Infra¶

Overview¶

The Infra custom resource centralizes the underlay network configuration for a BIG-IP Next for Kubernetes (BNK) instance.

Use the Infra CRD to define:

IP Address Management (IPAM) pools for address allocation
Network attachment references to Kubernetes NetworkAttachmentDefinition resources
Virtual Routing and Forwarding (VRF) instances for network isolation
VLAN and VXLAN network definitions
Static routes for specific destination prefixes

The Infra CR also provides the default network configuration for any Gateway that does not explicitly reference a GatewaySettings resource.

Note

Infra is a singleton CR. Only one Infra CR can be deployed in the BNK namespace. Deploying multiple Infra CRs is not supported.

Scope and persona¶

Scope: Namespaced. Must be deployed in the BNK namespace.
Persona: Infrastructure provider or network operator.

API details¶

Property	Value
API group	`gateway.k8s.f5.com`
API version	`v1alpha1`
Kind	`Infra`
Short name	`infra`
Scope	Namespaced

Spec fields¶

The following sections describe every field available under spec.

Required fields¶

The spec requires three top-level sections:

ipams
networkAttachments
networks

ipams¶

Defines IPAM configurations used to allocate IP addresses for VLANs, SNAT pools, and Gateway listener addresses.

Field	Type	Required	Default	Description
`name`	string	Yes	—	Unique name of this IPAM configuration. Max 255 characters. Pattern: `^[0-9a-zA-Z._-]+$`
`infobloxNetview`	string	No	`"default"`	IPAM network view (Infoblox concept). Scopes address allocation to a logical partition.
`ipPools[]`	array	Yes (min 1)	—	Address pools that can be consumed by network references. Max 50 items per IPAM entry.

ipPools¶

Each entry in the ipPools array defines a pool of IP addresses. You must provide either cidr or both rangeStart and rangeEnd; these options are mutually exclusive.

Field	Type	Required	Description
`cidr`	string	Conditional	CIDR notation for the IP pool. Mutually exclusive with `rangeStart`/`rangeEnd`.
`rangeStart`	string	Conditional	Starting IP address for explicit range mode. Must be used with `rangeEnd`.
`rangeEnd`	string	Conditional	Ending IP address for explicit range mode. Must be used with `rangeStart`.
`availabilityZone`	string	No	Availability zone for this IP pool (for example, `us-east-1a`). Used for zone-aware address allocation.

Validation rules:

Either cidr or both rangeStart and rangeEnd must be provided.
cidr and rangeStart/rangeEnd are mutually exclusive.
rangeStart and rangeEnd must be the same IP family (both IPv4 or both IPv6).

Limits: Maximum 256 IPAM entries. Maximum 64 ipPools per IPAM entry.

networkAttachments¶

Defines named groups of Kubernetes NetworkAttachmentDefinition references used by networks.

Field	Type	Required	Description
`name`	string	Yes	Logical name for this network attachment group. Max 255 characters.
`networkAttachmentDefinitions[]`	array	Yes (min 1)	List of NetworkAttachmentDefinition references in this group.

networkAttachmentDefinitions¶

Field	Type	Required	Description
`name`	string	Yes	Name of the Kubernetes NetworkAttachmentDefinition resource. Max 255 characters.

vrfs¶

Defines VRF instances available for network and route binding.

Field	Type	Required	Default	Description
`name`	string	Yes	—	Name of the VRF. Max 255 characters.
`strictIsolation`	boolean	No	`true`	When `true`, prohibits route leaking and shared interfaces.

egressDefaults¶

Defines optional defaults for egress tunnel network configuration. If you omit the subnet, the product uses an internal default subnet.

Field	Type	Required	Default	Description
`subnet`	string	No	`4789` port and `10.0.0.0/16` subnet	Subnet used for egress tunnels. Must be a valid IPv4 CIDR notation.
`port`	integer	No	`4789`	UDP destination port used for VXLAN encapsulation. Valid values: 1–65535.
`networkRef`	object	Yes	—	Reference to a `spec.networks[].name` entry of type VLAN used as the default egress tunnel network context.
`networkRef.name`	string	Yes	—	Name of a `spec.networks` entry. Max 255 characters. Pattern: `^[0-9a-zA-Z._-]+$`

networks¶

Defines VLAN and VXLAN network configurations. Each network entry must specify a type of either vlan or vxlan, and then provide the corresponding settings object.

Field	Type	Required	Description
`name`	string	Yes	Unique name of the network entry. Max 255 characters.
`type`	string	Yes	Network type. Accepted values: `vlan`, `vxlan`.
`vlan`	object	Conditional	VLAN-specific settings. Required when `type` is `vlan`.
`vxlan`	object	Conditional	VXLAN-specific settings. Required when `type` is `vxlan`.

Validation rule: For network type vlan, set vlan only. For type vxlan, set vxlan only.

vlan¶

VLAN-specific settings. Required fields: networkAttachmentRef, ipamRefs.

Field	Type	Required	Default	Description
`tag`	integer	No	`0`	802.1Q VLAN tag. Range: 0–4094. `0` or omitted means an untagged VLAN.
`mtu`	integer	No	`1500`	Maximum Transmission Unit (MTU) for the VLAN interface. Range: 576–9198.
`vrfRef.name`	string	No	—	Reference to a `spec.vrfs[].name` entry for VLAN routing context.
`networkAttachmentRef.name`	string	Yes	—	Reference to a `spec.networkAttachments[].name` entry used by this VLAN network.
`ipamRefs[].name`	string	Yes (min 1)	—	Name of a `spec.ipams[]` entry used for VLAN address allocation.

vxlan¶

VXLAN-specific settings. Required field: vni.

