Install FLP in a VM using the FLP QCOW2 or OVS image¶

Prerequisites for FLP Configuration in a VM¶

Obtained the JWT for F5 BIG-IP Next for Kubernetes.
Access to the myF5.
Capability to provision a virtual machine.
Compatible Hypervisor with FLP QCOW2 image.
Network reachability to the F5 TEEMS entitlement URL.
Virtual Machine minimum requirements:
- CPU: 4
- Memory: 8GB
- Storage: >80GB (more than 80GB)

Download FLP QCOW2 or OVA Image¶

Use your credentials to sign in to myF5.
Navigate to Resources > Downloads.
Review the End User License Agreement and Program Terms.
Select the I have read and agreed to the terms of the End User License Agreement and Program Terms. checkbox and click Next.
Select BIG-IP_Next in the Group field. The Tell us more about the product you want section is displayed.

Select BIG-IP Next for Kubernetes in the Product Line field.

Select the latest version in the Product Version field.
Select the latest version name in the Select a product container section.
Select the QCOW2 or OVA file in the Select a download file section.
Select the appropriate location in the Download locations field and Click Download.

Create a OpenStack VM¶

Provision an OpenStack VM with specified CPU, Memory, and storage that supports FLP QCOW2 image.
When provisioning a virtual machine (VM), you must configure a password for the admin user using one of the following cloud-init configuration options:

A combination of text (letters and numbers) and special characters password, see step 3.
An encrypted password, see step 4.
SSH keys, see step 5.

Ensure you choose only one cloud-init configuration option to set up the password.

Important

Make sure to copy the entire cloud-init config including #cloud-config while you set up a password for the admin user.

Cloud-init config to setup plain text password.

#cloud-config
users:
  - name: admin
    lock_passwd: false
    shell: /bin/bash
chpasswd:
  expire: false
  users:
    - name: admin
    # you can change the password here
    password: Admin123$
    type: text

Cloud-init config to setup encrypted password.

Before you configure Cloud-init with encrypted password, you must generate an encrypted password in your local host and use as part of Cloud-init config.

openssl passwd -6 admin
$6$fG216xAgMBIkUQ8.rTco4sddfhBdL9sdfPcnd1uUte3zAwHFhbdJ0

Cloud-init config:

#cloud-config
users:
  - name: admin
    lock_passwd: false
    shell: /bin/bash
chpasswd:
  expire: false
  users:
    - name: admin
    # you can change the password here
    password: $6$fG216xAgMBIkUQ8.rTco4sddfhBdL9sdfPcnd1uUte3zAwHFhbdJ0

Cloud-init config to setup password using ssh keys.

#cloud-config
users:
  - name: admin
    lock_passwd: false
    shell: /bin/bash
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaCsfjyYerNTE5AAAAUwebyAOBEXFJRmJReGvx1GI8IRu7

Deploy FLP Image in the VM¶

Login to the VM with admin credentials and proceed with FLP configuration.
Run sudo setup script and follow the on-screen instructions to complete the configuration.
When prompted for admin password, input your admin password that you have configured using Cloud-init config.
When prompted for JWT, input your JWT and press ENTER.
When prompted to update the f5CertUrl, f5Entitlement, f5InitialConfig URL, you must input N and press ENTER to continue.
When prompted to set up a proxy, If you choose Y, you must provide Proxy Host and Proxy Port. To know more about Forward Proxy, see the forward proxy documentation.
- Enter Proxy Host: <proxy host>
- Enter Proxy Port: <port number>
When prompted to enter Proxy Protocol, if you choose https, you must provide a Proxy ca bundle.
- Paste the proxy cert, press Enter, then Ctrl+D.

-----BEGIN CERTIFICATE-----
DksfeHtRAnugAwsdgIUEwtqc5WIsdhWly+DbxcaJKoZIhvEL
-----END CERTIFICATE------

When prompted to Enable proxy authentication, if you choose Y, you must provide Proxy Username and Proxy Password.
- Enter Proxy Username: XXXXXX
- Enter Proxy Password: XXXXXXX
This step validates the Proxy Host, Port, Certificate, Username, and Password. If any of the provided values are incorrect, the configuration fails.
When prompted to Enter F5 Root Cert, input N and proceed.

When prompted to restore FLP root certificates, input N and press ENTER if you are configuring FLP for the first time.

Starting MTLS execution - creating root CA
Starting MTLS execution - creating server cert
Starting vault execution - creating server cert
Environment preparation successful
Create the secret for flp-jwt-secret flp-mtls-secret postgresql-mtls-secret vault-ssl-secret
Secret creation successful

User will be prompted to provide encryption password for FLP root certificates backup file. If you choose to restore the FLP root certificates in previous step, you will not be prompted with this information.
- When prompted with Encryption password for FLP root certificates backup, provide the encryption password to the backup FLP root certificates.
- When prompted with Reenter encryption password for FLP root certificates backup, re-enter the encryption password to the backup FLP root certificates.
```
Passwords accepted.
Creating backup bundle backup.20250314-045912.tgz...
Encrypting backup bundle...
Backup bundle created at /root/.flp_spk_backup/backup.20250314-045912.tgz.enc
```
You must securely store the FLP root certificate backup bundle created at $HOME/.flp_spk_backup/backup.20250627-083720.tgz.enc and password used to encrypt the backup file to ensure it is available when needed.

Important

Retaining a copy of the root certificate is mandatory as it will be required for any future restoration of the FLP. Restoring the FLP with the same root certificate is essential to preserve the trust relationship between the FLP and the BNK/CNE cluster. Using a different root certificate during restoration may disrupt the trust relationship and cause communication issues.
When prompted to configure container log rotation, if you input Y, you will be prompted to configure log max file size, log max files, and log monitor interval. Follow the onscreen instructions:
Note
- The examples values give below are only for reference. To know the recommended values for different storage capacities, see the container log rotation storage recommendation section.
- User must specify only positive values (> 0). If a user wants to pass seconds - 5s, minutes and seconds - 3m5s, for hours, minutes and seconds - 1h2m5s.
- Enter container log max file size (Ki/Mi/Gi): 100Ki
- Enter container log max files: 3
- Enter container log monitor interval (hms): 5s
```
Updating container log rotation configurations
Updated container log rotation configurations successfully
Restarting K3S Server to apply new configurations
K3S Server started with new log rotation configurations.
```

Container log rotation storage recommendation¶

The below are the recommended container log rotation storage values for different storage capacities:

For 3 GB Storage¶

Parameter	Recommended Value	Description
`containerLogMaxSize`	10Mi	Maximum log size per container
`containerLogMaxFiles`	3	Retain up to 3 log files
`containerLogMonitorInterval`	“0h0m5s”	Monitor log rotation every 5 seconds

For 5 GB Storage¶

Parameter	Recommended Value	Description
`containerLogMaxSize`	20Mi	Maximum log size per container
`containerLogMaxFiles`	6	Retain up to 6 log files
`containerLogMonitorInterval`	“0h0m10s”	Monitor log rotation every 10 seconds

Create FLP Debug Logs Archive¶

The debug log archive serves as a valuable resource for the F5 support team, aiding in the efficient resolution of any issues reported by users.

To create a debug logs archive, follow the instructions below:

Create a debug logs archive gzip file.

kubectl -n default logs deployment/f5-license-proxy --all-containers=true &>f5-license-proxy.log ; gzip f5-license-proxy.log

Verify the created archive.
```
ls
```
Submit the debug logs archive gzip file to the F5 support team through the Customer Support portal.