From 525fc91d5cfc22775735a02816d6cab6c7b27d97 Mon Sep 17 00:00:00 2001 From: Luca Prete Date: Thu, 23 Nov 2023 16:15:47 +0100 Subject: [PATCH] Fixes/improvements to F5 HA blueprint (#1882) Co-authored-by: Luca Prete --- .../f5-bigip/f5-bigip-ha-active/README.md | 57 ++++++++++++++++--- .../f5-bigip/f5-bigip-ha-active/variables.tf | 2 +- 2 files changed, 51 insertions(+), 8 deletions(-) diff --git a/blueprints/third-party-solutions/f5-bigip/f5-bigip-ha-active/README.md b/blueprints/third-party-solutions/f5-bigip/f5-bigip-ha-active/README.md index bfdef8a6..57fc4b6b 100644 --- a/blueprints/third-party-solutions/f5-bigip/f5-bigip-ha-active/README.md +++ b/blueprints/third-party-solutions/f5-bigip/f5-bigip-ha-active/README.md @@ -1,20 +1,54 @@ # F5 BigIP-VE HA active-active blueprint -This blueprint allows to create external active/active private and/or public F5 BigIP-VE load balancers. +This blueprint allows to create active/active private and/or public F5 BigIP-VE load balancers. ## Design notes - The blueprint supports by default two VPCs: a `dataplane` network and a `management` network. - We don't use the `F5 Cloud Failover Extension (CFE)`. This would imply an active/passive architecture, it would limit the number of instances to two, it would use static routes and it would require F5 VMs service accounts to have roles set, so they can configure routes. -- We deploy instead as many active instances users need and we make them reachable through passthrough GCP load balancers. -- The blueprint allows to expose the F5 instances both externally and internally, using internal and external passthrough load balancers. You can also choose to expose the same F5 instances both externally and internally at the same time. +- Instead, users can deploy as many active instances they need and we make them reachable through passthrough GCP load balancers. +- The blueprint allows to expose the F5 instances both externally and internally, using internal and external network passthrough load balancers. You can also choose to expose the same F5 instances both externally and internally at the same time. - The blueprint supports dual-stack (IPv4/IPv6). -- We deliberately use the original F5-BigIP `startup-script.tpl` file. We haven't changed it and we pass to it the same variables, so it should be easier to swap it with custom scripts. +- We deliberately use the original F5-BigIP `startup-script.tpl` file. We haven't changed it and we pass to it the same variables, so it should be easier to swap it with custom scripts (copyright reported in the template file and down in this readme). + +## Access the F5 machines through IAP tunnels + +F5 management IPs are private. If you haven't setup any hybrid connectivity (i.e. VPN/Interconnect) you can still access the VMs with SSH and their GUI leveraging IAP tunnels. + +For example, you can first establish a tunnel: + +```shell +gcloud compute ssh YOUR_F5_VM_NAME \ + --project YOUR_PROJECT \ + --zone europe-west8-a -- \ + -L 4431:127.0.0.1:8443 \ + -L 221:127.0.0.1:22 \ + -N -q -f +``` + +And then connect to: + +- SSH: `127.0.0.1`, port `221` +- GUI: `127.0.0.1`, port `4431` + +The default username is `admin` and the password is `MyFabricSecret123!` + +## F5 configuration + +You won't be able to pass traffic through the F5 load balancers until you perform some further configurations. We hope to automate these configuration steps soon. **Contributions are welcome!** + +- Disable traffic-group and -optionally- configure config-sync. +- Configure the secondary IP range IPs assigned to each machine as a self-ip on each F5. These need to be self IPs as opposed to NAT pools, so they will be different for each instance, even if config sync is active. +- Enable `automap` so that traffic is source natted using the self IPs configured, before going to the backends. +- Create as many `virtual servers`/`irules` as you need, so you can match incoming traffic and redirect it to the backends. +- By default, Google load balancers' health checks will query the F5 VMs on port `65535` from a set of [well-known IPs](https://cloud.google.com/load-balancing/docs/health-check-concepts#ip-ranges). We recommend creating a dedicated virtual server that answers on port `65535`. You can redirect the connection to the loopback interface. ## Examples - [Design notes](#design-notes) +- [Access the F5 machines through IAP tunnels](#access-the-f5-machines-through-iap-tunnels) +- [F5 configuration](#f5-configuration) - [Examples](#examples) - [Single instance](#single-instance) - [Active/active instances](#activeactive-instances) @@ -22,13 +56,14 @@ This blueprint allows to create external active/active private and/or public F5 - [Public load F5 load balancers](#public-load-f5-load-balancers) - [Multiple forwarding rules and dual-stack (IPv4/IPv6)](#multiple-forwarding-rules-and-dual-stack-ipv4ipv6) - [Use the GCP secret manager](#use-the-gcp-secret-manager) +- [F5 code copyright](#f5-code-copyright) - [Variables](#variables) - [Outputs](#outputs) ### Single instance -By default, the blueprint deploys one or more instances in a region. These instances are behind an internal network passthrough (L3_DEFAULT) load balancer. +By default, the blueprint deploys one or more instances in a region. These instances are behind an internal network passthrough (`L3_DEFAULT`) load balancer. ```hcl module "f5-lb" { @@ -275,7 +310,7 @@ module "f5-lb" { instance_shared_config = { secret = { is_gcp = true - value = "f5_secret_name" # needs to be defined in the same project + value = "MyNewFabricSecret123!" # needs to be defined in the same project } } @@ -302,6 +337,14 @@ module "f5-lb" { } # tftest modules=6 resources=8 inventory=secret-manager.yaml ``` + +## F5 code copyright + +This repository usees code from the third-party project [terraform-gcp-bigip-module](https://github.com/F5Networks/terraform-gcp-bigip-module). + +This code is also licensed as Apache 2.0. + +This is the original copyright notice from the third-party repository: `Copyright 2014-2019 F5 Networks Inc.` ## Variables @@ -314,7 +357,7 @@ module "f5-lb" { | [vpc_config](variables.tf#L93) | The dataplane and mgmt network and subnetwork self links. | object({…}) | ✓ | | | [forwarding_rules_config](variables.tf#L17) | The optional configurations of the GCP load balancers forwarding rules. | map(object({…})) | | {…} | | [health_check_config](variables.tf#L32) | The optional health check configuration. The variable types are enforced by the underlying module. | map(any) | | {…} | -| [instance_shared_config](variables.tf#L56) | The F5 VMs shared configurations. | object({…}) | | {} | +| [instance_shared_config](variables.tf#L56) | The F5 VMs shared configurations. | object({…}) | | {} | ## Outputs diff --git a/blueprints/third-party-solutions/f5-bigip/f5-bigip-ha-active/variables.tf b/blueprints/third-party-solutions/f5-bigip/f5-bigip-ha-active/variables.tf index 2bab3812..79396f46 100644 --- a/blueprints/third-party-solutions/f5-bigip/f5-bigip-ha-active/variables.tf +++ b/blueprints/third-party-solutions/f5-bigip/f5-bigip-ha-active/variables.tf @@ -65,7 +65,7 @@ variable "instance_shared_config" { instance_type = optional(string, "n2-standard-4") secret = optional(object({ is_gcp = optional(bool, false) - value = optional(string, "mysecret") + value = optional(string, "MyFabricSecret123!") }), {}) service_account = optional(string) ssh_public_key = optional(string, "my_key.pub")