Anthos Clusters on VMware 现在是 Google Distributed Cloud for VMware（纯软件）。如需了解详情，请参阅产品概览。

此页面由 Cloud Translation API 翻译。

使用 F5 和旧版 Google 提供的控制器进行负载均衡

在 1.29 版及更低版本中，使用 loadBalancer.f5BigIP 配置创建的用户集群会部署 Google 提供的 F5 控制器。由于这些控制器存在限制，因此在 1.30 版及更高版本中，Google Distributed Cloud 会阻止使用 loadBalancer.f5BigIP 配置创建集群。相反，您必须为新集群配置手动负载均衡，并且需要自行部署 F5 控制器。

本页介绍了如何为使用 Google Distributed Cloud 创建的用户集群部署旧版 Google 提供的 F5 控制器。虽然我们支持部署这些控制器，但建议您从 F5 安装最新的 CIS 控制器。

前提条件：

您有一个采用 manualLB 配置的用户集群。
您有用户集群的 F5 服务器，并且知道其登录信息。
您希望自动为用户集群中的 LoadBalancer 类型 Kubernetes Service 在 F5 中配置虚拟服务器。

第 1 步。为控制器准备模板

获取 F5 信息并生成模板。

获取 F5 信息

使用 F5 服务器中的登录信息设置以下占位符变量：
- F5 用户名：USERNAME
- F5 密码：PASSWORD
- F5 地址：ADDRESS
- F5 分区：PARTITION
设置 SnatPoolName。如果您不使用 SNAT，请将占位符变量留空：
```
SnatPoolName: SNAT_POOL_NAME
```

获取注册表和版本信息

获取 onpremusercluster 自定义资源：

kubectl --kubeconfig USER_CLUSTER_KUBECONFIG get onpremusercluster -oyaml -n kube-system

从 onpremusercluster 自定义资源复制以下字段：

Registry: REGISTRY (onpremusercluster.spec.registry.address)
ImageTag: IMAGE_TAG (onpremusercluster.spec.gkeOnPremVersion)

生成模板

cat > templates.yaml << EOF
apiVersion: v1
kind: Secret
metadata:
  name: bigip-login
  namespace: kube-system
stringData:
  password: "PASSWORD"
  username: "USERNAME"
  url: "ADDRESS"
  partition: "PARTITION"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bigip-ctlr
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: load-balancer-f5
  namespace: kube-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8s-bigip-ctlr-deployment
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: k8s-bigip-ctlr
  template:
    metadata:
      name: k8s-bigip-ctlr
      labels:
        app: k8s-bigip-ctlr
    spec:
      serviceAccountName: bigip-ctlr
      volumes:
        - name: bigip-login
          secret:
            secretName: bigip-login
      containers:
        - name: k8s-bigip-ctlr
          image: "REGISTRY/k8s-bigip-ctlr:v1.14.0-gke.28"
          resources:
            requests:
              cpu: 60m
              memory: 90Mi
          volumeMounts:
            - name: bigip-login
              readOnly: true
              mountPath: "/etc/bigip-login"
          env:
            - name: BIGIP_PARTITION
              valueFrom:
                secretKeyRef:
                  name: bigip-login
                  key: partition
          command: ["/app/bin/k8s-bigip-ctlr"]
          args: [
            # See the k8s-bigip-ctlr documentation for information about
            # all config options
            # http://clouddocs.f5.com/products/connectors/k8s-bigip-ctlr/latest
            "--http-listen-address=:9097",
            "--credentials-directory=/etc/bigip-login",
            "--bigip-partition=\$(BIGIP_PARTITION)",
            "--log-level=ERROR",
            "--pool-member-type=nodeport",
            "--manage-ingress=false",
            "--vs-snat-pool-name=SNAT_POOL_NAME"
          ]
      dnsPolicy: Default
      imagePullSecrets:
        - name: private-registry-creds
      nodeSelector:
        kubernetes.io/os: linux
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: load-balancer-f5
  namespace: kube-system
  labels:
    app: load-balancer-f5
spec:
  replicas: 1
  selector:
    matchLabels:
      app: load-balancer-f5
  template:
    metadata:
      name: load-balancer-f5
      labels:
        app: load-balancer-f5
    spec:
      serviceAccountName: load-balancer-f5
      containers:
        - name: load-balancer-f5
          image: "REGISTRY/load-balancer-f5:IMAGE_TAG"
          env:
            - name: BIGIP_PARTITION
              valueFrom:
                secretKeyRef:
                  name: bigip-login
                  key: partition
          command:
            - ./load-balancer-f5
          args:
            - "--bigip-partition=\$(BIGIP_PARTITION)"
          resources:
            requests:
              cpu: 2m
              memory: 13Mi
      imagePullSecrets:
        - name: private-registry-creds
      nodeSelector:
        kubernetes.io/os: linux
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: bigip-ctlr-clusterrole-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: bigip-ctlr-clusterrole
subjects:
  - kind: ServiceAccount
    name: bigip-ctlr
    namespace: kube-system
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: load-balancer-f5-clusterrole-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: load-balancer-f5-clusterrole
subjects:
  - kind: ServiceAccount
    name: load-balancer-f5
    namespace: kube-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name:
    bigip-ctlr-clusterrole
rules:
  - apiGroups: ["", "extensions"]
    resources: ["nodes", "services", "endpoints", "namespaces", "ingresses", "pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["", "extensions"]
    resources: ["configmaps", "events", "ingresses/status"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["", "extensions"]
    resources: ["secrets"]
    resourceNames: ["bigip-login"]
    verbs: ["get", "list", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name:
    load-balancer-f5-clusterrole
rules:
  - apiGroups: [""]
    resources: ["events", "nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["services", "services/status"]
    verbs: ["get", "list", "watch", "patch", "update"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch",  "create", "patch", "delete"]
EOF

第 2 步。将模板应用于用户集群

kubectl --kubeconfig USER_CLUSTER_KUBECONFIG apply -f templates.yaml