Policy Enforcement for F5 Ingress Controller
Secure Workload enforces policies both at the F5 BIG-IP load balancer and at the backend pods when the pods are exposed to the external clients using Kubernetes ingress object.
Following are the steps to enforce the policy using the F5 ingress controller.
Procedure
| 1 |
Create an external orchestrator for F5 BIG-IP load balancer as described earlier. |
| 2 |
Create an external orchestrator for Kubernetes/OpenShift as described here. 
|
| 3 |
Create an ingress object in the Kubernetes cluster. A snapshot of the yaml file used to create the ingress object is provided in the following picture. 
|
| 4 |
Deploy an F5 ingress controller pod in the Kubernetes cluster. 
|
| 5 |
Create a backend service, which is accessed by the consumers outside the cluster. In the example provided below we have created a nginx service. 
|
| 6 |
Create a policy between external consumer and backend service. Enforce the policy using Policy Enforcement tab. 
|
| 7 |
Check the policies on F5 BIG-IP load balancer and backend pods. In case of F5 load balancer Secure Workload will apply the appropriate allow/drop rule where the source will be the consumer specified in step 6 and the destination will be VIP [VIP for the ingress virtual service for F5]. In case of backend pods, Secure Workload will apply the appropriate allow/drop rule where the source will the SNIP [in case SNAT pool is enabled] or F5 IP [auto map enabled] and destination will be backend pod IP. 
|