bigip-kubernetes-gateway's Introduction

bigip-kubernetes-gateway

Integrating BIG-IP Next as implementation provider for SIGNetworks gateway.

See https://gateway-api.f5se.io for more information.

For a list of supported Gateway API resources and features, see the Gateway API Compatibility doc.

Support

For support, please open a GitHub issue. Note, the code in this repository is community supported and is not supported by F5. For a complete list of supported projects please reference SUPPORT.md.

Community Code of Conduct

Please refer to the F5 DevCentral Community Code of Conduct.

bigip-kubernetes-gateway's People

Contributors

Stargazers

Watchers

bigip-kubernetes-gateway's Issues

RFE: Cilium CNI support

The requirement to support Cilium CNI is to create fake FDB for k8s node in BIG-IP, CIS has similar code like below:
https://github.com/F5Networks/k8s-bigip-ctlr/blob/master/pkg/vxlan/vxlanMgr.go#L123-L130

		rec := fdbRecord{}
		for _, addr := range nodeAddrs {
			if addr.Type == addrType {
				rec.Endpoint = addr.Address
				// Initially set the name to a fake MAC (for OpenShift use)
				// For flannel, this will be overwritten with the real MAC
				rec.Name = ipv4ToMac(addr.Address)
			}
		}

https://github.com/F5Networks/k8s-bigip-ctlr/blob/master/pkg/vxlan/vxlanMgr.go#L178-L189

func ipv4ToMac(addr string) string {
	ip := strings.Split(addr, ".")
	if len(ip) != 4 {
		log.Errorf("[VxLAN] Bad IPv4 address format specified for FDB record: %s", addr)
		return ""
	}
	var intIP [4]int
	for i, val := range ip {
		intIP[i], _ = strconv.Atoi(val)
	}
	return fmt.Sprintf("0a:0a:%02x:%02x:%02x:%02x", intIP[0], intIP[1], intIP[2], intIP[3])
}

see the fake fmt.Sprintf("0a:0a:%02x:%02x:%02x:%02x", intIP[0], intIP[1], intIP[2], intIP[3])

so from what I understand, probably https://github.com/f5devcentral/bigip-kubernetes-gateway/blob/master/internal/k8s/k8s.go#L40-L52 section could add cilium annotation check for Cilium k8s node to generate the fake k8s node FDB based on the node ip, and somehow your network rest golang code could send the fake fdb to BIG-IP.

your rest would also be able to create vxlan tunnel profile and tunnel, see the tmsh tunnel command here https://github.com/f5devcentral/f5-ci-docs/blob/master/docs/cilium/cilium-bigip-info.rst

#. Create a VXLAN tunnel profile. The tunnel profile name is fl-vxlan

tmsh create net tunnels vxlan fl-vxlan port 8472 flooding-type multipoint

#. Create a VXLAN tunnel, the tunnel name is ``flannel_vxlan``, in CIS use ``--openshift-sdn-name`` argument

tmsh create net tunnels tunnel flannel_vxlan key 2 profile fl-vxlan local-address 10.169.72.34

#. Create VXLAN tunnel self IP, allow default service, allow none stops self ip ping from working

tmsh create net self 10.1.6.34 address 10.1.6.34/255.255.255.0 allow-service default vlan flannel_vxlan

#. Create a static route to Cilium managed pod CIDR network ``10.0.0.0/16`` through tunnel interface ``flannel_vxlan``
#. DO NOT CREATE STATIC ROUTE THROUGH TUNNEL INTERFACE TO K8S NODE NETWORK/IP

tmsh create net route 10.0.0.0 network 10.0.0.0/16 interface flannel_vxlan

I noticed tmsh could only use modify to add FDB for tunnel, for example
tmsh modify net fdb tunnel flannel_vxlan records add { 0a:0a:0a:a9:48:ea { endpoint 10.169.72.234%0 } }, maybe the rest could simulate tmsh behavior

I am happy to answer any questions for this request :-)

Recommend Projects