Running F5 with managed Azure RedHat OpenShift

Summary

In early 2020, Microsoft and RedHat announced a new release of Azure RedHat OpenShift. This article shows how to set up F5 to integrate with this offering. This is also an easy demo.

Background

OpenShift is now available as a managed service in Azure called ARO (as in, Azure RedHat OpenShift). Microsoft has published a tutorial to deploy a cluster into an existing virtual network, but this article shows a way to deploy an environment with F5 integrated in a single deployment. Use this for demo or learning purposes.

Deploying Azure RedHat OpenShift (ARO)

You can run OpenShift on your own servers on-premises or in the cloud. For example, these instructions were the way I first learned to deploy a cluster on AWS. Eric Ji from F5 recently published a guide that walks through these instructions and he includes deployment of F5 Container Ingress Services. This method is supported and gives you a high level of control.

ARO is a deployment option where your servers are managed by Azure. Patching, upgrading, repair, and DR are all handled for you, along with joint support from Microsoft and RedHat. Microsoft have done a great job of documenting the process to deploy ARO in the tutorial already mentioned. If you were to follow their instructions, after about 35 minutes your deployment would produce something like this (image taken straight from OpenShift's announcement article):

Microsoft's instructions to create the demo above require that you have the User Access Administrator role, or that you pass in the credentials of a ServicePrincipal that has contributor rights over the Resource Group in which the existing VNET resides.

Deploying F5 + ARO

Another way to build out the same environment in Azure is this automated demo, which will include the deployment of F5 and also takes around 35 minutes to complete.

Click here to deploy this demo: https://github.com/mikeoleary/azure-redhat-openshift-f5 

This does not require a User Access Administrator, but does require that you have a ServicePrincipal with Contributor permissions on the subscription. A ServicePrincipal is a principal in Azure ActiveDirectory to which you can assign roles at a scope like Resource Group or Subscription. For this demo, I recommend creating a ServicePrincipal and then assigning it the role of Contributor over your Subscription, or the Resource Group in which you intend to deploy.

If you follow this demo, you'll have an environment that looks more like this:

 

 

This demo adds the following resources to the environment. You could add these resources manually yourself, if you have an existing OpenShift environment.

• Adds 3x subnets for the F5 BIG-IP VM
• Deploys F5 VM's into those subnets using this ARM template
• Adds the BIG-IP into the OpenShift network following these instructions
• Installs CIS in OpenShift following these instructions.
• Deploys an app into OpenShift
• This includes a Route resource that is detected by CIS
• CIS then populates the app's pod IP addresses as pool members in BIG-IP
• Output values are added to the deployment, for users to verify successful completion

Post-deployment verification

This demo will deploy an app in OpenShift that is exposed by an OpenShift Route, and this requires that you manually change your DNS record on the Internet to point to the IP address value of the deployment output called publicExternalLoadBalancerAddress.

After you have made this DNS change (optionally, use a local hosts record), you should see your demo app available on the Internet, like this:

The outputs of this demo will also give you the public URL's of BIG-IP's and your OpenShift cluster. You can login to all of these to see the configuration at work.

Deleting your environment

Don't forget to delete your environment if you are just testing. I find the easiest way to do this is just to delete the Resource Group into which you deployed originally. You can delete individual resources via the Azure portal if you choose, but do remember that the Read-Only Resource Group that is created by ARO is deleted by deleting the OpenShift cluster resource, which is in the Resource Group into which you originally deployed.

Conclusion

To summarize, ARO allows us to deploy an OpenShift environment quickly. Integration with F5 is much like an on-prem installation of OpenShift. You integrate the BIG-IP with the OpenShift network, then deploy CIS so that it can configure the BIG-IP to expose your applications.

 

Thanks for reading! Any questions, please leave a comment and I'll respond, thanks!