Fixes/improvements to F5 HA blueprint (#1882)
Co-authored-by: Luca Prete <lucaprete@google.com>
This commit is contained in:
Luca Prete
GitHub
parent
a223aa6f77
commit
525fc91d5c
|
|
@ -1,20 +1,54 @@
|
|||
# F5 BigIP-VE HA active-active blueprint
|
||||
|
||||
This blueprint allows to create external active/active private and/or public F5 BigIP-VE load balancers.
|
||||
This blueprint allows to create active/active private and/or public F5 BigIP-VE load balancers.
|
||||
|
||||
## Design notes
|
||||
|
||||
- The blueprint supports by default two VPCs: a `dataplane` network and a `management` network.
|
||||
- We don't use the `F5 Cloud Failover Extension (CFE)`. This would imply an active/passive architecture, it would limit the number of instances to two, it would use static routes and it would require F5 VMs service accounts to have roles set, so they can configure routes.
|
||||
- We deploy instead as many active instances users need and we make them reachable through passthrough GCP load balancers.
|
||||
- The blueprint allows to expose the F5 instances both externally and internally, using internal and external passthrough load balancers. You can also choose to expose the same F5 instances both externally and internally at the same time.
|
||||
- Instead, users can deploy as many active instances they need and we make them reachable through passthrough GCP load balancers.
|
||||
- The blueprint allows to expose the F5 instances both externally and internally, using internal and external network passthrough load balancers. You can also choose to expose the same F5 instances both externally and internally at the same time.
|
||||
- The blueprint supports dual-stack (IPv4/IPv6).
|
||||
- We deliberately use the original F5-BigIP `startup-script.tpl` file. We haven't changed it and we pass to it the same variables, so it should be easier to swap it with custom scripts.
|
||||
- We deliberately use the original F5-BigIP `startup-script.tpl` file. We haven't changed it and we pass to it the same variables, so it should be easier to swap it with custom scripts (copyright reported in the template file and down in this readme).
|
||||
|
||||
## Access the F5 machines through IAP tunnels
|
||||
|
||||
F5 management IPs are private. If you haven't setup any hybrid connectivity (i.e. VPN/Interconnect) you can still access the VMs with SSH and their GUI leveraging IAP tunnels.
|
||||
|
||||
For example, you can first establish a tunnel:
|
||||
|
||||
```shell
|
||||
gcloud compute ssh YOUR_F5_VM_NAME \
|
||||
--project YOUR_PROJECT \
|
||||
--zone europe-west8-a -- \
|
||||
-L 4431:127.0.0.1:8443 \
|
||||
-L 221:127.0.0.1:22 \
|
||||
-N -q -f
|
||||
```
|
||||
|
||||
And then connect to:
|
||||
|
||||
- SSH: `127.0.0.1`, port `221`
|
||||
- GUI: `127.0.0.1`, port `4431`
|
||||
|
||||
The default username is `admin` and the password is `MyFabricSecret123!`
|
||||
|
||||
## F5 configuration
|
||||
|
||||
You won't be able to pass traffic through the F5 load balancers until you perform some further configurations. We hope to automate these configuration steps soon. **Contributions are welcome!**
|
||||
|
||||
- Disable traffic-group and -optionally- configure config-sync.
|
||||
- Configure the secondary IP range IPs assigned to each machine as a self-ip on each F5. These need to be self IPs as opposed to NAT pools, so they will be different for each instance, even if config sync is active.
|
||||
- Enable `automap` so that traffic is source natted using the self IPs configured, before going to the backends.
|
||||
- Create as many `virtual servers`/`irules` as you need, so you can match incoming traffic and redirect it to the backends.
|
||||
- By default, Google load balancers' health checks will query the F5 VMs on port `65535` from a set of [well-known IPs](https://cloud.google.com/load-balancing/docs/health-check-concepts#ip-ranges). We recommend creating a dedicated virtual server that answers on port `65535`. You can redirect the connection to the loopback interface.
|
||||
|
||||
## Examples
|
||||
|
||||
<!-- BEGIN TOC -->
|
||||
- [Design notes](#design-notes)
|
||||
- [Access the F5 machines through IAP tunnels](#access-the-f5-machines-through-iap-tunnels)
|
||||
- [F5 configuration](#f5-configuration)
|
||||
- [Examples](#examples)
|
||||
- [Single instance](#single-instance)
|
||||
- [Active/active instances](#activeactive-instances)
|
||||
|
|
@ -22,13 +56,14 @@ This blueprint allows to create external active/active private and/or public F5
|
|||
- [Public load F5 load balancers](#public-load-f5-load-balancers)
|
||||
- [Multiple forwarding rules and dual-stack (IPv4/IPv6)](#multiple-forwarding-rules-and-dual-stack-ipv4ipv6)
|
||||
- [Use the GCP secret manager](#use-the-gcp-secret-manager)
|
||||
- [F5 code copyright](#f5-code-copyright)
|
||||
- [Variables](#variables)
|
||||
- [Outputs](#outputs)
|
||||
<!-- END TOC -->
|
||||
|
||||
### Single instance
|
||||
|
||||
By default, the blueprint deploys one or more instances in a region. These instances are behind an internal network passthrough (L3_DEFAULT) load balancer.
