Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 51 additions & 28 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# F5 IPAM Controller

The F5 IPAM Controller is a Docker container that runs in an orchestration environment and interfaces with an IPAM system.
The F5 IPAM Controller is a docker container that runs in an orchestration environment and interfaces with an IPAM system.
It allocates IP addresses from an IPAM system’s address pool for hostnames in an orchestration environment.
The F5 IPAM Controller watches orchestration-specific resources and consumes the hostnames within each resource.

# In this IPAM

The F5 IPAM Controller can allocate IP address from static IP address pool based on the CIDR mentioned in a Kubernetes resource The idea here is that we will support CRD, Type LB and probably also in the future route/ingress. We should make it more generic so that we don't have to update this later, F5 IPAM Controller decides to allocate the IP from the respective IP address pool for the hostname specified in the virtualserver custom resource.
The F5 IPAM Controller can allocate IP address from static IP address pool based on the ipamLabel mentioned in a kubernetes resource. The idea here is that we supports CRD, Type LB and probably also in the future route/ingress. We should make it more generic so that we don't have to update this later, F5 IPAM Controller decides to allocate the IP from the respective IP address pool for the hostname specified in the virtualserver custom resource.

Supported kubernetes resource :
| RESOURCES | MINIMUM VERSION SUPPORTED |
Expand All @@ -32,13 +32,14 @@ The F5 IPAM Controller acts as an interface to CIS to provide an IP address from
| PARAMETER | TYPE | REQUIRED | DESCRIPTION |
| ------ | ------ | ------ | ------ |
| orchestration | String | Required | The orchestration parameter holds the orchestration environment i.e. Kubernetes. |
| ip-range | String | Required | ip-range parameter holds the IP address ranges and from this range, it creates a pool of IP address range which gets allocated to the corresponding hostname in the virtual server CRD |
| ip-range | String | Required | ip-range parameter holds the IP address ranges with label and from this range, it creates a pool of IP address range which gets allocated to the corresponding hostname in the virtual server CRD |
| log-level | String | Optional | Log level parameter specify various logging level such as DEBUG, INFO, WARNING, ERROR, CRITICAL. |

Note: On how to configure these Configuration Options, please refer to IPAM Deployment YAML example in below.

### Installation
### IPAM Installation
#### RBAC - ServiceAccount, ClusterRole and ClusterRoleBindings for F5 IPAM Controller
Create a file named called `f5-ipam-rbac.yaml` with following configurations.

```
kind: ClusterRole
Expand Down Expand Up @@ -73,7 +74,7 @@ metadata:
```

#### Example: F5 IPAM Controller Deployment YAML

Create a file named called `f5-ipam-deployment.yaml` with following configurations.
```
apiVersion: apps/v1
kind: Deployment
Expand All @@ -95,7 +96,7 @@ spec:
containers:
- args:
- --orchestration=kubernetes
- --ip-range="10.192.75.111/24-10.192.75.115/24"
- --ip-range=`{"Dev":"10.192.75.111-10.192.75.115","Test":"172.168.3.30-172.168.3.50"}`
- --log-level=DEBUG
command:
- /app/bin/f5-ipam-controller
Expand All @@ -118,7 +119,7 @@ kubectl create -f f5-ipam-deployment.yaml

### Configuring CIS to work with F5 IPAM Controller

To configure CIS to work with the F5 IPAM controller, the user needs to give a parameter ```--ipam=true``` in the CIS deployment and also provide a parameter ```cidr``` in the virtual server CRD.
To configure CIS to work with the F5 IPAM controller, the user needs to give a parameter ```--ipam=true``` in the CIS deployment and also provide a parameter ```ipamLabel``` in the virtual server, transport server CRD.

#### Examples

Expand All @@ -133,13 +134,37 @@ metadata:
f5cr: "true"
spec:
host: coffee.example.com
cidr: "10.192.75.111/24"
ipamLabel: "Dev"
pools:
- path: /coffee
service: svc-2
servicePort: 80
```

