F5BigCneIrule

The F5BigCneIrule Custom Resource (CR) enables F5’s powerful iRules feature. iRules significantly extends the capabilities of the Traffic Management Microkernel (TMM) Proxy Pod in processing application traffic. You can add the iRule in the F5BigCneIrule CR, and then that can be attached to a NetPolicy. For iRule syntax or supported events, see iRules Home.

Specification

The spec parameters used to configure the F5BigCneIrule CR are:

Parameter	Description	Default
iRule	Specifies the iRule script which allows customization and extends the functionality of the BIG-IP system. This enable advanced traffic management, manipulations, and decision-making capabilities that exceed those offered by Custom Resource Objects. For iRule syntax or supported events, see iRules Home.	""

Sample F5BigCneIrule Manifest

apiVersion: k8s.f5net.com/v1
kind: F5BigCneIrule
metadata:
  name: irule-one
  namespace: gatewayns
spec:
  iRule: |
    when HTTP_RESPONSE {
      log local0.debug "Client IP Apps address"
      if { [HTTP::header exists "Content-Disposition"] } {
        log local0.debug "Client IP Apps address log2"
      }
    }

Sample output:

kubectl create -f irule.yaml
f5bigcneirule.k8s.f5net.com/irule-one created

kubectl get -f irule.yaml
NAME        READY   MESSAGE                                AGE
irule-one   True    CR config sent to all grpc endpoints   3m37s

kubectl get f5-big-cne-irules -n myappns
NAME        READY   MESSAGE                                AGE
irule-one   True    CR config sent to all grpc endpoints   17m

F5 iRules in Gateway API

F5 iRules are a powerful and flexible feature that allows you to customize and control network traffic. In Big-IP Next for Kubernetes, the significant use of iRule is extended to the Gateway API to improve the user experience. An adapter layer (NetPolicy) was introduced and developed in accordance with the Gateway Enhancement Proposal (GEP: 2648). This layer is designed to protect the system, simplify complex policies, and incorporate other important features. This will enable iRules (F5BigCneIrule) to be applied at the Gateway level, affecting all listeners, or at the listener level, targeting a specific listener.

Gateway resources can be configured to attach F5 iRules. This page shows how the Gateway API supports ‌iRules. The iRules are attached to Gateway API objects via NetPolicy by configuring the targetRefs and extensionRefs sections. The F5 Controller handles the iRules configured using Gateway API objects.

For more details, refer to

• F5 Lifecycle Operator

• Gateway API

NetPolicy

The NetPolicy CR supports general extensions. Refer to NetPolicy for additional details.

Sample NetPolicy CR

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: NetPolicy
metadata:
  name: my-test-netpolicy
  namespace: gatewayns
spec:
  extensionRefs:
  - kind: F5BigCneIrule
    name: irule-one
    group: k8s.f5net.com
  targetRefs:
  - kind: Gateway
    name: my-l4route-tcp-gateway
    group: gateway.networking.k8s.io
    sectionName: "l4-nginx-tcp"

Attaching iRules to a Gateway

You can now attach iRules to gateway level. This ensures that the iRule is applied to all the traffic that flows via gateway.

Applying Gateway, iRules, and NetPolicy CR

• Create and apply the Gateway .yaml file.

• Create and apply the F5BigCneIrule .yaml files.

• Create and apply NetPolicy .yaml file.

Note:

• Make sure that Gateway, NetPolicy, and the associated iRule (F5BigCneIrule) are in the same namespace.

• Make sure that GatewayClass and Gateway CRs are applied.

• The required CRs can be applied in any order.

• It is not required to mention the namespace in the kubectl command if the namespace is included in the CR.

Deleting Gateway, iRules, and NetPolicy CR

• Delete the required CR using kubectl delete command from the namespace.

kubectl delete -f my-resource.yaml

For example

kubectl delete -f my-f5bigcneirule.yaml

Note: When the BIG-IP Next for Kubernetes Net policy is deleted, iRule will not be applied to any traffic.