Skip to content

Prepare a Kubernetes cluster

You’ll need a Kubernetes cluster to run the Controller. You can use KIND to get a local cluster for testing, or run against a remote cluster.

Note: The Controller can run

  • As a standalone program with local kubeconfig file(by default: ~/.kube/config), or
  • In In-Cluster mode, then, specified ServiceAccount and ClusterRole/ClusterRoleBinding are required, see here

Kubernetes CNI Setup

To make BIG-IP as the Gateway for the business traffic, we need to setup both K8S and BIG-IP’s networks for different CNI types.

The relavent network setup of BIG-IP side is handled by Controller automatically when the controller is started. Here, we only focus on configuring networks of Kubernetes side manually.

For different CNIs, we have different configuration steps as following.


In flannel network mode, we need to create a BIG-IP virtual node to connect the BIG-IP node as a virtual node of the Kubernetes cluster.

In the following configuration sample, we use:

  • BIG-IP traffic IP(Flannel VXLAN SelfIP):
  • BIG-IP traffic Mac(Flannel VXLAN Tunnel MAC): fa:16:3e:d5:28:07 (see below for the way to get it)
  • podCIDR(BIGIP Flannel Subnet): (see below for how to determine it)

-> Create and edit the following yaml configuration file bigip1.yaml:


apiVersion: v1
kind: Node
  name: bigip1
    # Replace IP with Self-IP for your deployment ""
    # uncomment the following line if using v6 tunnel and modify bigip v6 address
    # "2021:15::125"
    # Replace MAC with your BIGIP Flannel VXLAN Tunnel MAC '{"VtepMAC":"fa:16:3e:d5:28:07"}'
    # uncomment the following line if using v6 tunnel and modify mac accordingly
    # '{"VtepMAC":"fa:16:3e:d5:28:07"}' "vxlan" "true"
  # Replace Subnet with your BIGIP Flannel Subnet
  podCIDR: ""
  # uncomment the following 3 lines if using v6 tunnel and modify CIDRs using real data
  #- ""
  #- "2021:118:2:2::/64"

The mac address VtepMAC can be obtained using the TMSH command on BIG-IP:

$ show net tunnels tunnel fl-tunnel all-properties

$ show net tunnels tunnel fl-tunnel6 all-properties

The pod CIDR podCIDR varies and should not be duplicated with the kubernetes cluster's pod CIDRs, see it by: kubectl get node -o yaml | grep podCIDR

-> Execute kubectl apply -f bigip1.yaml command to create the above virtual node.

In Calico mode

In calico mode, we need to peer BIG-IP(s) as the BGP neighbors of Kubernetes nodes.

In the following configuration sample, we use:

  • AS(Autonomous System): 64512
  • BIG-IP traffic IP:

On master node,

-> Run the command to get calicoctl command line:

$ curl -O -L`
$ chmod +x calicoctl
$ sudo mv calicoctl /usr/local/bin

-> Edit /etc/calico/calico.ctl.cfg file

$ sudo mkdir /etc/calico
$ vim /etc/calico/calicoctl.cfg


kind: CalicoAPIConfig
  datastoreType: "kubernetes"
  kubeconfig: "/root/.kube/config"    # change to actual kubeconfig path

-> Run calicoctl get nodes to verify calicoctl runtime works OK.

-> Run the following command to create BGP Group:

cat << EOF | calicoctl create -f -
kind: BGPConfiguration
  name: default
  logSeverityScreen: Info
  nodeToNodeMeshEnabled: true
  asNumber: 64512

-> Run the following command to create BIG-IP peer for the kubernetes cluster.

Notes: Change the peerIP to actual BIG-IP traffic IP(the selfIP for data traffic).

cat << EOF | calicoctl create -f -
kind: BGPPeer
    name: bgppeer-bigip1
  asNumber: 64512

-> After the configuration, we can use calicoctl node status command to check the BIG-IP peer status:

$ calicoctl node status
Calico process is running.

IPv4 BGP status
| PEER ADDRESS  |     PEER TYPE     | STATE |  SINCE   |    INFO     |
| | node-to-node mesh | up    | 03:07:33 | Established |
| | global            | up    | 06:18:28 | Established |

More references, see

Last update: April 12, 2023 22:28:42
Created: February 6, 2023 16:16:03