How to Use BIG-IQ and Ansible to Build Advanced BIG-IP Automation Workflows

It’s no secret that automation of networking, security, and application development processes offers a laundry list of benefits—reduced deployment time, lowered cost, fewer errors, and more resilient systems, to name a few. One of the most popular tools for building automation workflows is Ansible. Ansible is a powerful, open-source tool that simplifies and automates many common tasks and enables infrastructure as code for creating, deploying, and managing F5 application delivery and security services. This is accomplished through playbooks and roles available on Ansible Galaxy.

Another way to streamline working with BIG-IP is with BIG-IQ Centralized Management. BIG-IQ combines deep, app-centric visibility and dashboarding together with device, configuration, and policy management in a unified, intuitive user interface. From BIG-IQ, you can create new BIG-IP Virtual Editions (VEs), provision them with Declarative Onboarding, create advanced AS3 services, move deployments, upgrade software, and much more.

Together Ansible and BIG-IQ make automation and management of your BIG-IP environment simple and straightforward—enabling an effective, intuitive, data-rich, and highly visual solution that offers value to networking/F5 gurus, security practitioners, and application owners/developers alike.

To make things even easier, the F5 team has developed several community-supported Ansible roles that are designed to inject automation into workflows and make BIG-IQ’s simple app-centric management functionality even better.

Please note that this workflow assumes that you already have a BIG-IQ Centralized Management deployment up and running. The end result will be a fully provisioned BIG-IP deployment that can be fully managed—client-to-server visibility, troubleshooting, object level configuration, etc.—from BIG-IQ’s intuitive, role-specific GUI. You can get started with these roles and workflows today by checking out F5’s repository on Ansible Galaxy. To use these Ansible roles and playbooks, you’ll need to download and install them to a local workstation that will be used for managing F5 deployments.

Use the Ansible roles for BIG-IQ below to:

• Create new VEs
• Onboard VEs with DO
• Create and deploy common objects such as SSL certs and WAF policies
• Create AS3 application delivery and security services
• Move deployments across BIG-IPs

 

For additional how-to-use resources, guidance, and labs for BIG-IQ, check out the video library and the BIG-IQ labs.

Create a BIG-IP VE in AWS

 tasks:

   - name: Create a VE in AWS

     include_role:

       name: f5devcentral.bigiq_create_ve

     vars:

       cloud_environment: "BIG-IQ AWS US-East"

       ve_name: "bigipvm01"

     register: status

 

   - name: Get AWS BIG-IP VE IP address (port 8443)

     debug:

       msg: "{{ ve_ip_address }}"

 

   - name: Get AWS BIG-IP VE private Key Filename

     debug:

       msg: "{{ private_key_filename }}"

Onboard the New BIG-IP VE with Declarative Onboarding

tasks:

   - name: Onboard BIG-IP VE with DO

     include_role:

       name: f5devcentral.atc_deploy

     vars:

       atc_service: Device

       atc_method: POST

       atc_declaration: "{{ lookup('template','do_bigip_aws.j2') }}"

       atc_delay: 30

 atc_retries: 15

     register: atc_DO_status

 

do_bigip_aws.j2:

{

   "class": "DO",

   "declaration": {

       "schemaVersion": "1.5.0",

       "class": "Device",

       "async": true,

       "Common": {

             "class": "Tenant",

             "myLicense": {

               "class": "License",

               "licenseType": "licensePool",

               "licensePool": "byol-pool",

               "bigIpUsername": "admin",

               "bigIpPassword": "secret"

             },

             "myProvision": {

               "class": "Provision",

               "ltm": "nominal",

               "avr": "nominal"

             },

             "myNtp": {

               "class": "NTP",

               "servers": [

                   "169.254.169.123"

               ],

               "timezone": "UTC"

             },

             "admin": {

               "class": "User",

               "shell": "bash",

               "userType": "regular",

               "partitionAccess": {

                   "all-partitions": {

                         "role": "admin"

                   }

               },

               "password": "secret"

             },

             "hostname": "bigipvm01.example.com"

       }

   },

   "targetUsername": "admin",

   "targetHost": "{{ ve_ip_address }}",

   "targetPort": 8443,

   "targetSshKey": {

       "path": "{{ private_key_filename }}"

   },

   "bigIqSettings": {

       "conflictPolicy": "USE_BIGIQ",

       "deviceConflictPolicy": "USE_BIGIP",

       "failImportOnConflict": false,

       "versionedConflictPolicy": "KEEP_VERSION",

       "statsConfig": {

         "enabled": true

     }

   }

}

Create SSL Certificate and Key on BIG-IQ

 tasks:

