Software Secure Workload
Activity Configure

Deployment

Deployment
Figure 1: Deployment

Consider the following deployment where load balancer VIPs, SNIPs, and HIPs are part of the lb scope, and BEs are part of the be scope. Scopes are created as follows.

  • Client

    The client scope includes clients communicating with the load balancer. For the example above, the client scope query is as follows:

    address eq 192.168.60.21 or address eq 192.168.60.22
    
  • lb

    The F5 external orchestrator labels VIPs, SNIPs, HIPs, and BEs used by the load balancer. These labels can be used to construct scope queries, where orchestrator_system/service_name is used for selecting VIPs, orchestrator_system/service_startpoint SNIPs, and orchestrator_system/service_healthcheck_startpoint HIPs for the service. For the example above, a scope query that includes VIPs, SNIPs, and HIPs for service db is as follows:

    user_orchestrator_system/cluster_id eq 1234 and
    (user_orchestrator_system/service_name eq db or
    user_orchestrator_system/service_startpoint eq db or
    user_orchestrator_system/service_healthcheck_startpoint eq db)
    

 

It is required that SNIPs and VIPs be part of the same scope.

  • Be

    user_orchestrator_system/service_endpoint selects BEs for a service. For the example above, a scope query that includes BEs for service db is as follows:

    user_orchestrator_system/cluster_id eq 1234 and
    user_orchestrator_system/service_endpoint eq db