|
| 1 | +# Helm Chart for the F5 Container Ingress Services |
| 2 | + |
| 3 | +This chart simplifies repeatable, versioned deployment of the [Container Ingress Services](https://clouddocs.f5.com/containers/latest/). |
| 4 | + |
| 5 | +### Prerequisites |
| 6 | +- Refer to [CIS Prerequisites](https://clouddocs.f5.com/containers/latest/userguide/cis-helm.html#prerequisites) to install Container Ingress Services on Kubernetes or Openshift |
| 7 | +- [Helm 3](https://helm.sh/docs/intro/) should be installed. |
| 8 | + |
| 9 | + |
| 10 | +## Installing CIS Using Helm Charts |
| 11 | + |
| 12 | +This is the simplest way to install the CIS on OpenShift/Kubernetes cluster. Helm is a package manager for Kubernetes. Helm is Kubernetes version of yum or apt. Helm deploys something called charts, which you can think of as a packaged application. It is a collection of all your versioned, pre-configured application resources which can be deployed as one unit. This chart creates a Deployment for one Pod containing the [k8s-bigip-ctlr](https://clouddocs.f5.com/containers/latest/), it's supporting RBAC, Service Account and Custom Resources Definition installations. |
| 13 | + |
| 14 | +## Installing the Chart |
| 15 | + |
| 16 | +- (Optional) Add BIG-IP credentials as K8S secrets. |
| 17 | + |
| 18 | +For Kubernetes, use the following command: |
| 19 | + |
| 20 | +```kubectl create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=<password>``` |
| 21 | + |
| 22 | +For OpenShift, use the following command: |
| 23 | + |
| 24 | +```oc create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=<password>``` |
| 25 | + |
| 26 | +- Add the CIS chart repository in Helm using following command: |
| 27 | + |
| 28 | +```helm repo add f5-stable https://f5networks.github.io/charts/stable``` |
| 29 | + |
| 30 | +- Create values.yaml as shown in [examples](https://github.com/F5Networks/charts/tree/master/example_values/f5-bigip-ctlr): |
| 31 | + |
| 32 | +- Install the Helm chart if BIGIP credential secrets created manually using the following command: |
| 33 | + |
| 34 | +```helm install -f values.yaml <new-chart-name> f5-stable/f5-bigip-ctlr``` |
| 35 | + |
| 36 | +- Install the Helm chart with skip crds if BIGIP credential secrets created manually (without custom resource definitions installations) |
| 37 | + |
| 38 | +```helm install --skip-crds -f values.yaml <new-chart-name> f5-stable/f5-bigip-ctlr``` |
| 39 | + |
| 40 | +- If you want to create the BIGIP credential secret with helm charts use the following command: |
| 41 | + |
| 42 | +```helm install --set bigip_secret.create="true" --set bigip_secret.username=$BIGIP_USERNAME --set bigip_secret.password=$BIGIP_PASSWORD -f values.yaml <new-chart-name> f5-stable/f5-bigip-ctlr``` |
| 43 | + |
| 44 | +## Chart parameters: |
| 45 | + |
| 46 | +Parameter | Required | Description | Default |
| 47 | +----------|-------------|-------------|-------- |
| 48 | +bigip_login_secret | Optional | Secret that contains BIG-IP login credentials | f5-bigip-ctlr-login |
| 49 | +args.bigip_url | Required | The management IP for your BIG-IP device | **Required**, no default |
| 50 | +args.bigip_partition | Required | BIG-IP partition the CIS Controller will manage | f5-bigip-ctlr |
| 51 | +args.namespaces | Optional | List of Kubernetes namespaces which CIS will monitor | empty |
| 52 | +bigip_secret.create | Optional | Create kubernetes secret using username and password | false |
| 53 | +bigip_secret.username | Optional | bigip username to create the kubernetes secret | empty |
| 54 | +bigip_secret.password | Optional | bigip password to create the kubernetes secret | empty |
| 55 | +rbac.create | Optional | Create ClusterRole and ClusterRoleBinding | true |
| 56 | +serviceAccount.name | Optional | name of the ServiceAccount for CIS controller | f5-bigip-ctlr-serviceaccount |
| 57 | +serviceAccount.create | Optional | Create service account for the CIS controller | true |
| 58 | +namespace | Optional | name of namespace CIS will use to create deployment and other resources | kube-system |
| 59 | +image.user | Optional | CIS Controller image repository username | f5networks |
| 60 | +image.repo | Optional | CIS Controller image repository name | k8s-bigip-ctlr |
| 61 | +image.pullPolicy | Optional | CIS Controller image pull policy | Always |
| 62 | +image.pullSecrets | Optional | List of secrets of container registry to pull image | empty |
| 63 | +version | Optional | CIS Controller image tag | latest |
| 64 | +nodeSelector | Optional | dictionary of Node selector labels | empty |
| 65 | +tolerations | Optional | Array of labels | empty |
| 66 | +limits_cpu | Optional | CPU limits for the pod | 100m |
| 67 | +limits_memory | Optional | Memory limits for the pod | 512Mi |
| 68 | +requests_cpu | Optional | CPU request for the pod | 100m |
| 69 | +requests_memory | Optional | Memory request for the pod | 512Mi |
| 70 | +affinity | Optional | Dictionary of affinity | empty |
| 71 | +securityContext | Optional | Dictionary of deployment securityContext | empty |
| 72 | +podSecurityContext | Optional | Dictionary of pod securityContext | empty |
| 73 | +ingressClass.ingressClassName | Optional | Name of ingress class | f5 |
| 74 | +ingressClass.isDefaultIngressController | Optional | CIS will monitor all the ingresses resource if set true | false |
| 75 | +ingressClass.create | Optional | Create ingress class | true |
| 76 | + |
| 77 | +Note: bigip_login_secret and bigip_secret are mutually exclusive, if both are defined in values.yaml file bigip_secret will be given priority. |
| 78 | + |
| 79 | + |
| 80 | +See the CIS documentation for a full list of args supported for CIS [CIS Configuration Options](https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html) |
| 81 | + |
| 82 | +> **Note:** Helm value names cannot include the character `-` which is commonly used in the names of parameters passed to the controller. To accomodate Helm, the parameter names in `values.yaml` use `_` and then replace them with `-` when rendering. |
| 83 | +> e.g. `args.bigip_url` is rendered as `bigip-url` as required by the CIS Controller. |
| 84 | +
|
| 85 | + |
| 86 | +If you have a specific use case for F5 products in the Kubernetes environment that would benefit from a curated chart, please [open an issue](https://github.com/F5Networks/charts/issues) describing your use case and providing example resources. |
| 87 | + |
| 88 | +## Uninstalling Helm Chart |
| 89 | + |
| 90 | +Run the following command to uninstall the chart. |
| 91 | + |
| 92 | +```helm uninstall <new-chart-name>``` |
| 93 | + |
0 commit comments