Deploy Secure Mesh Site v2 with Amazon EKS (ClickOps)

Overview

This guide provides instructions on how to create a Customer Edge (CE) Site using the F5 Distributed Cloud Console for the Amazon EKS environment.

Important: This guide does not provide instructions on how to deploy an F5 App Stack Site.

This functionality is in Early Access (EA) and can be used for proof of concept (PoC) or proof of value (PoV) deployments. The functionality will be made Generally Available (GA) over the next couple of releases. Reach out to your F5 account representative for more information.

Plan your deployment

Read the following documents before deploying a Secure Mesh Site in any provider environment:

• Understanding F5 Distributed Cloud - Customer Edge (CE)
• CE Datasheet
• CE Supported Platforms Guide
• Customer Edge Site Sizing Reference
• CE Performance Guide: Contact your account representative on CE performance-related information.
• Proxy for CE Registration and Upgrades Reference
• Secure Mesh Sites v2 Frequently Asked Questions
• Customer Edge Registration and Upgrade Reference
• F5 Customer Edge IP Address and Domain Reference for Firewall or Proxy Settings

Before you begin

Before you begin, make sure you have:

• A Distributed Cloud Services account. If you do not have an account, see Get Started with Distributed Cloud Console.

• Resources required per node: Minimum 8 vCPUs, 32 GB RAM, and 80 GB disk storage. For a full listing of the resources required, see the Customer Edge Site Sizing Reference guide. All the nodes in a given CE Site should have the same resources regarding the compute, memory, and disk storage. When deploying in cloud environments, these nodes should use the same instance flavor.

• Customer Edge (CE) deployments require connectivity to F5 Distributed Cloud. See the F5 Customer Edge IP Address and Domain Reference for Firewall or Proxy Settings guide for the list of IP addresses and domain names that need to be allowed.

• F5 assumes that an existing IPv4 subnet exists with Internet connectivity to attach to the node.

• The new Secure Mesh Site workflow enables you to have up to eight interfaces. However, these interfaces should be in different subnets. Therefore, make sure you have the required subnets available before creating the CE Site nodes.

• If you are deploying the CE site with High Availability (HA) enabled, Internet Control Message Protocol (ICMP) must be opened between the CE nodes on the Site Local Outside (SLO) interfaces. This is needed to ensure intra-cluster communication checks.

• An AWS EKS cluster with EC2 instances running. To set up a cluster, see Set up to use Amazon EKS.

• Enabled AVX (Advanced Vector Extensions) on hardware where your CEs are deployed if you're using F5 Distributed Cloud WAF. If you don't enable AVX, you can't use the AI features for F5 Distributed Cloud WAF.

Important: After you deploy the CE Site, the IP address for the SLO interface cannot be changed. Also, the MAC address cannot be changed.

Feature gaps from other providers

The following features aren't supported:

• Segment virtual routing and forwarding (VRF)
• Common virtual IP address (VIP)
• DC Cluster Group (DC-CG)
• Enhanced Firewall policy (EFP)
• Static route configuration
• Virtual Router Redundancy Protocol (VRRP) mode
• SLI Site-to-Site connectivity
• Jumbo frames
• Node-by-node upgrades
• Management network
• Horizontal scaling
• Vertical scaling

Configuration overview

To create a Secure Mesh Site for AWS EKS:

• Site object configuration: Create and configure a Secure Mesh Site object using F5 Distributed Cloud Console.
• Node deployment prerequisites: Create objects that are associated with the CE nodes, including security groups, SSH key pairs, and more.
• Node management: Use Download Manifests deployment method to create the CE nodes. Each CE node is a virtual machine (VM).

Important: If you make changes to the custom proxy server or node selector configurations for running nodes, you must download the manifest file again and re-apply it.

Create Site Object

export KUBECONFIG=</path/to/the/kubeconfig/file>
   for n in ip-10-0-1-38.ec2.internal ip-10-0-2-243.ec2.internal ip-10-0-3-154.ec2.internal; do
     kubectl debug node/$n -it --image=public.ecr.aws/amazonlinux/amazonlinux:2023 -- \
       chroot /host /bin/bash -c "
         grep -q '^vm.nr_hugepages' /etc/sysctl.conf || echo 'vm.nr_hugepages=768' >> /etc/sysctl.conf
         sysctl -p
         systemctl restart kubelet
         grep -i huge /proc/meminfo"
   done

Verify CE Site Registration

After you deploy your nodes, they automatically register as a CE Site in Distributed Cloud Console. The registration process is not instantaneous. In Console, the status changes from Waiting for Registration to Provisioning to Online. Wait a few minutes for the registration process to begin after completing the preceding section.

• In Distributed Cloud Console, navigate to Multi-Cloud Network Connect > Overview > Infrastructure > Sites.

• Select your CE Site. The Dashboard tab should clearly show that the CE Site has registered successfully with the System Health of 100% as well as Data Plane/Control Plane both Up.

Note: For more information on the CE Site registration process, see the Customer Edge Registration and Upgrade Reference guide.

Day 2 operations

• To monitor your CE Site, see the Monitor Site guide.
• To manage your CE Site software updates, see the Manage Site guide.
• For the latest on Distributed Cloud Services releases, see Changelogs.
• To view the various types of events generated, see the Events Reference guide.

Related guides

To create a load balancer on the CE Site, see the Create HTTP Load Balancer or the Create TCP Load Balancer guides.

References

For more information, see:

• System Overview
• Core Concepts
• Networking
• F5 Distributed Cloud - Customer Edge