f5networks/f5-ipam-ctlr

Repository for the F5 IPAM Controller

F5 IPAM Controller

This GitHub repository has been archived and is read-only. This project is no longer actively maintained.

The F5 IPAM Controller interfaces with an IPAM system to allocate IP addresses for host names in an orchestration environment.

The controller currently supports the following environments:

Orchestrations:

Kubernetes/OpenShift

IPAM systems:

Infoblox

Documentation

For instruction on how to use this component, see the docs for F5 IPAM Controller.

Running

The official docker image is f5networks/f5-ipam-ctlr.

Usually, the controller is deployed in an orchestration environment. However, the controller can be run locally for development testing.

docker run f5networks/f5-ipam-ctlr /app/bin/f5-ipam-ctlr <args>

Building

The official images are built using docker, but the adventurous can use standard go build tools.

Official Build

Prerequisites:

• Docker

git clone https://github.com/f5networks/f5-ipam-ctlr.git
cd  f5-ipam-ctlr

# Use docker to build the release artifacts, into a local "_docker_workspace" directory, then put into docker images
# Alpine image
make prod

OR

# RHEL7 image
make prod BASE_OS=rhel7

Alternate, unofficial build

A normal go and godep toolchain can be used as well

Prerequisites:

• go 1.9.4
• $GOPATH pointing at a valid go workspace
• godep (Only needed to modify vendor's packages)

mkdir -p $GOPATH/src/github.com/F5Networks
cd $GOPATH/src/github.com/F5Networks
git clone https://github.com/f5networks/f5-ipam-ctlr.git
cd f5-ipam-ctlr

# Build all packages, and run unit tests
make all test

To make changes to vendor dependencies, see Devel

f5-ipam-ctlr's Issues

Add beta notice

Description

The initial release will be a beta release. The docs README needs a banner informing customers of the beta status.

Orchestration Name and Version

Controller Version

v1.0.0-beta

IPAM System and Version

Diagnostic Information

<Configuration files, error messages, logs>
Note: Sanitize the data. For example, be mindful of IPs, ports, application names and URLs

Create only A records

Description

Look into best practices (most efficient) for creating multiple DNS records for names pointing to the same IP address. There has been recent discussions criticizing the IPAM controller's method. Research if CNAME records or multiple A (AAAA) has a clear superiority and/or best practice.

Orchestration Name and Version

n/a

Controller Version

beta version

IPAM System and Version

n/a

Diagnostic Information

<Configuration files, error messages, logs>
Note: Sanitize the data. For example, be mindful of IPs, ports, application names and URLs

Need a verify-interval for Infoblox

Description

If a record is removed or an IP address is released in Infoblox, the controller needs to know about it. Currently, the controller's internal store will only be updated via what comes from the orchestration. There should be some verify-interval (30 seconds) in which the controller pings Infoblox to ensure the records match what they should be.

Orchestration Name and Version

Kubernetes 1.8

Controller Version

0.1

IPAM System and Version

Infoblox

Stream data from orchestration to controller

Description

Rather than passing a pointer to the IPGroups through the channel from orchestration to controller, there should be a stream of events (creates/updates/deletes) only. This allows for passing copied data (so we don't share memory) in small enough pieces where memory usage isn't very high.

The orchestration can then send some "steady state" signal to the controller to inform it that all objects have been processed, and the controller can move forward with its processing. The controller will simply receive the stream and build up its data structure until it receives the ready signal.

Orchestration Name and Version

Kubernetes 1.8

Controller Version

0.1

IPAM System and Version

Infoblox

Support more than one Infoblox View

Description

The controller assumes that the Network and DNS views will always be the same. This is not true at my company as the nextavailableip call needs to go against the Network view however most DNS calls need to go against an Internal view.

Orchestration Name and Version

kubernetes 1.11

Controller Version

v0.1.0

IPAM System and Version

Infoblox 2.7 API

Nothing happens if host is deleted from multi-service Ingress

Description

If a host is completely removed from a multi-service Ingress, this update is not picked up by the controller. The controller should see this change and properly remove the host from the IPGroups.

Orchestration Name and Version

Kubernetes 1.8

Controller Version

0.1

IPAM System and Version

Infoblox

[DOC] Update the RBAC example

Description

The RBAC example doesn't match the format currently used in the Kubernetes docs. This needs to be updated.

See https://kubernetes.io/docs/admin/authorization/rbac/#service-account-permissions for examples.

Orchestration Name and Version

K8s

Controller Version

IPAM System and Version

N/A

Diagnostic Information

<Configuration files, error messages, logs>
Note: Sanitize the data. For example, be mindful of IPs, ports, application names and URLs
N/A

Controller should only manage records it creates

Description

The controller will currently manage all records in Infoblox. This means that any records a user creates on their own will be wiped out by the controller, since they weren't created by the controller. The controller should use the Extensible Attributes to tag DNS records with an F5 identifier, and only manage resources with this EA.

Orchestration Name and Version

Kubernetes 1.8

Controller Version

0.1

IPAM System and Version

Infoblox

Zones with more than 1000 records fail

Description

Any time a zone has more than 1000 records the controller blows up and is unable to process requests for that zone. This has to do with the infoblox go library not supporting pagination and infloblox default of returning an error when more than 1000 results are returned.

A way to filter the DNS zones you care about would also be helpful as it took over 2 hours to scan the few thousand zones we have. I had to hand add the _max_results flag to your code to get it so "work" with the large number of zones we have. I only care to have this controller manage a few of them.

Orchestration Name and Version

kubernetes 1.11

Controller Version

v0.1.0

IPAM System and Version

Infoblox 2.7 API

Filter zones f5-ipam-cltr manages

Description

Provide a way to filter zones the controller will manage. We have thousands of dns zones and only want the controller to touch a few of them. We can manage some of this with permissions so the user ipam connects as does not have access to all zones however sub zones are an issue. If I want to manage zone kube.example.com I need to give read access to zone example.com which means the controller will read in all stuff in example.com when it does not need to.

Orchestration Name and Version

kubernetes 1.11

Controller Version

v0.1.0

IPAM System and Version

Infoblox 2.7 API

[DOC] Set up deployment to staging & production

Description

I need to set up this project to publish docs to the staging and production websites.

• add acct in AWS
• add secure vars to travis config
• add updated deploy script

Controller Version

IPAM System and Version

N/A

Diagnostic Information

<Configuration files, error messages, logs>
Note: Sanitize the data. For example, be mindful of IPs, ports, application names and URLs
N/A

Document all extended attributes

Description

Please document all of the extended attributes needed so that they can be created by infoblox admins. We do not want the controller to be a full admin which is required to create extended attributes. Your code also only seems to make a single attribute however 4-6 others where required.

Orchestration Name and Version

kubernetes 1.11

Controller Version

v0.1.0

IPAM System and Version

Infoblox 2.7 API