**Transport Server CRD**

```
apiVersion: "cis.f5.com/v1"
kind: TransportServer
metadata:
labels:
f5cr: "true"
name: tcp-transport-server
namespace: default
spec:
ipamLabel: "Dev"
virtualServerPort: 8544
mode: standard
snat: auto
pool:
service: svc-1
servicePort: 8181
monitor:
type: tcp
interval: 10
timeout: 10
```

**CIS Deployment with ipam enabled**

```
Expand Down Expand Up @@ -177,18 +202,18 @@ spec:


#### NOTE:
- If the user provides the parameter ```--ipam=true``` in the CIS deployment then it is mandatory to provide the CIDR parameter in VS CRD to leverage the the IPAM Controller.
- If a VirtualServer Address is specified in the resource, CIS don't leverage the IPAM Controller even if a CIDR parameter is specified
- If No VirtualServer Address is specified in the resource and a CIDR parameter is specified, CIS leverage the IPAM Controller for VS address.
- If the user provides the parameter ```--ipam=true``` in the CIS deployment then it is mandatory to provide the ipamLabel parameter in VS CRD and TS CRD to leverage the the IPAM Controller.
- If a VirtualServer Address is specified in the resource, CIS don't leverage the IPAM Controller even if a ipamLabel parameter is specified
- If No VirtualServer Address is specified in the resource and a ipamLabel parameter is specified, CIS leverage the IPAM Controller for VS address.

### Updating the Status in Virtual Server CRD
### F5 IPAM controller updates the status in IPAM CR


The main aim of IPAM is to provide an IP address corresponding to each hostname provided in the VS CRD.
The main aim of IPAM controller is to provide an IP address corresponding to each hostname provided in the VS CRD and key in TS CRD.

The user needs to mandatorily provide the host and CIDR in the hostSpecs section of F5-CR. The F5 IPAM Controller, in turn, reads the hostSpecs of CR, processes it, and updates the IPStatus with each host provided in the hostSpecs with host, IP(which is generated from the range of IP address by FIC), and corresponding CIDR.
The user needs to mandatorily provide the host and ipamLabel in the hostSpecs section of F5-CR. The F5 IPAM Controller, in turn, reads the hostSpecs of CR, processes it, and updates the IPStatus with each host provided in the hostSpecs with host, IP(which is generated from the range of IP address by FIC), and corresponding ipamLabel.

- F5-ipam-controller (FIC) acts as a communication channel for updating the host, IP, and CIDR in VS CRD.
- F5-ipam-controller (FIC) acts as a communication channel for updating the host, IP and ipamLabel for VS and TS CRD.

Below is the example:

Expand All @@ -203,29 +228,27 @@ metadata:
spec:
hostSpecs:
- host: cafe.example.com
cidr: 10.192.75.111/24
ipamLabel: Dev
- host: tea.example.com
cidr: 10.192.75.111/24
ipamLabel: Test
- key: default/tcp-transport-server_ts
ipamLabel: Dev
status:
IPStatus:
- host: cafe.example.com
ip: 10.192.75.112
cidr: 10.192.75.111/24
ipamLabel: Dev
- host: tea.example.com
ip: 10.192.75.114
cidr: 10.192.75.111/24
ip: 172.168.2.30
ipamLabel: Test
- key: default/tcp-transport-server_ts
ip: 10.192.75.113
ipamLabel: Dev
```

### Limitations

1. Single IPAM Controller does not work with multiple CIS deployment.
2. Sometime IPAM missed to allocate an IP for a domain when CIS is restarted.
3. Sometime IPAM fails to allocate new IP address when CIDR is updated.

For 2 and 3:
Mitigation: In this case the user can delete the F5-IPAM custom resource from kube-system named `"ipam.<Partition_Name>"` and restart both the controller.

`kubectl delete f5ipam ipam.<Partition_Name> -n kube-system`
- Single IPAM Controller does not work with multiple CIS deployment.


### Known Issue
Expand Down
Binary file modified image/img-2.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.