This directory contains the Terraform module to create BIG-IP™ VPC Gen2 instances using variable input from the user.

Use this template to create BIG-IP™ Virtual Edition instances using imported customer VPC images using Terraform or IBM Cloud Schematics. Schematics uses Terraform as the infrastructure-as-code engine. With this template, you can create and manage infrastructure as a single unit as follows. For more information about how to use this template, see the IBM Cloud Schematics documentation.

This template requires that the F5 TMOS™ qcow2 images be patched including the IBM VPC Gen2 cloudinit config and the full complement of tmos-cloudinit modules. The template also requires the f5-declarative-onboarding AT extension version 1.16.0 or greater be included in the patched image.

This Schematics template submits cloudinit user-data which utilizes the F5 Declarative Onboarding extension. Documentation for this extension can be found at:

F5 Cloud Documentation for the F5 Declarative Onboarding Extension

In addition to installing and utilizing the Declarative Onboarding extension, the image onboarding process also installs recent versions of the F5 Application Services 3 and Telemetry Streaming extensions. Documentation of these extensions, and the use of their control plane API endpoints, can be found at:

F5 Cloud Documentation for the F5 Application Services 3 Extension

F5 Cloud Documentation for the F5 Telemetry Services Extension

Once the BIG-IP™ Virtual Edition instance is onboarded through Schematics and the F5 Declarative Onboarding Extension, the extension endpoints can be utilized to orchestrate L4-L7 services and logging, creating a fully functional and declarative ADC. Multiple VNFs can be provisioned using the BIG-IP™ Virtual Edition with declared services.

You're provided free technical support through the IBM Cloud™ community and Stack Overflow, which you can access from the Support Center. The level of support that you select determines the severity that you can assign to support cases and your level of access to the tools available in the Support Center. Choose a Basic, Advanced, or Premium support plan to customize your IBM Cloud™ support experience for your business needs.

Learn more: https://www.ibm.com/cloud/support

• Have access to Gen 2 VPC.
• The given VPC must have at least one subnet with one IP address unassigned (up to 5 are supported)
• The BIG-IP™ image name is the name of a custom VPC image in your region. To import a public F5 BIG-IP image see: BIG-IP public image importer.
• This template uses F5 Automation and Orchestration declaration URL downloads. This is a new feature in tmos-cloudinit. You must be using custom VPC images which are patched with the latest version of tmos-cloudinit modules.

They are supported in the following regions:

• us-south
• us-east
• eu-de
• eu-gb
• eu-es
• jp-tok
• jp-osa
• au-syd
• ca-tor
• br-sao

User variable: tmos_image_name

Values:

• Your VPC custom image name

If your regional custom image has the same name as the public image, your custom image will be used.

By default, if no declaration URLs are supplied, the BIG-IP™ Virtual Edition instances created with this template will not be licensed nor have anything but default provisioning performed. To license and declare resources and services, supply declaration URLs to download your F5 Automation and Orchestration declarations in JSON format.

For information on creating custom images for IBM cloud see TMOS Cloudinit

The user should create an SSH key in the IBM cloud region. The SSH key name should be included as a user variable.

User Variable: ssh_key_name

Once the image completes onboarding, SSH access to the root user is available on the defined management Floating IP.

The user should also provide an admin user password.

User Variable: tmos_admin_password

If no tmos_admin_password is provided, a randomized lengthy password will be set. The user can then access the device via SSH authorized key and set the admin password by using passwd admin.

Currently, IBM terraform resources do not provide the ability to obtain VPC subnets by their name. The user will have to know the subnet UUID as input variables.

At least one VPC subnet must be defined:

User Variable: management_subnet_id

If only the management_subnet_id id is defined, the BIG-IP™ will be created as a 1NIC instance. The management UI and APIs can then be reached on port 8443 instead of the standard 443.

