$ oadm policy remove-scc-from-user hostnetwork -z router $ oadm policy add-scc-to-user privileged -z router
The F5 router plug-in is provided as a container image and run as a pod, just like the default HAProxy router.
When deploying the F5 router plug-in, ensure you meet the following requirements:
An F5 host IP and credentials
The name of the virtual servers (for both HTTP and HTTPS)
The private key to the F5 instance
The host-internal IP and VXLAN gateway
Ensure you have created the router service account.
As a prerequisite to working with the openshift-F5 integrated router, two virtual servers (one virtual server each for HTTP and HTTPS profiles, respectively) need to be set up in the F5 BIG-IP® appliance.
To set up a virtual server in the F5 BIG-IP® appliance, follow the instructions from F5.
While creating the virtual server, ensure the following settings are in place:
For the HTTP server, set the ServicePort to 'http'/80.
For the HTTPS server, set the ServicePort to 'https'/443.
In the basic configuration, set the HTTP profile to /Common/http for both of the virtual servers.
For the HTTPS server, create a default client-ssl profile and select it for the SSL Profile (Client).
To create the default client SSL profile, follow the instructions from F5, especially the Configuring the fallback (default) client SSL profile section, which discusses that the certificate/key pair is the default that will be served in the case that custom certificates are not provided for a route or server name.
|
The F5 router must be run in privileged mode, because route certificates are
copied using the $ oadm policy remove-scc-from-user hostnetwork -z router $ oadm policy add-scc-to-user privileged -z router |
Deploy the F5 router with the oadm router command, but provide additional
flags (or environment variables) specifying the following parameters for the F5
BIG-IP® host:
| Flag | Description |
|---|---|
|
Specifies that an F5 router should be launched (the default |
|
Specifies the F5 BIG-IP® host’s management interface’s host name or IP address. |
|
Specifies the F5 BIG-IP® user name (typically admin). |
|
Specifies the F5 BIG-IP® password. |
|
Specifies the name of the F5 virtual server for HTTP connections. This must be configured by the user prior to launching the router pod. |
|
Specifies the name of the F5 virtual server for HTTPS connections. This must be configured by the user prior to launching the router pod. |
|
Specifies the path to the SSH private key file for the F5 BIG-IP® host. Required to upload and delete key and certificate files for routes. |
|
A Boolean flag that indicates that the F5 router should skip strict certificate verification with the F5 BIG-IP® host. |
|
Specifies the F5 BIG-IP® partition path (the default is /Common). |
For example:
$ oadm router \
--type=f5-router \
--external-host=10.0.0.2 \
--external-host-username=admin \
--external-host-password=mypassword \
--external-host-http-vserver=ose-vserver \
--external-host-https-vserver=https-ose-vserver \
--external-host-private-key=/path/to/key \
--host-network=false \
--service-account=router
As with the HAProxy router, the oadm router command creates the service and
deployment configuration objects, and thus the replication controllers and
pod(s) in which the F5 router itself runs. The replication controller restarts
the F5 router in case of crashes. Because the F5 router is watching routes,
endpoints, and nodes and configuring F5 BIG-IP® accordingly, running the F5
router in this way, along with an appropriately configured F5 BIG-IP®
deployment, should satisfy high-availability requirements.
Partition paths allow you to store your OpenShift Origin routing configuration in a custom F5 BIG-IP® administrative partition, instead of the default /Common partition. You can use custom administrative partitions to secure F5 BIG-IP® environments. This means that an OpenShift Origin-specific configuration stored in F5 BIG-IP® system objects reside within a logical container, allowing administrators to define access control policies on that specific administrative partition.
See the F5 BIG-IP® documentation for more information about administrative partitions.
Use the --external-host-partition-path flag when
deploying the F5 router to specify a partition
path:
$ oadm router --external-host-partition-path=/OpenShift/zone1 ...
|
This section reviews how to set up F5 native integration with OpenShift Origin. The concepts of F5 appliance and OpenShift Origin connection and data flow of F5 native integration are discussed in the F5 Native Integration section of the Routes topic. |
With native integration of F5 with OpenShift Origin, you do not need to configure a ramp node for F5 to be able to reach the pods on the overlay network as created by OpenShift SDN.
The F5 controller pod needs to be launched with enough information so that it can successfully directly connect to pods.
Create a ghost hostsubnet on the OpenShift Origin cluster:
$ cat > f5-hostsubnet.yaml << EOF
{
"kind": "HostSubnet",
"apiVersion": "v1",
"metadata": {
"name": "openshift-f5-node",
"annotations": {
"pod.network.openshift.io/assign-subnet": "true",
"pod.network.openshift.io/fixed-vnid-host": "0" (1)
}
},
"host": "openshift-f5-node",
"hostIP": "10.3.89.213" (2)
} EOF
$ oc create -f f5-hostsubnet.yaml
| 1 | Make F5 global. |
| 2 | The internal IP of the F5 appliance. |
Determine the subnet allocated for the ghost hostsubnet just created:
$ oc get hostsubnets NAME HOST HOST IP SUBNET openshift-f5-node openshift-f5-node 10.3.89.213 10.131.0.0/23 openshift-master-node openshift-master-node 172.17.0.2 10.129.0.0/23 openshift-node-1 openshift-node-1 172.17.0.3 10.128.0.0/23 openshift-node-2 openshift-node-2 172.17.0.4 10.130.0.0/23
Check the SUBNET for the newly created hostsubnet. In this example,
10.131.0.0/23.
Get the entire pod network’s CIDR:
$ oc get clusternetwork
This value will be something like 10.128.0.0/14, noting the mask (14 in
this example).
To construct the gateway address, pick any IP address from the hostsubnet
(for example, 10.131.0.5). Use the mask of the pod network (14). The
gateway address becomes: 10.131.0.5/14.
Launch the F5 controller pod, following these instructions. Additionally, allow the access to 'node' cluster resource for the service account and use the two new additional options for VXLAN native integration.
$ # Add policy to allow router to access nodes using the sdn-reader role
$ oadm policy add-cluster-role-to-user system:sdn-reader system:serviceaccount:default:router
$ # Launch the router pod with vxlan-gw and F5's internal IP as extra arguments
$ #--external-host-internal-ip=10.3.89.213
$ #--external-host-vxlan-gw=10.131.0.5/14
$ oadm router \
--type=f5-router \
--external-host=10.3.89.90 \
--external-host-username=admin \
--external-host-password=mypassword \
--external-host-http-vserver=ose-vserver \
--external-host-https-vserver=https-ose-vserver \
--external-host-private-key=/path/to/key \
--credentials='/etc/openshift/master/openshift-router.kubeconfig' \
--service-account=router \
--host-network=false \
--external-host-internal-ip=10.3.89.213 \
--external-host-vxlan-gw=10.131.0.5/14
The F5 setup is now ready, without the need to set up the ramp node.