Kubernetes architecture options with F5 Distributed Cloud Services
Summary
F5 Distributed Cloud Services (F5 XC) can both integrate with your existing Kubernetes (K8s) clusters and/or host a K8s workload itself. Within these distinctions, we have multiple arch...
Updated Mar 14, 2024
Version 12.0
MichaelOLeary
Employee
Employee
MichaelOLearyEmployee
EmployeeHi Nikoolayy1
Thanks for asking. I am happy to hear you know about CIS and BIG-IP and different CNI's, because that makes understanding the options with XC pretty easy.
With the Security Gateway architecture where the CE is outside of the cluster, you can only expose ClusterIP services if they are reachable from the CE. That means either
1) you have BGP and are using Calico, OR
2) maybe your pods are reachable from the CE because you are using EKS, AKS, GKE, etc, where the pods are on the same subnet as the nodes.
The VXLAN/GENEVE tunnels are not an option at this time. You could also use an ingress controller and expose that via NodePort, but have your backend service be ClusterIP. Foo-Bang_Chan covers some of these options in his article: Multi-Cluster, Multi-Cloud Networking (MCN) for Kubernetes (see architecture #2 in his article).
Feel free to email/message/LinkedIn and we can chat too.
Mike.