k8s big-ip control 安装使用

0. 准备工作

网络打通，这里没有使用fannel，没有使用vxlan 。

在f5界面创建f5分区。这里是cce-test。

1. 安装bigip control

kubectl create serviceaccount bigip-ctlr -n kube-system

kubectl get sa -n kube-system

创建ClusterRole ，ClusterRole

f5-k8s-sample-rbac.yaml

# for use in k8s clusters only

# for OpenShift, use the OpenShift-specific examples

kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: bigip-ctlr-clusterrole

rules:

- apiGroups: ["", "extensions"]

  resources: ["nodes", "services", "endpoints", "namespaces", "ingresses", "pods"]

  verbs: ["get", "list", "watch"]

- apiGroups: ["", "extensions"]

  resources: ["configmaps", "events", "ingresses/status"]

  verbs: ["get", "list", "watch", "update", "create", "patch"]

- apiGroups: ["", "extensions"]

  resources: ["secrets"]

  resourceNames: ["<secret-containing-bigip-login>"]

  verbs: ["get", "list", "watch"]

---

kind: ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: bigip-ctlr-clusterrole-binding

  namespace: kube-system

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: bigip-ctlr-clusterrole

subjects:

- apiGroup: ""

  kind: ServiceAccount

  name: bigip-ctlr

  namespace: kube-system

kubectl get clusterroles.rbac.authorization.k8s.io -n kube-system

NAME                                                                   AGE

admin                                                                  2d12h

aggregate-network-attachment-definitions-admin                         2d12h

aggregate-network-attachment-definitions-edit                          2d12h

aggregate-network-attachment-definitions-view                          2d12h

bigip-ctlr-clusterrole                                                 46h

cluster-admin                                                          2d12h

copaddon-nginx-ingress                                                 2d12h

coredns                                                                2d12h

edit                                                                   2d12h

kubectl get clusterrolebindings.rbac.authorization.k8s.io -n kube-system

NAME                                                   AGE

auto-approve-csrs-for-group                            2d12h

auto-approve-renewals-for-nodes                        2d12h

auto-approve-renewals-for-nodes-server                 2d12h

bigip-ctlr-clusterrole-binding                         46h

f5-k8s-bigip-ctlr_basic.yaml

kubectl create secret generic bigip-login --namespace kube-system --from-literal=username=admin --from-literal=password=admin

kubectl describe secret bigip-login -n kube-system

kubectl apply -f f5-k8s-bigip-ctlr_basic.yaml

apiVersion: extensions/v1beta1

kind: Deployment

metadata:

  name: k8s-bigip-ctlr-deployment

  namespace: kube-system

spec:

  # DO NOT INCREASE REPLICA COUNT

  replicas: 1

  template:

    metadata:

      name: k8s-bigip-ctlr

      labels:

        app: k8s-bigip-ctlr

    spec:

      # Name of the Service Account bound to a Cluster Role with the required

      # permissions

      serviceAccountName: bigip-ctlr

      containers:

        - name: k8s-bigip-ctlr

          image: "f5networks/k8s-bigip-ctlr"

          imagePullPolicy: IfNotPresent

          env:

            - name: BIGIP_USERNAME

              valueFrom:

                secretKeyRef:

                  # Replace with the name of the Secret containing your login

                  # credentials

                  name: bigip-login

                  key: username

            - name: BIGIP_PASSWORD

              valueFrom:

                secretKeyRef:

                  # Replace with the name of the Secret containing your login

                  # credentials

                  name: bigip-login

                  key: password

          command: ["/app/bin/k8s-bigip-ctlr"]

          args: [

            # See the k8s-bigip-ctlr documentation for information about

            # all config options

            # https://clouddocs.f5.com/products/connectors/k8s-bigip-ctlr/latest

            "--bigip-username=$(BIGIP_USERNAME)",

            "--bigip-password=$(BIGIP_PASSWORD)",

            "--bigip-url=xxxxxxxxx",

            "--bigip-partition=cce-test",

            "--pool-member-type=cluster"

            ]

     # imagePullSecrets:

     #   # Secret that gives access to a private docker registry

     #   - name: f5-docker-images

     #   # Secret containing the BIG-IP system login credentials

     #   - name: bigip-login

指定bigip-url

bigip-partition

pool-member-type

看下deployment日志有没有报错:

kubectl logs k8s-bigip-ctlr-deployment-bcf87fdb8-ztj9f -n kube-system

2. 创建应用和对应f5 vs的configmap

创建应用，这里以nginx为例:

kubectl create deployment --image=nginx nginx1

kubectl expose deployment nginx1 --port=80

创建f5vs的configmap

f5-resource-vs-example.configmap.yaml

kind: ConfigMap

apiVersion: v1

metadata:

  name: nginx1.vs

  labels:

    f5type: virtual-server

data:

  # See the f5-schema table for schema-controller compatibility

  # https://clouddocs.f5.com/containers/latest/releases_and_versioning.html#f5-schema

  schema: "f5schemadb://bigip-virtual-server_v0.1.7.json"

  data: |

    {

      "virtualServer": {

        "backend": {

          "servicePort": 80,

          "serviceName": "nginx1",

          "healthMonitors": [{

            "interval": 30,

            "protocol": "http",

            "send": "GET / HTTP/1.1\r\nHost:abc.com\r\n\r\n",

            "recv": "200|OK",

            "timeout": 120

          }]

        },

        "frontend": {

          "virtualAddress": {

            "port": 80,

            "bindAddr": "xxxxxxxxxx"

          },

          "partition": "cce-test",

          "balance": "least-connections-member",

          "mode": "http"

        }

      }

    }

填写backend, frontend。

官网有比较详细的解释，参数可以添加很多。https://clouddocs.f5.com/products/connectors/k8s-bigip-ctlr/v1.10/

F5