Field	Type	Required	Default	Description
`vni`	integer	Yes	—	VXLAN Network Identifier (VNI). Range: 0–16777215.
`networkRef.name`	string	No	—	Reference to another `spec.networks[].name` entry for underlay network context.
`mtu`	integer	No	`1450`	MTU for VXLAN tunnel traffic. Range: 1280–9000.
`port`	integer	No	`4789`	UDP destination port used for VXLAN encapsulation. Range: 1–65535.
`ipamRefs[].name`	string	No	—	Name of a `spec.ipams[]` entry used for VXLAN self IP address allocation.
`vtepIpamRefs[].name`	string	No	—	Name of a `spec.ipams[]` entry used for VXLAN tunnel endpoint (VTEP) IP address allocation.
`vrfRef.name`	string	No	—	Reference to a `spec.vrfs[].name` entry for VXLAN routing context.

staticRoutes¶

Defines static routes programmed in the selected VRF contexts.

Field	Type	Required	Description
`name`	string	Yes	Unique name of the static route entry. Max 255 characters.
`destination`	string	Yes	Destination prefix in CIDR notation (for example, `0.0.0.0/0` or `2001:db8::/32`).
`nextHop`	string	Conditional	Next-hop IP address. Mutually exclusive with `networkRef`.
`networkRef.name`	string	Conditional	Reference to a `spec.networks[].name` entry for directly connected routes. Mutually exclusive with `nextHop`.
`vrfRef.name`	string	No	Reference to a `spec.vrfs[].name` entry where this route is installed.

Validation rule: Exactly one of nextHop or networkRef must be set.

Status fields¶

The controller populates the status section after reconciliation. All status subsections follow the Gateway API condition structure.

Top-level status¶

Field	Type	Description
`observedGeneration`	integer	Most recent `metadata.generation` observed by the controller.
`conditions[]`	array	Top-level conditions describing the overall state of the Infra resource. Max 8 conditions.

Condition types¶

Type	Description
`Accepted`	The resource is syntactically valid and accepted by the controller.
`ResolvedRefs`	All referenced resources have been resolved.
`Programmed`	The configuration has been sent to TMM.

Each condition includes:

Field	Type	Description
`type`	string	Condition type name.
`status`	string	One of `True`, `False`, or `Unknown`.
`reason`	string	Programmatic identifier for the transition reason.
`message`	string	Human-readable message with details about the transition.
`lastTransitionTime`	date-time	Timestamp of the last status transition.
`observedGeneration`	integer	The generation this condition was set for.

Per-resource status¶

The status section includes sub-status arrays for each resource type defined in spec:

Status section	Description	Max items
`networkAttachments[]`	Status for each network attachment. Keyed by `name`.	64
`networks[]`	Status for each network. Includes `name`, `type`, and `conditions`. Keyed by `name`.	—
`vrfs[]`	Status for each VRF. Keyed by `name`.	64
`staticRoutes[]`	Status for each static route. Includes `name`, `destination`, and `conditions`. Keyed by `name`.	64
`ipams[]`	Status for each IPAM entry. Includes `name`, `infobloxNetview`, per-pool status (with `cidr`, `rangeStart`, `rangeEnd`, `availabilityZone`), and `conditions`. Keyed by `name`.	—
`egressDefaults`	Status for `spec.egressDefaults` entry. Includes `internalVlanTag`, the internal VLAN tag allocated for the egress default network.	4094

Printer columns¶

When you run kubectl get infra, the following columns display:

Column	Source
Programmed	`.status.conditions[?(@.type=="Programmed")].status`
Message	`.status.conditions[?(@.type=="Programmed")].message`
Age	`.metadata.creationTimestamp`

Example¶

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: Infra
metadata:
  name: infra
  namespace: bnk-system
spec:
  # IPAM pools
  ipams:
    - name: client-pool
      infobloxNetview: "default"
      ipPools:
        - cidr: 11.11.11.0/24
    - name: server-pool
      infobloxNetview: "default"
      ipPools:
        - cidr: 22.22.22.0/24
        - cidr: 2002::22:22:22:0/112
    - name: listener-pool
      infobloxNetview: "default"
      ipPools:
        - cidr: 22.22.22.0/24
        - cidr: 2002::22:22:22:0/112

  # Network attachment definitions
  networkAttachments:
    - name: client-attach
      networkAttachmentDefinitions:
        - name: sriov-client-netattach
    - name: server-attach
      networkAttachmentDefinitions:
        - name: sriov-server-netattach

  # Networks
  networks:
    - name: tmm-client
      type: vlan
      vlan:
        tag: 0
        mtu: 1500
        networkAttachmentRef:
          name: client-attach
        ipamRefs:
          - name: client-pool
    - name: tmm-server
      type: vlan
      vlan:
        tag: 0
        mtu: 1500
        networkAttachmentRef:
          name: server-attach
        ipamRefs:
          - name: server-pool

  # Static routes
  staticRoutes:
    - name: default-route
      destination: 0.0.0.0/0
      nextHop: 22.22.22.1

Infra CR deletion¶

After you delete the Infra custom resource, verify that both the IPAM and IPAMRange custom resources have been removed from the BNK namespace before you reapply the custom resource. If you use Infoblox, also confirm that the associated IPs have been released. Ensuring a clean state before you reapply the custom resource prevents unpredictable behavior.