|
||||
By default, the blueprint deploys one or more instances in a region. These instances are behind an internal network passthrough (`L3_DEFAULT`) load balancer.
|
||||
|
||||
```hcl
|
||||
module "f5-lb" {
|
||||
|
|
@ -275,7 +310,7 @@ module "f5-lb" {
|
|||
instance_shared_config = {
|
||||
secret = {
|
||||
is_gcp = true
|
||||
value = "f5_secret_name" # needs to be defined in the same project
|
||||
value = "MyNewFabricSecret123!" # needs to be defined in the same project
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -302,6 +337,14 @@ module "f5-lb" {
|
|||
}
|
||||
# tftest modules=6 resources=8 inventory=secret-manager.yaml
|
||||
```
|
||||
|
||||
## F5 code copyright
|
||||
|
||||
This repository usees code from the third-party project [terraform-gcp-bigip-module](https://github.com/F5Networks/terraform-gcp-bigip-module).
|
||||
|
||||
This code is also licensed as Apache 2.0.
|
||||
|
||||
This is the original copyright notice from the third-party repository: `Copyright 2014-2019 F5 Networks Inc.`
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
|
|
@ -314,7 +357,7 @@ module "f5-lb" {
|
|||
| [vpc_config](variables.tf#L93) | The dataplane and mgmt network and subnetwork self links. | <code title="object({ dataplane = object({ network = string subnetwork = string }) management = object({ network = string subnetwork = string }) })">object({…})</code> | ✓ | |
|
||||
| [forwarding_rules_config](variables.tf#L17) | The optional configurations of the GCP load balancers forwarding rules. | <code title="map(object({ address = optional(string) external = optional(bool, false) global_access = optional(bool, true) ip_version = optional(string, "IPV4") protocol = optional(string, "L3_DEFAULT") subnetwork = optional(string) # used for IPv6 NLBs }))">map(object({…}))</code> | | <code title="{ l4 = {} }">{…}</code> |
|
||||
| [health_check_config](variables.tf#L32) | The optional health check configuration. The variable types are enforced by the underlying module. | <code>map(any)</code> | | <code title="{ tcp = { port = 65535 port_specification = "USE_FIXED_PORT" } }">{…}</code> |
|
||||
| [instance_shared_config](variables.tf#L56) | The F5 VMs shared configurations. | <code title="object({ boot_disk = optional(object({ image = optional(string, "projects/f5-7626-networks-public/global/images/f5-bigip-15-1-2-1-0-0-10-byol-ltm-2boot-loc-210115160742") size = optional(number, 100) type = optional(string, "pd-ssd") }), {}) enable_ipv6 = optional(bool, false) # needs to be true to receive traffic from IPv6 forwarding rules instance_type = optional(string, "n2-standard-4") secret = optional(object({ is_gcp = optional(bool, false) value = optional(string, "mysecret") }), {}) service_account = optional(string) ssh_public_key = optional(string, "my_key.pub") tags = optional(list(string), []) username = optional(string, "admin") })">object({…})</code> | | <code>{}</code> |
|
||||
| [instance_shared_config](variables.tf#L56) | The F5 VMs shared configurations. | <code title="object({ boot_disk = optional(object({ image = optional(string, "projects/f5-7626-networks-public/global/images/f5-bigip-15-1-2-1-0-0-10-byol-ltm-2boot-loc-210115160742") size = optional(number, 100) type = optional(string, "pd-ssd") }), {}) enable_ipv6 = optional(bool, false) # needs to be true to receive traffic from IPv6 forwarding rules instance_type = optional(string, "n2-standard-4") secret = optional(object({ is_gcp = optional(bool, false) value = optional(string, "MyFabricSecret123!") }), {}) service_account = optional(string) ssh_public_key = optional(string, "my_key.pub") tags = optional(list(string), []) username = optional(string, "admin") })">object({…})</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
|
|||
|
|
@ -65,7 +65,7 @@ variable "instance_shared_config" {
|
|||
instance_type = optional(string, "n2-standard-4")
|
||||
secret = optional(object({
|
||||
is_gcp = optional(bool, false)
|
||||
value = optional(string, "mysecret")
|
||||
value = optional(string, "MyFabricSecret123!")
|
||||
}), {})
|
||||
service_account = optional(string)
|
||||
ssh_public_key = optional(string, "my_key.pub")
|
||||
|
|
|
|||
Loading…
Reference in New Issue