CNFs Software

您所在的位置:网站首页 openssl dgst -sha256 -sign CNFs Software

CNFs Software

2023-03-16 13:47| 来源: 网络整理| 查看: 265

CNFs Software露 Overview露

The Cloud-Native Network Functions (CNFs) custom resource definitions (CRDs), software images and installation Helm charts are provided in a single TAR file. A CNFs public signing key, and two signature files are also provided to validate the TAR file鈥檚 integrity. Once validated and extracted, the software images can be uploaded to a local container registry, and integrated into the cluster using the CNFs Helm charts. Finally, the CNFs CRDs will be installed into the cluster.

This document describes the CNFs software, and guides you through validating, extracting and installing the CNF software components.

Software images露

The table below lists and describes the software images for this software release. For a full list of software images by release, refer to the Software Releases guide.

Note: The software image name and deployed container name may differ.

Image Version Description f5ingress v9.0.60 The helm_release-f5ingress container is a custom CNF controller that watches the K8S API for CR updates, and configures either AFM or TMM based on the update. tmm-img v3.0.12 The f5-tmm container is a Traffic Management Microkernel (TMM) instance that proxies and load balances application traffic between the external and internal networks. f5-l4p-engine v2.0.3 The f5-afm-pccd container is an Application Firewall Manager (AFM) instance that converts firewall rules and NAT policies into the binary large objects (BLOBs) used by TMM. f5-nsec-ips-daemon v2.1.2 The f5-ipsd container is the intrusion detection and prevention instance, providing deep packet inspection and prevention of malignant network packets. tmrouted-img v0.8.37 The f5-tmm-tmrouted container proxies and forwards information between the f5-tmm-routing and f5-tmm containers. f5dr-img v0.7.8 The f5-tmm-routing container maintains the dynamic routing tables used by TMM. f5-toda-tmstatsd v1.7.21 The f5-toda-stats container collects application traffic processing statistics from the f5-tmm container, and forwards the data to the Otel Collectors. f5-dssm-store v3.1.0 Contains two sets of software images; The f5-dssm-db containers that store shared, persisted session state data, and the f5-dssm-sentinel containers to monitor the f5-dssm-db containers. For more info, refer to dSSM database. spk-cwc v3.0.6 The cnf-cwc container enables software licensing, and reports telemetry statistics regarding monthly software usage. Refer to CNFs CWC. f5-license-helper v3.0.4 The f5-lic-helper communicates with the spk-cwc to determine the current license status of the cluster. rabbit v3.0.2 The rabbitmq-server container as a general message bus, integrating CNFs CWC with the BIG-IP Controller Pod(s) for licensing purposes. cert-manager-controller v1.3.2 The cert-manager-controller manages the generation and rotation of the SSL/TLS certificate that are stored as Secrets, to secure communication between the various CNFs Pods. cert-manager-cainjector v1.3.2 The cert-manager-cainjector assists the cert-manager-controller to configure the CA certificates used by the cert-manager-webhook and K8S API. cert-manager-webhook v1.3.2 The cert-manager-webhook ensures that SSL/TLS certificate resources created or updated by the cert-manager-contoller conform to the API specifications. f5-debug-sidecar v7.18.3-0.0.13 The debug container provides diagnostic tools for viewing TMM's configuration, traffic processing statistics and gathering TMM diagnostic data. For more info, refer to Debug Sidecar. f5-fluentbit v0.4.1 The fluentbit container collects and forwards statistics to the f5-fluentd container. Multiple versions are included to support the different CNFs containers. f5-fluentd v1.4.24 The f5-fluentd container collects statistics and logging data from the Controller, TMM and dSSM Pods. For more info, refer to Fluentd Logging. opentelemetry-collector 0.62.1 The otel-collector container gathers metrics and statistics from the TMM Pods. Refer to OTEL Collector. f5-dssm-upgrader 1.0.20 The dssm-upgrade-hook enables dSSM DBs upgrades without service interruption or data loss. Refer to Upgrading dSSM. Requirements露

Ensure you have:

Obtained the CNF software tarball. A local container registry. A workstation with Podman. Procedures露 Validate and extract露

Use the following steps to validate the CNFs tarball, extract the software images, installation Helm charts, and CRDs.

