F5BigGlobalOptions

Overwiew

The F5BigGlobalOptions CRD enables you to define multiple different behaviours at the global level (Traffic Management Microkernel (TMM)) on the BlueField-3 (BF3) Data Processing Unit (DPU) using Data Center Operations and Communications Acceleration (DOCA) APIs. These APIs provide secure, high-speed encryption and decryption. The BlueField-3 DPU employs the Advanced Encryption Standard-Galois/Counter Mode (AES-GCM) engine to enhance performance and security for traffic management operations.

CR Parameters

metadata

Parameter	Description
name	The unique name identifying the resource (Kubernetes object name). Example: global-options.
namespace	The Kubernetes namespace in which the resource is created.

---

spec

Parameter	Type	Description	Default
crypto	object	Crypto configuration used to enable/disable hardware acceleration.	{}
crypto.hwAccel	boolean	Enable/disable crypto hardware acceleration.	true
dnscache	object	DNS Cache options at the global level.	{}
dnscache.matchWildcardVip	boolean	Allows Unbound backend resolution to match a wildcard VIP (0.0.0.0/0 or ::/0) that uses SNAT pool source-address-translation; intended to allow SNATing of backend resolutions.	false
firewall	object	Global firewall behaviors (e.g., default action for unmatched traffic, logging, hardware offload).	{ defaultAction: "", defaultActionLog: true, hardwareOffload: true }
firewall.defaultAction	string	Default action for traffic not matching any firewall rule in Secure Context or Gateway. Allowed values: "", accept, reject, drop.	""
firewall.defaultActionLog	boolean	Whether an HSL message should be generated when applying defaultAction.	true
firewall.hardwareOffload	boolean	Enable/disable hardware offloading of firewall rules when supported by the platform.	true
ip	object	Global IP behaviors such as accepting IPv4 options.	{}
ip.acceptIpOptions	boolean	Whether IP options are accepted globally.	false
tcpOptimization	object	Global TCP optimization settings (initial congestion window behavior and adaptive buffer auto-tuning).	{}
tcpOptimization.autoTuning	object	Adaptive TCP buffer growth parameters controlling min/max limits, growth cadence, and responsiveness.	{}
tcpOptimization.autoTuning.autoNagleRttThreshold	integer (int64)	RTT threshold (ms) used to automatically adjust delayed send (Nagle-related) behavior. Range: 0–200.	20
tcpOptimization.autoTuning.proxyBufMax	integer (int64)	Maximum proxy buffer size (bytes) limiting adaptive growth. Range: 1048576–4194304.	2097152
tcpOptimization.autoTuning.proxyBufMin	integer (int64)	Minimum proxy buffer size (bytes) before adaptive scaling. Range: 4096–1048576.	65535
tcpOptimization.autoTuning.proxyBufOffset	integer (int64)	Offset added to computed proxy buffer size (bytes) for headroom. Range: 4096–1048576.	65535
tcpOptimization.autoTuning.recvBufBDPMultiplier	integer (int64)	Multiplier applied to bandwidth-delay product when targeting receive buffer size. Range: 1–10.	1
tcpOptimization.autoTuning.recvBufIncr	integer (int64)	Increment (bytes) used when growing receive buffer during tuning cycles. Range: 4096–1048576.	65536
tcpOptimization.autoTuning.recvBufMax	integer (int64)	Maximum receive buffer size (bytes) per connection during tuning. Range: 4194304–16777216.	16777216
tcpOptimization.autoTuning.recvBufMin	integer (int64)	Minimum receive buffer size (bytes) before adaptive growth decisions. Range: 4096–1048576.	65535
tcpOptimization.autoTuning.recvBufMinInterval	integer (int64)	Minimum interval (ms) between attempts to enlarge receive buffer. Range: 10–65535.	100
tcpOptimization.autoTuning.sendBufBDPMultiplier	integer (int64)	Multiplier applied to bandwidth-delay product when targeting send buffer size. Range: 1–10.	1
tcpOptimization.autoTuning.sendBufIncr	integer (int64)	Increment (bytes) used when growing send buffer during tuning cycles. Range: 4096–1048576.	65536
tcpOptimization.autoTuning.sendBufMax	integer (int64)	Maximum send buffer size (bytes) per connection during tuning. Range: 1048576–16777216.	16777216
tcpOptimization.autoTuning.sendBufMin	integer (int64)	Minimum send buffer size (bytes) before adaptive growth decisions. Range: 4096–1048576.	131070
tcpOptimization.autoTuning.sendBufMinInterval	integer (int64)	Minimum interval (ms) between attempts to enlarge send buffer. Range: 10–65535.	100
tcpOptimization.initWindowAfterXon	boolean	Enables use of optimized initial congestion window after XON flow resumption.	true
tcpOptimization.initWindowMultiplierAfterXon	integer (int64)	Multiplier applied to baseline initial congestion window after XON to scale recovery aggressiveness. Range: 1–100.	1

