The requirement to support Cilium CNI is to create fake FDB for k8s node in BIG-IP, CIS has similar code like below:
https://github.com/F5Networks/k8s-bigip-ctlr/blob/master/pkg/vxlan/vxlanMgr.go#L123-L130
rec := fdbRecord{}
for _, addr := range nodeAddrs {
if addr.Type == addrType {
rec.Endpoint = addr.Address
// Initially set the name to a fake MAC (for OpenShift use)
// For flannel, this will be overwritten with the real MAC
rec.Name = ipv4ToMac(addr.Address)
}
}
https://github.com/F5Networks/k8s-bigip-ctlr/blob/master/pkg/vxlan/vxlanMgr.go#L178-L189
func ipv4ToMac(addr string) string {
ip := strings.Split(addr, ".")
if len(ip) != 4 {
log.Errorf("[VxLAN] Bad IPv4 address format specified for FDB record: %s", addr)
return ""
}
var intIP [4]int
for i, val := range ip {
intIP[i], _ = strconv.Atoi(val)
}
return fmt.Sprintf("0a:0a:%02x:%02x:%02x:%02x", intIP[0], intIP[1], intIP[2], intIP[3])
}
see the fake fmt.Sprintf("0a:0a:%02x:%02x:%02x:%02x", intIP[0], intIP[1], intIP[2], intIP[3])
so from what I understand, probably https://github.com/f5devcentral/bigip-kubernetes-gateway/blob/master/internal/k8s/k8s.go#L40-L52 section could add cilium annotation check for Cilium k8s node to generate the fake k8s node FDB based on the node ip, and somehow your network rest golang code could send the fake fdb to BIG-IP.
your rest would also be able to create vxlan tunnel profile and tunnel, see the tmsh tunnel command here https://github.com/f5devcentral/f5-ci-docs/blob/master/docs/cilium/cilium-bigip-info.rst
#. Create a VXLAN tunnel profile. The tunnel profile name is fl-vxlan
tmsh create net tunnels vxlan fl-vxlan port 8472 flooding-type multipoint
#. Create a VXLAN tunnel, the tunnel name is ``flannel_vxlan``, in CIS use ``--openshift-sdn-name`` argument
tmsh create net tunnels tunnel flannel_vxlan key 2 profile fl-vxlan local-address 10.169.72.34
#. Create VXLAN tunnel self IP, allow default service, allow none stops self ip ping from working
tmsh create net self 10.1.6.34 address 10.1.6.34/255.255.255.0 allow-service default vlan flannel_vxlan
#. Create a static route to Cilium managed pod CIDR network ``10.0.0.0/16`` through tunnel interface ``flannel_vxlan``
#. DO NOT CREATE STATIC ROUTE THROUGH TUNNEL INTERFACE TO K8S NODE NETWORK/IP
tmsh create net route 10.0.0.0 network 10.0.0.0/16 interface flannel_vxlan
I noticed tmsh could only use modify to add FDB for tunnel, for example
tmsh modify net fdb tunnel flannel_vxlan records add { 0a:0a:0a:a9:48:ea { endpoint 10.169.72.234%0 } }
, maybe the rest could simulate tmsh behavior
I am happy to answer any questions for this request :-)