Using the F5 Router Plug-in

You are viewing documentation for a release that is no longer supported. The latest supported version of version 3 is [3.11]. For the most recent version 4, see

The F5 router plug-in is provided as a container image and run as a pod, just like the default HAProxy router.

When deploying the F5 router plug-in, ensure you meet the following requirements:

• A F5 host IP with:

  • Credentials for API access

  • SSH access via a private key

• An F5 user with Advanced Shell access

• A virtual server for HTTP routes:

  • HTTP profile must be http.

• A virtual server with HTTP profile routes:

  • HTTP profile must be http

  • SSL Profile (client) must be clientssl

  • SSL Profile (server) must be serverssl

• For edge integration (not recommended):

  • A working ramp node

  • A working tunnel to the ramp node

• For native integration:

  • A host-internal IP capable of communicating with all nodes on the port 4789/UDP

  • The sdn-services add-on license installed on the F5 host.

• Ensure you have .

The F5 router plug-in for OKD supports only the following F5 BIG-IP versions:

• 11.x

• 12.x

The F5 BIG-IP Controller for OpenShift supports the OKD versions found in the F5 BIG-IP Controller for OpenShift releases and versioningpage in the F5 documentation.

As a prerequisite to working with the F5 router plug-in, two virtual servers (one virtual server each for HTTP and HTTPS profiles, respectively) need to be set up in the F5 BIG-IP appliance.

To set up a virtual server in the F5 BIG-IP appliance, follow the .

While creating the virtual server, ensure the following settings are in place:

• For the HTTP server, set the ServicePort to 'http'/80.

• For the HTTPS server, set the ServicePort to 'https'/443.

• In the basic configuration, set the HTTP profile to /Common/http for both of the virtual servers.

• For the HTTPS server, create a default client-ssl profile and select it for the SSL Profile (Client).

  • To create the default client SSL profile, follow the instructions from F5, especially the Configuring the fallback (default) client SSL profile section, which discusses that the certificate/key pair is the default that will be served in the case that custom certificates are not provided for a route or server name.

Deploy the F5 router plug-in with the oc adm router command, but provide additional flags (or environment variables) specifying the following parameters for the F5 BIG-IP host:

For example:

$ oc adm router \
    --type=f5-router \
    --external-host=10.0.0.2 \
    --external-host-username=admin \
    --external-host-password=mypassword \
    --external-host-http-vserver=ose-vserver \
    --external-host-https-vserver=https-ose-vserver \
    --external-host-private-key=/path/to/key \
    --host-network=false \

As with the HAProxy router, the oc adm router command creates the service and deployment configuration objects, and thus the replication controllers and pod(s) in which the F5 router plug-in itself runs. The replication controller restarts the F5 router plug-in in case of crashes. Because the F5 router plug-in is watching routes, endpoints, and nodes and configuring F5 BIG-IP accordingly, running the F5 router in this way, along with an appropriately configured F5 BIG-IP deployment, satisfies high-availability requirements.

Partition paths allow you to store your OKD routing configuration in a custom F5 BIG-IP administrative partition, instead of the default /Common partition. You can use custom administrative partitions to secure F5 BIG-IP environments. This means that an OKD-specific configuration stored in F5 BIG-IP system objects reside within a logical container, allowing administrators to define access control policies on that specific administrative partition.

See the F5 BIG-IP documentation for more information about administrative partitions.

To configure your OKD for partition paths:

1. Optionally, perform some cleaning steps:

   1. Ensure F5 is configured to be able to switch to the /Common and /Custom paths.

   2. Delete the static FDB of vxlan5000. See the for more information.

2. Configure a virtual server for the custom partition.

3. To specify a partition path, deploy the F5 router plug-in using the --external-host-partition-path flag:

With F5 router plug-in for OKD, you do not need to configure a ramp node for F5 to be able to reach the pods on the overlay network as created by OpenShift SDN.

The F5 router plug-in pod needs to be launched with enough information so that it can successfully directly connect to pods.

1. Create a ghost hostsubnet on the OKD cluster:

   $ cat > f5-hostsubnet.yaml << EOF
   {
       "kind": "HostSubnet",
       "apiVersion": "v1",
       "metadata": {
           "annotations": {
           "pod.network.openshift.io/assign-subnet": "true",
       "pod.network.openshift.io/fixed-vnid-host": "0"  (1)
           }
       },
       "host": "openshift-f5-node",
       "hostIP": "10.3.89.213"  (2)
   } EOF
   $ oc create -f f5-hostsubnet.yaml

   1	Make F5 global.
   2	The internal IP of the F5 appliance.

2. Determine the subnet allocated for the ghost hostsubnet just created:

3. Check the SUBNET for the newly created hostsubnet. In this example, 10.131.0.0/23.

4. Get the entire pod network’s CIDR:

   $ oc get clusternetwork

   This value will be something like 10.128.0.0/14, noting the mask (14 in this example).

5. Launch the F5 router plug-in pod, following these instructions. Additionally, allow the access to ‘node’ cluster resource for the service account and use the two new additional options for VXLAN native integration.