F5BigGlobalOptions CR Example

apiVersion: k8s.f5net.com/v1
kind: F5BigGlobalOptions
metadata:
  name: global-options
  namespace: f5-bnk
spec:
  crypto:
    hwAccel: false
  firewall:
    defaultAction: accept
    defaultActionLog: true
    hardwareOffload: true

Disabling Crypto Hardware Acceleration on the BlueField-3 DPU

Follow the steps below to disable crypto hardware acceleration on the BlueField-3 DPU:

1. Copy the F5BigGlobalOptions example CR below to a YAML file. Set the crypto.hwAccel parameter to false and save:

    apiVersion: k8s.f5net.com/v1
    kind: F5BigGlobalOptions
    metadata:
      name: global-options
      namespace: f5-bnk
    spec:
      crypto:
        hwAccel: false
   

2. Apply the F5BigGlobalOptions CR that you have created:

   kubectl apply -f f5-global-options.yaml
   

The crypto hardware acceleration is now disabled on the BlueField-3 DPU, and a software-based codec will be enabled.

Enabling Crypto Hardware Acceleration on the BlueField-3 DPU

Prerequisites:

To enable crypto hardware acceleration on the BlueField-3 Data Processing Unit (DPU), ensure you have the following:

1. A BlueField-3 DPU must have a crypto-capable device.

2. A Scalable Function (SF) must be created on the BlueField-3 DPU.

Follow the steps below to enable ‌crypto hardware acceleration on the BlueField-3 DPU:

1. Copy the F5BigGlobalOptions example CR below to a YAML file. Set the crypto.hwAccel parameter to true and save:

    apiVersion: k8s.f5net.com/v1
    kind: F5BigGlobalOptions
    metadata:
      name: global-options
      namespace: f5-bnk
    spec:
      crypto:
        hwAccel: true
   

2. Apply the F5BigGlobalOptions CR that you have created:

   kubectl apply -f f5-global-options.yaml
   

The crypto hardware acceleration is now enabled on the BlueField-3 DPU, and a software-based codec will be disabled.

Enabling/Disabling ACL HW offload on the BlueField-3 DPU

Note

ACL HW Offload is enabled by default.

1. To disable the ACL HW Offload, set the firewall.hardwareOffload parameter to false and save:

    apiVersion: k8s.f5net.com/v1
    kind: F5BigGlobalOptions
    metadata:
      name: global-options
      namespace: f5-bnk
    spec:
      firewall:
        defaultAction: accept
        defaultActionLog: true
        hardwareOffload: false
   

2. Apply the F5BigGlobalOptions CR that you have created:

   kubectl apply -f f5-global-options.yaml
   

The hardware acceleration is now disabled on the BlueField-3 DPU.

Note

To enable the ACL HW Offload, set the firewall.hardwareOffload parameter to true and apply CR. ACL HW Offload works only for the rules with drop action configured in F5BigFwPolicy CR.