:localhost,DNS:localhost")

  3. Create Secrets in Kubernetes.

    kubectl create secret generic flp-mtls-secret \
   --from-file=ca.crt=$HOME/.flp_spk_volume/flp/ca.crt \
   --from-file=tls.crt=$HOME/.flp_spk_volume/flp/tls.crt \
   --from-file=tls.key=$HOME/.flp_spk_volume/flp/tls.key \
   --dry-run=client -o yaml | kubectl apply -f -

4.4 FLP-jwt-Secret

Create Secrets in Kubernetes:

kubectl create secret generic flp-jwt-secret \
   --from-literal=jwt_secret=$JWT_TOKEN \
   --dry-run=client -o yaml | kubectl apply -f -

5. Deploy helm chart to install FLP

  1. Run the following command to deploy and install FLP.

    Important

    • Update the command with the correct path to your Helm chart before executing.

    • Ensure the Helm chart is downloaded from FAR.

    • Verify that the Chart.yaml file exists in the intended folder.

    helm upgrade --install f5-license-proxy /root/f5-license-proxy \
--namespace default \
--timeout 600s \
--set flp.image.repository=<<image_path>> \
--set vaultInit.image.repository=<<image_path>> \
--set vault.image.repository=<<image_path>> \
--set postgresql.image.repository=<<images_path>>

  2. Add or update configurations using Helm flags (--set) to dynamically pass key-value pairs.

    --set flp.isProxyTlsEnabled=true
--set flp.isProxyAuthEnabled=true

  3. Check deployment status.

    helm list
kubectl get pods

6. Proxy Configuration

If you choose to use a proxy, export proxy’s settings via Kubernetes secrets.

  1. Verify Proxy Validation. Use curl to ensure the proxy is accessible.

    curl -x http://<proxy_host>:<proxy_port> <test_url>

  2. Create Proxy Secret.

    kubectl create secret generic flp-secret \
   --from-literal=host=<proxy_host> \
   --from-literal=port=<proxy_port> \
   --from-literal=protocol=http \
   --from-literal=username=<username> \
   --from-literal=password=<password>

  3. Optionally add CA Certificate for HTTPS.

    kubectl create secret generic flp-ssl-secret \
   --from-file=ca.crt=<path_to_ca.crt>