-
Notifications
You must be signed in to change notification settings - Fork 51
/
f5_onboard.tmpl
240 lines (228 loc) · 7.22 KB
/
f5_onboard.tmpl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
#!/bin/bash
# NOTE: Startup Script is run once / initialization only (Cloud-Init behavior vs. typical re-entrant for Azure Custom Script Extension )
# For 15.1+ and above, Cloud-Init will run the script directly and can remove Azure Custom Script Extension
mkdir -p /var/log/cloud /config/cloud /var/config/rest/downloads
LOG_FILE=/var/log/cloud/startup-script.log
[[ ! -f $LOG_FILE ]] && touch $LOG_FILE || { echo "Run Only Once. Exiting"; exit; }
npipe=/tmp/$$.tmp
trap "rm -f $npipe" EXIT
mknod $npipe p
tee <$npipe -a $LOG_FILE /dev/ttyS0 &
exec 1>&-
exec 1>$npipe
exec 2>&1
### write_files:
# Download or Render BIG-IP Runtime Init Config
cat << 'EOF' > /config/cloud/runtime-init-conf.yaml
---
runtime_parameters:
- name: USER_NAME
type: static
value: ${f5_username}
- name: SSH_KEYS
type: static
value: ${ssh_keypair}
EOF
if ${az_keyvault_authentication}; then
cat << 'EOF' >> /config/cloud/runtime-init-conf.yaml
- name: ADMIN_PASS
type: secret
secretProvider:
environment: azure
type: KeyVault
vaultUrl: ${vault_url}
secretId: ${keyvault_secret}
EOF
else
cat << 'EOF' >> /config/cloud/runtime-init-conf.yaml
- name: ADMIN_PASS
type: static
value: ${f5_password}
EOF
fi
# Add remaining runtime_parameters
cat << 'EOF' >> /config/cloud/runtime-init-conf.yaml
- name: GATEWAY_EXTERNAL
type: metadata
metadataProvider:
environment: azure
type: network
field: ipv4
index: 1
ipcalc: first
- name: GATEWAY_INTERNAL
type: metadata
metadataProvider:
environment: azure
type: network
field: ipv4
index: 2
ipcalc: first
- name: SELF_IP_EXTERNAL
type: metadata
metadataProvider:
environment: azure
type: network
field: ipv4
index: 1
ipcalc: address
- name: SELF_IP_INTERNAL
type: metadata
metadataProvider:
environment: azure
type: network
field: ipv4
index: 2
ipcalc: address
- name: DNS_SERVER
type: static
value: ${dns_server}
- name: DNS_SUFFIX
type: static
value: ${dns_suffix}
- name: NTP_SERVER
type: static
value: ${ntp_server}
- name: TIMEZONE
type: static
value: ${timezone}
- name: HOST_NAME
type: metadata
metadataProvider:
environment: azure
type: compute
field: name
- name: REGION
type: url
value: http://169.254.169.254/metadata/instance/compute/location?api-version=2021-05-01&format=text
headers:
- name: Metadata
value: true
pre_onboard_enabled:
- name: provision_rest
type: inline
commands:
- /usr/bin/setdb provision.extramb 1024
- /usr/bin/setdb restjavad.useextramb true
- /usr/bin/setdb setup.run false
- /usr/bin/setdb tmrouted.tmos.routing enable
- /usr/bin/setdb config.allow.rfc3927 enable
extension_packages:
install_operations:
- extensionType: do
extensionVersion: ${DO_VER}
extensionUrl: ${DO_URL}
- extensionType: as3
extensionVersion: ${AS3_VER}
extensionUrl: ${AS3_URL}
extension_services:
service_operations:
- extensionType: do
type: inline
value:
schemaVersion: 1.0.0
class: Device
async: true
label: Onboard BIG-IP
Common:
class: Tenant
dbVars:
