本頁面由 Cloud Translation API 翻譯而成。

使用 F5 和 Google 提供的舊版控制器進行負載平衡

在 1.29 以下版本中，使用 loadBalancer.f5BigIP 設定建立的使用者叢集，會部署 Google 提供的 F5 控制器。由於這些控制器有限制，在 1.30 以上版本中，Google Distributed Cloud 會禁止使用 loadBalancer.f5BigIP 設定建立叢集。您必須為新叢集設定手動平衡負載，並自行部署 F5 控制器。

本頁說明如何為使用 Google Distributed Cloud 建立的使用者叢集，部署 Google 提供的舊版 F5 控制器。雖然系統支援部署這些控制器，但我們建議您安裝 F5 的最新 CIS 控制器。

需求條件：

您有一個採用 manualLB 設定的使用者叢集。
您擁有使用者叢集的 F5 伺服器，且知道登入資訊。
您想自動化程序，在 F5 中為使用者叢集內 LoadBalancer 類型的 Kubernetes 服務設定虛擬伺服器。

步驟 1：準備控制器的範本

取得 F5 資訊並產生範本。

取得 F5 資訊

使用 F5 伺服器的登入資訊，設定下列預留位置變數：
- F5 使用者名稱：USERNAME
- F5 密碼：PASSWORD
- F5 地址：ADDRESS
- F5 分割區：PARTITION
設定 SnatPoolName。如果未使用 SNAT，請將預留位置變數留空：
```
SnatPoolName: SNAT_POOL_NAME
```

取得登錄檔和版本資訊

取得 onpremusercluster 自訂資源：

kubectl --kubeconfig USER_CLUSTER_KUBECONFIG get onpremusercluster -oyaml -n kube-system

從 onpremusercluster 自訂資源複製下列欄位：

Registry: REGISTRY (onpremusercluster.spec.registry.address)
ImageTag: IMAGE_TAG (onpremusercluster.spec.gkeOnPremVersion)

生成範本

cat > templates.yaml << EOF
apiVersion: v1
kind: Secret
metadata:
  name: bigip-login
  namespace: kube-system
stringData:
  password: "PASSWORD"
  username: "USERNAME"
  url: "ADDRESS"
  partition: "PARTITION"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bigip-ctlr
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: load-balancer-f5
  namespace: kube-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8s-bigip-ctlr-deployment
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: k8s-bigip-ctlr
  template:
    metadata:
      name: k8s-bigip-ctlr
      labels:
        app: k8s-bigip-ctlr
    spec:
      serviceAccountName: bigip-ctlr
      volumes:
        - name: bigip-login
          secret:
            secretName: bigip-login
      containers:
        - name: k8s-bigip-ctlr
          image: "REGISTRY/k8s-bigip-ctlr:v1.14.0-gke.28"
          resources:
            requests:
              cpu: 60m
              memory: 90Mi
          volumeMounts:
            - name: bigip-login
              readOnly: true
              mountPath: "/etc/bigip-login"
          env:
            - name: BIGIP_PARTITION
              valueFrom:
                secretKeyRef:
                  name: bigip-login
                  key: partition
          command: ["/app/bin/k8s-bigip-ctlr"]
          args: [
            # See the k8s-bigip-ctlr documentation for information about
            # all config options
            # http://clouddocs.f5.com/products/connectors/k8s-bigip-ctlr/latest
            "--http-listen-address=:9097",
            "--credentials-directory=/etc/bigip-login",
            "--bigip-partition=\$(BIGIP_PARTITION)",
            "--log-level=ERROR",
            "--pool-member-type=nodeport",
            "--manage-ingress=false",
            "--vs-snat-pool-name=SNAT_POOL_NAME"
          ]
      dnsPolicy: Default
      imagePullSecrets:
        - name: private-registry-creds
      nodeSelector:
        kubernetes.io/os: linux
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: load-balancer-f5
  namespace: kube-system
  labels:
    app: load-balancer-f5
spec:
  replicas: 1
  selector:
    matchLabels:
      app: load-balancer-f5
  template:
    metadata:
      name: load-balancer-f5
      labels:
        app: load-balancer-f5
    spec:
      serviceAccountName: load-balancer-f5
      containers:
        - name: load-balancer-f5
          image: "REGISTRY/load-balancer-f5:IMAGE_TAG"
          env:
            - name: BIGIP_PARTITION
              valueFrom:
                secretKeyRef:
                  name: bigip-login
                  key: partition
          command:
            - ./load-balancer-f5
          args:
            - "--bigip-partition=\$(BIGIP_PARTITION)"
          resources:
            requests:
              cpu: 2m
              memory: 13Mi
      imagePullSecrets:
        - name: private-registry-creds
      nodeSelector:
        kubernetes.io/os: linux
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: bigip-ctlr-clusterrole-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: bigip-ctlr-clusterrole
subjects:
  - kind: ServiceAccount
    name: bigip-ctlr
    namespace: kube-system
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: load-balancer-f5-clusterrole-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: load-balancer-f5-clusterrole
subjects:
  - kind: ServiceAccount
    name: load-balancer-f5
    namespace: kube-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name:
    bigip-ctlr-clusterrole
rules:
  - apiGroups: ["", "extensions"]
    resources: ["nodes", "services", "endpoints", "namespaces", "ingresses", "pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["", "extensions"]
    resources: ["configmaps", "events", "ingresses/status"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["", "extensions"]
    resources: ["secrets"]
    resourceNames: ["bigip-login"]
    verbs: ["get", "list", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name:
    load-balancer-f5-clusterrole
rules:
  - apiGroups: [""]
    resources: ["events", "nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["services", "services/status"]
    verbs: ["get", "list", "watch", "patch", "update"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch",  "create", "patch", "delete"]
EOF

步驟 2：將範本套用至使用者叢集

kubectl --kubeconfig USER_CLUSTER_KUBECONFIG apply -f templates.yaml