​

Deploy Secure Mesh Site v2 with Azure Kubernetes Service (ClickOps)

Published November 8, 2026 | Last modified November 9, 2026

Overview

Use F5 Distributed Cloud Console to deploy a Distributed Cloud Customer Edge (CE) with Azure Kubernetes Service (AKS) as the provider.

Important: This guide doesn't provide instructions on how to deploy an F5 App Stack Site.

About this provider

This is early access (EA) functionality and can be used for proof-of-concept (PoC) or proof-of-value (PoV) deployments. The functionality will be made generally available (GA) over the next couple of releases. Reach out to your account representative for more information.

Plan your deployment

Read the following documents before you deploy a Secure Mesh Site in any provider environment:

Before you begin

Before you begin, make sure you have:

  • A Distributed Cloud account. If you don't have an account, see Get Started with Distributed Cloud Console.

  • Resources required per node: Minimum 8 vCPUs, 32 GB RAM, and 80 GB disk storage. For a full listing of the resources required, see the Customer Edge Site Sizing Reference guide. All the nodes in a given CE Site should have the same compute, memory, and disk storage resources. When you deploy in cloud environments, these nodes should use the same instance flavor.

  • Customer Edge (CE) deployments require connectivity to F5 Distributed Cloud. See the F5 Customer Edge IP Address and Domain Reference for Firewall or Proxy Settings guide for the list of IP addresses and domain names that need to be allowed.

  • F5 assumes that an existing IPv4 subnet exists with Internet connectivity to attach to the node.

  • The new Secure Mesh Site workflow enables you to have up to eight interfaces. These interfaces must be in different subnets. Make sure you have the required subnets available before creating the CE Site nodes.

  • To deploy the CE site with High Availability (HA) enabled, you must open the Internet Control Message Protocol (ICMP) between the CE nodes on the Site Local Outside (SLO) interfaces. This is needed to ensure intra-cluster communication checks.

  • An AKS cluster with virtual machines running.

  • Enabled AVX (Advanced Vector Extensions) on hardware where your CEs are deployed if you're using F5 Distributed Cloud WAF. If you don't enable AVX, you can't use the AI features for F5 Distributed Cloud WAF.

Important: After you deploy the CE Site, you can't change the SLO IP address or the MAC address.

Feature gaps from other providers

The following features aren't supported:

  • Segment virtual routing and forwarding (VRF)
  • Common virtual IP address (VIP)
  • DC Cluster Group (DC-CG)
  • Enhanced Firewall policy (EFP)
  • Static route configuration
  • Virtual Router Redundancy Protocol (VRRP) mode
  • SLI Site-to-Site connectivity
  • Jumbo frames
  • Node-by-node upgrades
  • Management network
  • Horizontal scaling
  • Vertical scaling

Configuration overview

To create a Secure Mesh Site for AKS:

  • Site object configuration: Create and configure a Secure Mesh Site object using Distributed Cloud Console.
  • Node deployment prerequisites: Create objects that are associated with the CE nodes, including security groups, SSH key pairs, and more.
  • Node management: Use Download Manifests deployment method to create the CE nodes. Each CE node is a virtual machine (VM).

Important: If you make changes to the custom proxy server or node selector configurations for running nodes, you must download the manifest file again and re-apply it.

Create site object

Step 1: Create object.

  • Create a secure mesh site object in Distributed Cloud Console. Refer to the Create Secure Mesh Site guide.

  • Set the Provider Name option to Microsoft AKS (EA).

Step 2: Set node deployment size.

From the Deployment Size list, select Medium or Large. You must select the same size for each node that deploys in your CE Site.

Step 3: Set node selector label.

If you have more than three nodes in your Kubernetes configuration, you should add node selectors to the CE Site configuration so that pods don't move to other nodes during restarts or upgrades.

Under Node Selector Labels, select Add Label. Select a label or add a new key. Add the label to each node deployed for your CE Site.

Step 4: Set pod anti-affinity option.

From the Pod Anti-Affinity list, select Enable or Disable.

Step 5: Set HA option.

For High Availability, choose an option. If it's Disabled, then the CE Site only supports one node. If it's Enabled, the CE Site requires three nodes. You can only add additional nodes to your CE when the High Availability option is set to Enabled.

Important: You can't change the High Availability option after the CE Site is created.

Step 6: Complete and save configuration.

  • Leave the other options with default values. These options have intelligent default values and do not need further configuration. See the Create Secure Mesh Site guide for more information on these options.

  • Select Add Secure Mesh Site.

Step 7: Download manifest.

Under the list of sites, select Actions and then select Download Manifest for your site object.

Step 8: Apply manifest.

In a terminal, enter kubectl apply -f <downloaded-manifest>.yml.

Important: If you make changes to the Site configuration after you apply the manifest and before registration, you must re-apply the manifest file and perform a rollout restart of VPM.

Verify CE site registration

After you deploy your nodes, they automatically register as a CE Site in Distributed Cloud Console. The registration process isn't quick.

In Distributed Cloud Console, the status changes from Waiting for Registration to Provisioning to Online. Wait a few minutes for the registration process to begin.

  • In Distributed Cloud Console, go to Multi-Cloud Network Connect > Overview > Infrastructure > Sites.

  • Select your CE Site.

  • Confirm that the Dashboard tab shows the System Health of 100% as well as Data Plane and Control Plane both Up.

Note: For more information, see the Customer Edge Registration and Upgrade Reference guide.

Next steps

See the following documentation for additional CE Site operations:

  • To monitor your CE Site, see the Monitor Site guide.
  • To manage your CE Site software updates, see the Manage Site guide.
  • For the latest on Distributed Cloud Services releases, see Changelogs.
  • To view the various types of events generated, see the Events Reference guide.

Add a load balancer with CE deployment

Optionally, set up a load balancer with your CE deployment:

References

For more information, see:

On this page: