High-speed logging in Gateway API

Gateway resources can be configured to attach F5-specific High-Speed Log (HSL) profiles. This allows you to configure High-Speed Logging for events like applying a firewall rule.

This section shows how the Gateway API supports ‌HSL log profiles. The policy is attached to Gateway API objects via SecPolicy by configuring the targetRefs and extensionRefs sections. The F5 Controller handles the log profiles configured using Gateway API objects.

For more details, refer to

HSL log profile

The F5BigLogProfile Custom Resource (CR) is used to specify traffic processing events that the Traffic Management Microkernel (TMM) should capture, and send to one or more remote logging servers. The F5BigLogProfile specifically handles events that occur when TMM is processing traffic with any of the Protection BIG-IP Next for Kubernetes CRs. The F5BigLogHslpub CR specifies the remote logging destination IP address and service port, as well as the logging format. The F5BigLogHslpub CR should be configured and installed first, and then referenced in the F5BigLogProfile CR configuration.

You can now attach a High-Speed Logging (HSL) profile to the Gateway Class. This feature enables centralized or standardized logging of ACL (Access Control List) events both in the global context and within individual Virtual Servers.

SecPolicy

The SecPolicy CR supports general extensions. Refer to SecPolicy for additional details.

Sample SecPolicy CR

This YAML configuration defines a custom resource of kind SecPolicy, which specifies security policies to be applied to targeted Gateway resources using the F5 controller.

This resource attaches a F5BigLogPolicy named logprofile1 to:

  • The Gateway mygw in the namespace gatewayns.

  • Specifically, the listener section myhttp2 on the Gateway.

SecPolicyCR

apiVersion: "gateway.k8s.f5.com/v1"
kind: SecPolicy
metadata:
  name: mySecPolicy
  namespace: gatewayns
spec:
  extensionRefs:
  - kind: F5BigLogProfile
    name: logprofile1
    group: k8s.f5net.com
  targetRefs:
  - kind: Gateway
    name: mygw
    group: gateway.networking.k8s.io
    sectionName: "myhttp2"

This table summarizes the roles and relationships of CRs.

CR

Description

Scope

GatewayClass

Defines the controller responsible for managing gateways.

Can manage multiple Gateways and associates with one SecPolicy.

Gateway

Manages external traffic and routes it through multiple Listeners or applies SecPolicies for security.

Can associate one SecPolicy with multiple Listeners in a Gateway.

Gateway Listener

Specifies port, protocol, and traffic routing configuration for the Gateway.

Can associate one SecPolicy with specific Listeners.

SecPolicy

Applies security policies to Gateways or Listeners and bridges them with log profiles.

Can integrate one F5BigLogProfile with one Gateway or multiple Gateways/Listeners.

F5BigLogProfile

Defines detailed logging policy.

Can associate with multiple SecPolicies.

Applying Gateway, SecPolicy and F5BigLogProfile CR

  • Apply the CR files using kubectl apply command in the specific namespace.

kubectl apply -n <namespace> -f <filename>.yaml

For example

kubectl apply -n appns-1 -f my-f5biglogprofile.yaml

Note:

  • To apply a CR in GatewayClass the namespace must be the cluster namespace.

  • To apply a CR in Gateway or Listener the namespace must be the application namespace.

Deleting Gateway, SecPolicy and F5BigLogProfile CR

  • Delete the CR files using kubectl delete command in the specific namespace.

kubectl delete -n <namespace> -f <filename>.yaml

For example

kubectl delete -n appns-1 -f my-f5biglogprofile.yaml

Editing Gateway, SecPolicy and F5BigLogProfile CR

  • Delete the CR.

  • Modify the .yaml file for the specific CR.

  • Apply the CR.

Use cases

The use cases are defined based on the scope of the HSL log profile.

  • Global HSL log profile

  • Listener-Specific HSL log profile

  • Gateway-Wide HSL log profile

| Use case | Log profile type | Target | Target reference fields in SecPolicy | Log profile attachment | | :————— | :————— | :————— | :————— | | Global HSL log profile | Global Context | GatewayClass | name field: Specifies the GatewayClass name.
sectionName field: Not applicable. | Log profile is attached to the Global Context in all TMMs (Traffic Management Microkernel) within the cluster. | | Listener-specific HSL log profile | Listener-Specific Context | Gateway Listener | name field: Specifies the Gateway name.
sectionName field: Specifies the Listener name within the Gateway (e.g., http, https). | Log profile is attached to the ingress Virtual Servers corresponding to the specified Gateway Listener. | | Gateway-wide HSL log profile | Gateway-Wide Context | Entire Gateway | name field: Specifies the Gateway name.
sectionName field: No specific section is targeted if this field is empty. | Log profile is attached to ingress and egress Virtual Servers corresponding to the Gateway, except ingress Virtual Servers with listener-specific log profiles. |

Using SecPolicy, you can attach ‌targets with specific namespace requirements for each scenario. Each scenario ensures namespace consistency and proper resource scoping to prevent cross-namespace violations or misconfigurations.

GatewayClass: When the SecPolicy is attached to a GatewayClass, both the SecPolicy and F5BigLogProfile custom resources (CRs) must be created in the Controller’s namespace.

Gateway: When the SecPolicy is attached to a Gateway, both the SecPolicy and F5BigLogProfile CRs must be created in the same namespace as the Gateway CR.

Gateway Listener (a section in the Gateway CR): When the SecPolicy is attached to a specific section of a Gateway (referred to as a Gateway Listener), both the SecPolicy and F5BigLogProfile CRs must be created in the same namespace as the Gateway CR.

Global HSL log profile

This section provides sample YAML files to configure Kubernetes Gateway with HSL log profile. This allows you to attach the HSL log profile to the Global Context in all TMMs in the cluster.

GatewayClass:

  • Defines a custom GatewayClass named my-gateway-class.

  • Links to the F5 BIG-IP Controller (f5.com/controller-ns-f5-cne-controller).

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: my-gateway-class
spec:
  controllerName: f5.com/controller-ns-f5-cne-controller
  description: F5 BIG-IP Kubernetes Gateway

SecPolicy:

  • Creates SecPolicy named mySecPolicy in the controller-ns namespace.

  • Associates a log profile (logprofile1) with the my-gateway-class.

  • Targets the entire GatewayClass for logging.

apiVersion: "gateway.k8s.f5.com/v1"
kind: SecPolicy
metadata:
  name: mySecPolicy
  namespace: controller-namespace  # Must be in controller namespace for GatewayClass
spec:
  extensionRefs:
  - kind: F5BigLogProfile
    name: logprofile1
    group: k8s.f5net.com
  targetRefs:
  - kind: GatewayClass
    name: my-gateway-class
    group: gateway.networking.k8s.io

F5BigFwPolicy:

  • Creates a HSL Log profile logprofile1 in the controller-ns namespace.

apiVersion: k8s.f5net.com/v1
kind: F5BigLogProfile
metadata:
  name: logprofile1
  namespace: controller-ns
spec:
  rule:
  - action: accept
    destination:
      addresses:
      - 0.0.0.0/0
      ports:
      - '8000'
    ipProtocol: tcp
    logging: true
    name: tcp-acceptmy-logprofile
    source:
      addresses:
      - 0.0.0.0/0

Listener-specific HSL log profile

This section has a sample YAML file to set up a listener-specific HSL log profile. You do this by attaching a F5BigLogProfile to a Gateway Listener through a SecPolicy.

SecPolicy:

  • Attaches SecPolicy named mySecPolicy to the myhttp2 section of mygw.

  • References a HSL log profile (logprofile1) for the myhttp2 listener.

apiVersion: "gateway.k8s.f5.com/v1"
kind: SecPolicy
metadata:
  name: mySecPolicy
  namespace: gateway-namespace  # Must be in same namespace as Gateway
spec:
  extensionRefs:
  - kind: F5BigLogProfile
    name: logprofile1
    group: k8s.f5net.com
  targetRefs:
  - kind: Gateway
    name: mygw
    group: gateway.networking.k8s.io
    sectionName: "myhttp2"  # Specify the listener name

Gateway-wide HSL log profile

This section has sample YAML files to set up a HSL log profile for the entire gateway. You can do this by attaching a F5BigLogProfile to the entire Gateway through a SecPolicy. These example CRs illustrate how a SecPolicy CR can be used to integrate a F5BigLogProfile CR to the Listeners that are defined in the Gateway CR.

GatewayClass:

  • Defines a custom GatewayClass named my-gateway-class.

  • Links to the F5 BIG-IP Controller (f5.com/controller-ns-f5-cne-controller).

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: my-gateway-class
spec:
  controllerName: f5.com/controller-ns-f5-cne-controller
  description: F5 BIG-IP Kubernetes Gateway

Gateway

  • Creates a Gateway resource named my-gw in the app-ns-1 namespace.

  • Manages external traffic bound to the IP address 22.22.22.2.

  • Configures two listeners (Listener 1 (http) and Listener 2 (http2))

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-gw
  namespace: gateway-namespace
spec:
  addresses:
  - type: IPAddress
    value: 22.22.22.2
  gatewayClassName: my-gatewayclass
  listeners:
  - allowedRoutes:
      kinds:
      - kind: HTTPRoute
    name: http
    port: 8000
    protocol: HTTP
  - allowedRoutes:
      kinds:
      - kind: HTTPRoute
    name: http2
    port: 8001
    protocol: HTTP

SecPolicy:

  • Creates SecPolicy named mySecPolicy in the controller-ns namespace.

  • Associates a log profile (logprofile1) with mygw.

  • Targets the entire GatewayClass for logging.

apiVersion: "gateway.k8s.f5.com/v1"
kind: SecPolicy
metadata:
  name: mySecPolicy
  namespace: gateway-namespace  # Must be in same namespace as Gateway
spec:
  extensionRefs:
  - kind: F5BigLogProfile
    name: logprofile1
    group: k8s.f5net.com
  targetRefs:
  - kind: Gateway
    name: mygw
    group: gateway.networking.k8s.io
    # No sectionName specified for gateway-wide profile

F5BigLogProfile (HSL Log Profile)

  • Creates a HSL log profile named logprofile1.

  • Enables logging to monitor traffic that matches the rule.

  • Enforces security for all traffic handled by the mygw.

apiVersion: k8s.f5net.com/v1
kind: F5BigFwPolicy
metadata:
  name: logprofile1
  namespace: gateway-namespace
spec:
  rule:
  - action: accept
    destination:
      addresses:
      - 0.0.0.0/0
      ports:
      - '8000'
    ipProtocol: tcp
    logging: true
    source:
      addresses:

Sample statistics

This section provides sample commands and output for TMSTL statistics.

Sample commands

#FLO - tmm is daemonset: kubectl exec -it daemonsets/f5-tmm -c debug -- bash

Sample output

f5-tmm-9cmv6
 
virtual_server_stat table
name                                                   clientside.pkts_in clientside.pkts_out serverside.pkts_out serverside.pkts_in
------------------------------------------------------ ------------------ ------------------- ------------------- ------------------
gwapi-demo-tcp-gateway-192.168.10.239-demo-listener-vs                 80                  40                  80                 40
gwapi-demo-tcp-gateway-fe03:10::239-demo-listener-vs                   20                   2                   8                  0
 
 
 
fw_rule_stat table
context_type context_name                                           rule_name                                   micro_rules counter hw_counter last_hit_time action
------------ ------------------------------------------------------ ------------------------------------------- ----------- ------- ---------- ------------- ------
virtual      gwapi-demo-tcp-gateway-192.168.10.239-demo-listener-vs rule-ingress-tcp-gateway-firewallpolicyrule           2      40          0    1742430496      2
virtual      gwapi-demo-tcp-gateway-fe03:10::239-demo-listener-vs   rule-ingress-tcp-gateway-firewallpolicyrule           2       2          0    1742430490      2

Sample HSL log example

Mar 20 23:27:18 11.11.11.201 1 2025-03-20T23:27:18.278437+00:00 f5-tmm-tvbcq tmm 23 23003137 [F5@12276 acl_policy_name="default-policy1-firewallpolicy" acl_policy_type="Enforced" acl_rule_name="rule-tcp-accept-firewallpolicyrule" acl_rule_uuid="" action="Accept" hostname="f5-tmm-tvbcq" bigip_mgmt_ip="10.244.99.83" context_name="global-context" context_type="Global" date_time="Mar 20 2025 23:27:17" dest_fqdn="unknown" dest_ip="44.44.44.1" dst_geo="No-lookup" dest_port="8050" device_product="Advanced Firewall Module" device_vendor="F5" device_version="10.14.0+0.1.5" drop_reason="" errdefs_msgno="23003137" errdefs_msg_name="Network Event" flow_id="0000000000000000" ip_protocol="TCP" severity="8" partition_name="" route_domain="0" sa_translation_pool="" sa_translation_type="" source_fqdn="unknown" source_ip="11.11.11.1" src_geo="No-lookup" source_port="5000" source_user="unknown" source_user_group="unknown" translated_dest_ip="" translated_dest_port="" translated_ip_protocol="" translated_route_domain="" translated_source_ip="" translated_source_port="" translated_vlan="" vlan="client-1001" send_to_vs="" src_zone="" dest_zone="" dest_vlan="eth0" source_ipint_categories="No-lookup" dest_ipint_categories="No-lookup"] "10.244.99.83","f5-tmm-tvbcq","Global","global-context","No-lookup","11.11.11.1","No-lookup","44.44.44.1","5000","8050","client-1001","TCP","0","","","","","","","","Enforced","default-policy1-firewallpolicy","rule-tcp-accept-firewallpolicyrule","","Accept","","","","0000000000000000","unknown","unknown","unknown","unknown","","","","eth0","No-lookup","No-lookup"