Up to five network interfaces can be added to a IBM VPC instnace. If you define additional subnet IDs, these will be mapped to BIG-IP™ data interfaces starting with interface 1.1

User Variables:

cluster_subnet_id intenral_subnet_id external_subnet_id do_declaration_url as3_declaration_url ts_declaration_url

When onboarding is complete, including optional licensing and network interface provisioning, the BIG-IP™ can issue an HTTP(s) POST request to an URL specified by the user.

User Variables:

phone_home_url

The POST body will be JSON encoded and supply basic instance information:

{
    "status": "SUCCESS",
    "product": "BIG-IP",
    "version": "15.1.2.0.0.9",
    "hostname": "f5-test-ve-01.local",
    "id": "27096838-e85f-11ea-ac1c-feff0b2c5217",
    "management": "10.243.0.7/24",
    "installed_extensions": ["f5-service-discovery", "f5-declarative-onboarding", "f5-appsvcs", "f5-telemetry", "f5-appsvcs-templates"],
    "do_enabled": true,
    "as3_enabled": false,
    "ts_enabled": false,
    "metadata": {
        "template_source": "/f5devcentral/ibmcloud_schematics_bigip_multinic/tree/master",
        "template_version": 20200825,
        "zone": "eu-de-1",
        "vpc": "r010-e27c516a-22ff-41f5-96b8-e8ea833fd39f",
        "app_id": "undefined"
    }
}

The user can optionally define an app_id variable to tie this instnace for reference.

User Variables:

app_id

Once onboarding is complete, the user can than access the TMOS™ Web UI, use iControl™ REST API endpoints, or utilize the F5 BIG-IP™ Extensibility Extensions installed.

When you apply the template, the infrastructure resources that you create incur charges as follows. To clean up the resources, you can delete your Schematics workspace or your instance. Removing the workspace or the instance cannot be undone. Make sure that you back up any data that you must keep before you start the deletion process.

*VPC: VPC charges are incurred for the infrastructure resources within the VPC, as well as network traffic for internet data transfer. For more information, see Pricing for VPC.

Before you can apply the template in IBM Cloud, complete the following steps.

1. Ensure that you have the following permissions in IBM Cloud Identity and Access Management:
   • Manager service access role for IBM Cloud Schematics
   • Operator platform role for VPC Infrastructure
2. Ensure the following resources exist in your VPC Gen 2 environment
   • VPC
   • SSH Key
   • VPC with multiple subnets

Create a schematics workspace and provide the github repository url (https://github.com/f5devcentral/ibmcloud_schematics_bigip_multinic/tree/master) under settings to pull the latest code, so that you can set up your deployment variables from the Create page. Once the template is applied, IBM Cloud Schematics provisions the resources based on the values that were specified for the deployment variables.

Fill in the following values, based on the steps that you completed before you began.

Fill in the following values, based on the steps that you completed before you began.

If there is any failure during VPC instance creation, the created resources must be destroyed before attempting to instantiate again. To destroy resources go to Schematics -> Workspaces -> [Your Workspace] -> Actions -> Delete to delete all associated resources.

1. From the VPC list, confirm the F5 BIG-IP™ Virtual Edition is powered ON with green button
2. From the CLI, run ssh root@<Management IP>.
3. Enter 'yes' for continue connecting using ssh your key. This is the ssh key value, you specified in ssh_key variable.
4. Use the tmsh shell.

Alternatively, the F5 Declarative Onboading, F5 Application Service 3, and F5 Telemetry Streaming service endpoints are available at:

https://<Management IP>/mgmt/shared/declarative-onboarding
https://<Management IP>/mgmt/shared/appsvcs
https://<Management IP>/mgmt/shared/telemetry

These endpoints provide declarative orchestration of multiple NFV functions including L4-L7 ADC funcationality, network firewalls, web application firewalls, and DNS services.

Troubleshoot and validate declarations by checking the:

/var/log/restnoded/restnoded.log

on the F5 BIG-IP™ Virtual Edition instance.