Multi‑Cluster Kubernetes App Delivery Made Simple with F5 BIG‑IP CIS & Nutanix Kubernetes Platform

CIS Multicluster Support with F5 BIG-IP and Nutanix Kubernetes Platform

Key Concepts:

• CIS (Container Ingress Solution): F5’s solution for managing ingress traffic to applications running across multiple Kubernetes clusters.
• BIG-IP: F5’s application delivery controller, used for traffic management and security.
• NKP (Nutanix Kubernetes Platform): The Kubernetes platform used in the demo for managing clusters.
• AOS (Nutanix Acropolis Operating System): Nutanix’s hyperconverged infrastructure operating system.
• CNI (Container Network Interface): A specification for networking plugins used in Kubernetes; Selium is used in this demo.
• Virtual Server: A representation of a service on the BIG-IP, acting as the entry point for traffic.
• Pool: A group of backend servers (in this case, Kubernetes nodes) that a virtual server distributes traffic to.
• Pool Member: An individual server within a pool.
• WAF (Web Application Firewall): A security mechanism to protect web applications from attacks.
• Custom Resources: Kubernetes objects used by CIS to manage configurations.

---

Multicluster Application Delivery Overview

This demonstration showcases how F5’s Container Ingress Solution (CIS) integrates with Nutanix Kubernetes Platform (NKP) to simplify application delivery across multiple Kubernetes clusters. The goal is to centralize traffic management, maintain consistent security, and enable effortless scalability for containerized applications. The setup utilizes a high availability F5 BIG-IP pair with minimal initial configuration – a single partition named NKPCIS demo is created for CIS to manage Kubernetes objects.

Demo Environment & Setup

The demo environment consists of four Kubernetes clusters (NKPCIS demo0, NKPCIS demo1, NKPCIS demo2, and NKPCIS demo3) deployed across two Nutanix AOS clusters. Nutanix serves as the Enterprise NKP provider, leveraging Selium as the Container Network Interface (CNI). Two sample applications, “Hello” and “Cafe,” are pre-deployed across all three initial clusters. Each cluster terminal section is color-coded for clarity: white (cluster 0), green (cluster 1), and orange (cluster 2). Static routing is enabled for Selium on CIS, allowing automatic creation of static routes on the BIG-IP.

CIS Deployment and Initial Configuration

CIS multicluster was successfully deployed, automatically creating virtual server resources for both “Hello” and “Cafe” applications. CIS pushed the initial configuration to the BIG-IP, provisioning application services and dynamically creating static routes for all nodes across the three initial Kubernetes clusters. Verification confirmed that both applications were reachable and load balanced across clusters 0, 1, and 2 as expected.

Dynamic Scalability and Cluster Addition

The demonstration highlights CIS’s ability to dynamically adapt to changes in the Kubernetes environment. Scaling up pods on each cluster is seamlessly reflected on the BIG-IP in real-time, maintaining consistent load balancing. Adding a new cluster (NKPCIS demo3) is achieved by simply updating the CIS config map and virtual server resources. Upon application of the updated configuration, the BIG-IP automatically adjusts, and “Hello” is then load balanced across all four clusters (0, 1, 2, and 3).

Security Policy Integration with WAF

CIS facilitates the attachment of security policies to applications, ensuring consistent protection. A Web Application Firewall (WAF) policy, “policy demo,” was created but initially unattached. CIS manages security through custom resources; referencing the WAF policy within a policy custom resource and attaching it to the virtual server custom resource. Once attached, both “Hello” and “Cafe” remained reachable and load balanced, but were now protected by the WAF. A simulated cross-site scripting (XSS) attack was successfully mitigated, with the BIG-IP logs detailing the detected attack type.

High Availability Configuration

CIS supports high availability through primary and secondary roles. The secondary CIS instance operates in a passive mode, continuously health-checking the primary. It only takes over configuration pushing to the BIG-IP upon detection of a primary instance failure. During normal operation, only the primary CIS pushes configuration, ensuring consistency and preventing conflicts.

Technical Details & Observations

• Selium CNI: Utilized for networking within the Kubernetes clusters, and its static routing capabilities are leveraged by CIS.
• Dynamic Route Creation: CIS dynamically creates static routes on the BIG-IP, simplifying network configuration and ensuring traffic is directed to the correct backend nodes.
• Custom Resources: CIS utilizes Kubernetes custom resources for managing configuration, providing a declarative and automated approach.
• Real-time Synchronization: Changes in the Kubernetes environment (scaling, cluster additions) are reflected on the BIG-IP in real-time.

---

Conclusion:

The demonstration effectively illustrates how F5 CIS, in conjunction with Nutanix NKP, streamlines multicluster application delivery. The solution provides unified traffic management, consistent security through WAF integration, and effortless scalability, simplifying operations for modern containerized applications. The key takeaway is the ability to manage complex multicluster deployments with a centralized and automated approach, reducing operational overhead and enhancing application resilience.