   - name: Authenticate to BIG-IQ

     uri:

       url: https://{{ provider.server }}:{{ provider.server_port }}/mgmt/shared/authn/login

       method: POST

       headers:

         Content-Type: application/json

       body:

         username: "{{ provider.user }}"

         password: "{{ provider.password }}"

         loginProviderName: "{{ provider.auth_provider | default('tmos') }}"

       body_format: json

       timeout: 60

       status_code: 200, 202

       validate_certs: "{{ provider.validate_certs }}"

     register: auth

 

   - name: Create SSL Certificate and Key on BIG-IQ

     uri:

       url: https://{{ provider.server }}:{{ provider.server_port }}/mgmt/cm/adc-core/tasks/certificate-management

       method: POST

       headers:

         Content-Type: application/json

         X-F5-Auth-Token: "{{ auth.json.token.token }}"

       body: |

         {

             "issuer": "Self",

             "itemName": "mywebapp.crt",

             "itemPartition": "Common",

             "durationInDays": 365,

             "country": "US",

             "commonName": "mywebapp.example.com ",

             "division": "MyDiv",

             "organization": "MyOrg",

             "locality": "Seattle",

             "state": "WA",

             "subjectAlternativeName": "DNS: mywebapp.example.com",

             "securityType": "normal",

             "keyType": "RSA",

             "keySize": 2048,

             "command": "GENERATE_CERT"

         }

       body_format: json

       timeout: 60

       status_code: 200, 202

       validate_certs: "{{ provider.validate_certs }}"

     register: json_response

Pin and Deploy SSL Certificates and Key to BIG-IP

 tasks:

   - name: Pin and deploy SSL certificate and key to BIG-IP

     include_role:

       name: f5devcentral.bigiq_pinning_deploy_objects

     vars:

       bigiq_task_name: "Deployment through Ansible/API - mywebapp"

       modules:

         - name: ltm

           pins:

             - { type: "sslCertReferences", name: "mywebapp.crt" }

             - { type: "sslKeyReferences", name: "mywebapp.key" }

       device_address: "{{ ve_ip_address }}"

     register: status

Deploy an AS3 Service to BIG-IP

 tasks:

   - name: Deploy AS3 application services to BIG-IP

     include_role:

       name: f5devcentral.atc_deploy

     vars:

       atc_service: AS3

       atc_method: POST

       atc_declaration: "{{ lookup('template','as3_bigiq_https_app.j2') }}"

       atc_delay: 30

       atc_retries: 15

     register: atc_AS3_status

 

as3_bigiq_https_app.j2:

{

   "class": "AS3",

   "action": "deploy",

   "declaration": {

       "class": "ADC",

       "schemaVersion": "3.12.0",

       "target": {

           "address": "{{ ve_ip_address }}"

       },

       "myorg": {

           "class": "Tenant",

           "mywebapp": {

               "class": "Application",

               "schemaOverlay": "AS3-F5-HTTPS-offload-lb-existing-cert-template-big-iq-default-v1",

               "template": "https",

               "serviceMain": {

                   "class": "Service_HTTPS",

                   "pool": "Pool",

                   "enable": true,

                   "serverTLS": "TLS_Server",

                   "virtualPort": 443,

                   "profileAnalytics": {

                       "use": "Analytics_Profile"

                   },

                   "virtualAddresses": [

                       "0.0.0.0"

                   ]

               },

               "Pool": {

                   "class": "Pool",

                   "members": [

                       {

                           "adminState": "enable",

                           "servicePort": 80,

                           "serverAddresses": 10.1.3.23

                       }

                   ]

               },

               "TLS_Server": {

                   "class": "TLS_Server",

                   "certificates": [

                       {

                           "certificate": "Certificate"

                       }

                   ]

               },

               "Certificate": {

                   "class": "Certificate",

                   "privateKey": {

                       "bigip": "/Common/mywebapp.key"

                   },

                   "certificate": {

                       "bigip": "/Common/mywebapp.crt"

                   }

               },

               "Analytics_Profile": {

                   "class": "Analytics_Profile",

                   "collectIp": false,

                   "collectGeo": false,

                   "collectUrl": false,

                   "collectMethod": false,

                   "collectUserAgent": false,

                   "collectOsAndBrowser": false,

                   "collectPageLoadTime": false,

                   "collectResponseCode": true,

                   "collectClientSideStatistics": true

               }

           }

       }

   }

}

 

 

Move an AS3 Service Within BIG-IQ Dashboard

tasks:

   - name: Move an AS3 application service in BIG-IQ dashboard.

     include_role:

       name: f5devcentral.bigiq_move_app_dashboard

     vars:

         apps:

         - name: myWebApp

           pins:

             - name: "myorg_mywebapp"

     register: status