class: DbVariables
restjavad.useextramb: true
provision.extramb: 1024
config.allow.rfc3927: enable
ui.advisory.enabled: true
ui.advisory.color: blue
ui.advisory.text: '{{{ HOST_NAME }}}.${dns_suffix}'
mySystem:
autoPhonehome: true
class: System
hostname: '{{{ HOST_NAME }}}.${dns_suffix}'
'{{{ USER_NAME }}}':
class: User
partitionAccess:
all-partitions:
role: admin
password: '{{{ ADMIN_PASS }}}'
shell: bash
userType: regular
keys:
- '{{{ SSH_KEYS }}}'
myDns:
class: DNS
nameServers:
- '{{{ DNS_SERVER }}}'
- 2001:4860:4860::8844
search:
- f5.com
myNtp:
class: NTP
servers:
- '{{{ NTP_SERVER }}}'
- 1.pool.ntp.org
- 2.pool.ntp.org
timezone: '{{{ TIMEZONE }}}'
myProvisioning:
class: Provision
ltm: nominal
external:
class: VLAN
tag: 4094
mtu: 1500
interfaces:
- name: 1.1
tagged: false
external-localself:
class: SelfIp
address: '{{{ SELF_IP_EXTERNAL }}}/24'
vlan: external
allowService:
- tcp:179
trafficGroup: traffic-group-local-only
internal:
class: VLAN
tag: 4093
mtu: 1500
interfaces:
- name: 1.2
tagged: false
internal-localself:
class: SelfIp
address: '{{{ SELF_IP_INTERNAL }}}/24'
vlan: internal
allowService: default
trafficGroup: traffic-group-local-only
default:
class: Route
gw: '{{{ GATEWAY_EXTERNAL }}}'
network: default
mtu: 1500
post_onboard_enabled:
- name: router_bgp
type: inline
commands:
- tmsh create net routing prefix-list myPrefixList1 { entries add { 10 { action permit prefix 10.0.0.0/8 prefix-len-range 16:32 } } route-domain 0 }
- tmsh create net routing bgp myBGP local-as 65530 peer-group add { Neighbor { address-family { ipv4 { prefix-list { out myPrefixList1 } soft-reconfiguration-inbound enabled } } ebgp-multihop 2 remote-as 65515 } } neighbor add { 10.255.255.4 { peer-group Neighbor } 10.255.255.5 { peer-group Neighbor } } address-family { ipv4 { redistribute add { kernel } aggregate-address add { 10.100.0.0/16 { summary-only enabled } 10.101.0.0/16 { summary-only enabled } 10.102.0.0/16 { summary-only enabled } } } } graceful-restart { restart-time 120 }
- name: create_virtual_server
type: inline
commands:
- tmsh create ltm virtual 10.100.0.0 destination 10.100.0.0:any mask 255.255.0.0
- tmsh create ltm virtual 10.101.0.0 destination 10.101.0.0:any mask 255.255.0.0
- tmsh create ltm virtual 10.102.0.0 destination 10.102.0.0:any mask 255.255.0.0
- name: route_advertise_virtual_servers
type: inline
commands:
- tmsh modify ltm virtual-address all arp disabled icmp-echo disabled route-advertisement selective traffic-group none
- tmsh save sys config
EOF
# Download BIG-IP Runtime Init
for i in {1..30}; do
curl -fv --retry 1 --connect-timeout 5 -L ${INIT_URL} -o "/var/config/rest/downloads/f5-bigip-runtime.gz.run" && break || sleep 10
done
# Remove comment to do silly debugging on BIG-IP Runtime init
# export F5_BIGIP_RUNTIME_INIT_LOG_LEVEL=silly
# export F5_BIGIP_RUNTIME_EXTENSION_INSTALL_DELAY_IN_MS=60000
# Install BIG-IP Runtime Init
bash /var/config/rest/downloads/f5-bigip-runtime.gz.run -- '--cloud azure'
# Run BIG-IP Runtime Init and Process YAML
f5-bigip-runtime-init --config-file /config/cloud/runtime-init-conf.yaml