Create a new directory for the CNFs files:

mkdir

In this example, the new directory is named cnfinstall:

mkdir cnfinstall

Move the CNFs files into the directory:

mv f5-cnf-tarball* f5-cnf-1.1.0.pem cnfinstall

Change into the directory and list the files:

cd cnfinstall; ls -1

The files appear as:

f5-cnf-1.1.0.pem f5-cnf-tarball-1.1.0.tgz f5-cnf-tarball-sha512.txt-1.1.0.sha512.sig f5-cnf-tarball.tgz-1.1.0.sha512.sig

Use the PEM signing key and each SHA signature file to validate the CNFs TAR file:

openssl dgst -verify .pem -keyform PEM \ -sha512 -signature .sig .tgz

The command output states Verified OK for each signature file:

openssl dgst -verify f5-cnf-1.1.0.pem -keyform PEM -sha512 \ -signature f5-cnf-tarball.tgz-1.1.0.sha512.sig f5-cnf-tarball-1.1.0.tgz Verified OK openssl dgst -verify f5-cnf-1.1.0.pem -keyform PEM -sha512 \ -signature f5-cnf-tarball-sha512.txt-1.1.0.sha512.sig f5-cnf-tarball-1.1.0.tgz Verified OK

Extract the CNFs images, Helm charts, and CRDs from the TAR file:

tar xvf f5-cnf-tarball-1.1.0.tgz

List the newly extracted files:

ls -1

The file list shows the CRD bundless and the CNF image TAR file named f5-cnf-images-1.1.0.tgz:

f5-cnf-crds-n6lan-5.0.14.tgz f5-cnf-images-1.1.0.tgz f5-cnf-tarball-1.1.0.tgz

Extract the CNF Helm charts and software images:

tar xvf f5-cnf-images-1.1.0.tgz

List the extracted Helm charts and software images:

ls -1R

The file list shows a new tar directory with the following files:

f5-cnf-crds-n6lan-5.0.14.tgz f5-cnf-images-1.1.0.tgz f5-cnf-tarball-1.1.0.tgz tar ./tar: cnf-docker-images.tgz cwc-3.0.7.tgz f5-cert-gen-0.7.1.tgz f5-cert-manager-0.5.10.tgz f5-dssm-3.0.13.tgz f5-toda-fluentd-1.13.14.tgz f5ingress-9.0.60.tgz rabbitmq-3.0.4.tgz Install CRDs露

Use the following steps to extract and install the new CNF CRDs.

List the CNF CRD bundle:

ls -1 | grep crd

The file list shows three CRD bundles:

f5-cnf-crds-n6lan-5.0.14.tgz

Extract the CRDs from the bundle:

tar xvf f5-cnf-crds-n6lan-5.0.14.tgz

Install the CRDs:

oc apply -f f5-cnf-crds-n6lan/crds

Note the command output: Newly installed CRDs will be indicated by created, and updated CRDs will be indicated by configured:

customresourcedefinition.apiextensions.k8s.io/f5-big-alg-ftps.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-alg-pptps.k8s.f5net.com configured customresourcedefinition.apiextensions.k8s.io/f5-big-alg-rtsps.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-alg-tftps.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-cne-addresslists.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-cne-datagroups.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-cne-portlists.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-cne-snatpools.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-context-globals.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-context-secures.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-ddos-policies.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-dns-apps.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-dns-caches.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-fastl4-settings.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-fw-policies.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-ips-policies.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-log-hslpubs.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-log-profiles.k8s.f5net.com configured customresourcedefinition.apiextensions.k8s.io/f5-big-nat-policies.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-net-staticroutes.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-net-vlans.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-tcp-settings.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-udp-settings.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/f5-big-zerorating-policies.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/certificaterequests.cm.f5co.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/certificates.cm.f5co.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/challenges.acme.cm.f5co.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/clusterissuers.cm.f5co.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/issuers.cm.f5co.k8s.f5net.com unchanged customresourcedefinition.apiextensions.k8s.io/orders.acme.cm.f5co.k8s.f5net.com unchanged

List the installed CNFs CRDs:

oc get crds | grep f5-big

The CRD listing will contain the full list of CRDs:

f5-big-alg-ftps.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-alg-pptps.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-alg-rtsps.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-alg-tftps.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-cne-addresslists.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-cne-datagroups.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-cne-downloaders.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-cne-portlists.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-cne-snatpools.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-context-globals.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-context-secures.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-ddos-policies.dos.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-ddos-policies.k8s.f5net.com 2023-02-09T22:29:25Z f5-big-dns-apps.dns.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-dns-apps.k8s.f5net.com 2023-02-09T22:29:25Z f5-big-dns-caches.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-dns-zones.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-dnsx-global-optionses.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-dpi-appses.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-dpi-pe-optionses.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-dpi-profiles.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-fastl4-settings.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-fw-policies.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-ips-policies.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-log-hslpubs.k8s.f5net.com 2023-01-24T00:02:02Z f5-big-log-profiles.k8s.f5net.com 2023-01-24T00:02:03Z f5-big-nat-policies.k8s.f5net.com 2023-01-24T00:02:03Z f5-big-net-staticroutes.k8s.f5net.com 2023-01-24T00:02:03Z f5-big-net-vlans.k8s.f5net.com 2023-01-24T00:02:03Z f5-big-pe-policies.k8s.f5net.com 2023-01-24T00:02:03Z f5-big-pe-profiles.k8s.f5net.com 2023-01-24T00:02:03Z f5-big-tcp-settings.k8s.f5net.com 2023-01-24T00:02:03Z f5-big-udp-settings.k8s.f5net.com 2023-01-24T00:02:03Z f5-big-zerorating-policies.k8s.f5net.com 2023-01-24T00:02:03Z Upload the images露

Use the following steps to upload the CNFs software images to a local container registry.

Install the CNFs images to your workstation鈥檚 Podman image store:

podman load -i tar/cnf-docker-images.tgz

List the CNF images to be tagged and pushed to the local container registry in the next step:

podman images --format "table {{.Repository}} {{.Tag}} {{.ID}}" REPOSITORY TAG IMAGE ID local.registry/f5ingress v9.0.60 1fd9ba04c0fa local.registry/f5dr-img-init v0.7.8 926919d8cc68 local.registry/f5dr-img v0.7.8 e47812030b51 local.registry/tmm-img v3.0.12 a18c56ed261b local.registry/f5-debug-sidecar v7.18.3-0.0.13 20e05cd8a907 local.registry/spk-cwc v3.0.6 aa136df422b0 local.registry/rabbit v3.0.2 d1b34116414b local.registry/f5-dssm-upgrader 1.0.20 84e01f44dbed local.registry/f5-toda-tmstatsd v1.7.21 e2d308a3eada local.registry/f5-fluentbit v0.4.1 04eb05a57e12 local.registry/f5-license-helper v3.0.4 90971a6d9e93 local.registry/f5-dssm-store v3.1.0 4f621d673ff0 local.registry/f5-l4p-engine v2.0.3 e6cc6290416d local.registry/f5-nsec-ips-daemon v2.1.2 3acee3a47373 local.registry/f5-fluentd v1.4.24 10f1ecf225fe local.registry/tmrouted-img v0.8.37 3ff758d640f3 local.registry/cert-manager-ctl 1.3.2 f12fe2000d77 local.registry/cert-manager-webhook 1.3.2 c7abc19e5278 local.registry/cert-manager-cainjector 1.3.2 6f627f2fddd2 local.registry/cert-manager-controller 1.3.2 b43f59f240d3 local.registry/opentelemetry-collector 0.62.1 ce87f9acddfa

Tag and push each image to the local container registry. For example:

podman tag : /: podman push /:

In this example, the f5ingress:v9.0.60 image is tagged and pushed to the remote registry registry.com:

podman tag local.registry/f5ingress:v9.0.60 registry.com/f5ingress:v9.0.60 podman push registry.com/f5ingress:v9.0.60

Once all of the images have uploaded, verify the images exist in the local container registry:

curl -X GET https:///v2/_catalog -u

For example:

curl -X GET https://registry.com/v2/_catalog -u cnfadmin:cnfadmin "repositories":["f5-debug-sidecar","f5-dssm-store","f5-fluentbit","f5-fluentd","f5-toda-tmstatsd","f5dr-img","f5ingress","tmm-img","tmrouted-img"]} Next step露

Continue to the CNFs Cert Manager guide to secure CNFs communications.

Feedback露

Provide feedback to improve this document by emailing [email protected].

Supplemental露 Using Podman load.


【本文地址】


今日新闻


推荐新闻


CopyRight 2018-2019 办公设备维修网 版权所有 豫ICP备15022753号-3