Sample YAML files by use case

This document provides sample YAML files for common BGP routing use cases in F5 BIG-IP Next for Kubernetes (BNK).

Before you begin

Before using these samples, review the BGP routing with Kubernetes CRDs introduction to understand the CRD hierarchy and creation order.

Use case 1: North–south BGP in the default VRF

Route traffic between your Kubernetes workloads and external networks using a single, shared routing domain. No VRF or VXLAN resources are needed.

RoutingTemplate

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingTemplate
metadata:
  name: ns-default-template
spec:
  body: |
    router bgp {{ .global.spec.bgp.startASN }}
    bgp router-id {{ $routerId }}
    {{- range $nbr := .global.spec.bgp.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} remote-as {{ $nbr.remoteAs }}
    {{- end }}
    address-family ipv4 unicast
    {{- range $nbr := .global.spec.bgp.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} activate
    {{- end }}
    exit-address-family
    exit
```

Secret (BGP neighbor authentication)

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: Secret
metadata:
  name: bgp-ns-auth
type: Opaque
stringData:
  slot0: "my-bgp-password"
```

GlobalRoutingConfig

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: GlobalRoutingConfig
metadata:
  name: global-config
spec:
  templateRef:
    name: ns-default-template
  bgp:
    startASN: 65001
    routerIdSubnet: 10.10.10.0
    routerIdPrefix: 24
    neighbors:
      - ip: 198.51.100.10
        remoteAs: 65100
        families: ["ipv4-unicast"]
  neighborSecrets:
    - address: 198.51.100.10
      secretRef:
        name: bgp-ns-auth
        key: slot0
```

Note

No RoutingConfig, Vrf, or Vxlan resources are required. All traffic uses the default route domain (route domain 0).

Use case 2: North–south BGP with tenant VRF isolation

Each tenant gets a dedicated VRF. Traffic stays isolated at the network level. No VXLAN overlay is used — this is for north–south routing with VRF separation.

VRF (one per tenant)

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: Vrf
metadata:
  name: tenant-a
spec:
  strictIsolation: true
---
apiVersion: k8s.f5net.com/v1alpha1
kind: Vrf
metadata:
  name: tenant-b
spec:
  strictIsolation: true
```

RoutingTemplate

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingTemplate
metadata:
  name: ns-vrf-template
spec:
  body: |
    router bgp {{ .global.spec.bgp.startASN }}
    bgp router-id {{ $routerId }}
    {{- range $nbr := .global.spec.bgp.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} remote-as {{ $nbr.remoteAs }}
    {{- end }}
    address-family ipv4 unicast
    {{- range $nbr := .global.spec.bgp.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} activate
    {{- end }}
    exit-address-family
    {{- if .tenant }}
    {{- range $nbr := .tenant.spec.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} remote-as {{ $nbr.remoteAs }}
    {{- end }}
    {{- end }}
    exit
```

GlobalRoutingConfig

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: GlobalRoutingConfig
metadata:
  name: global-config
spec:
  templateRef:
    name: ns-vrf-template
  bgp:
    startASN: 65001
    routerIdSubnet: 10.10.10.0
    routerIdPrefix: 24
    neighbors:
      - ip: 198.51.100.10
        remoteAs: 65100
        families: ["ipv4-unicast"]
```

RoutingConfig (one per tenant, using vrf field)

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingConfig
metadata:
  name: tenant-a-routing
spec:
  templateRef:
    name: ns-vrf-template
  vrf: tenant-a
  neighbors:
    - ip: 198.51.100.20
      remoteAs: 65200
      families: ["ipv4-unicast"]
---
apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingConfig
metadata:
  name: tenant-b-routing
spec:
  templateRef:
    name: ns-vrf-template
  vrf: tenant-b
  neighbors:
    - ip: 198.51.100.30
      remoteAs: 65300
      families: ["ipv4-unicast"]
```

Note

The RoutingConfig uses the vrf field (not vxlanRef) because no VXLAN/EVPN overlay is needed. The vrf and vxlanRef fields are mutually exclusive.

Use case 3: East–west VXLAN/EVPN overlays

Connect workloads across nodes using VXLAN tunnels with EVPN as the control plane. Each tenant gets a VRF, a VXLAN tunnel, and BGP neighbors for EVPN route exchange.

VRF

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: Vrf
metadata:
  name: tenant-a
spec:
  strictIsolation: true
```

Vxlan

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: Vxlan
metadata:
  name: vxlan-tenant-a
spec:
  vlan: f5-vlan-egress
  vrf: tenant-a
  mtu: 1430
  port: 4789
  vni: 10010
  localIpSubnet: "192.168.0.0"
  localIpPrefixLen: 18
  ipv4Subnet: "50.0.0.0"
  ipv4PrefixLen: 18
  evpn: true
```

RoutingTemplate

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingTemplate
metadata:
  name: evpn-overlay-template
spec:
  body: |
    nvo vxlan enable
    nvo vxlan irb

    router bgp {{ .global.spec.bgp.startASN }}
    bgp router-id {{ $routerId }}
    no bgp inbound-route-filter
    {{- range $nbr := .global.spec.bgp.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} remote-as {{ $nbr.remoteAs }}
    neighbor {{ or $nbr.ip $nbr.interface }} ebgp-multihop 255
    neighbor {{ or $nbr.ip $nbr.interface }} update-source lo
    {{- end }}
    address-family ipv4 unicast
    {{- range $nbr := .global.spec.bgp.neighbors }}
    {{- range $fam := $nbr.families }}
    {{- if eq $fam "ipv4-unicast" }}
    neighbor {{ or $nbr.ip $nbr.interface }} activate
    {{- end }}
    {{- end }}
    {{- end }}
    exit-address-family
    address-family l2vpn evpn
    {{- range $nbr := .global.spec.bgp.neighbors }}
    {{- range $fam := $nbr.families }}
    {{- if eq $fam "l2vpn-evpn" }}
    neighbor {{ or $nbr.ip $nbr.interface }} activate
    {{- end }}
    {{- end }}
    {{- end }}
    exit-address-family
    {{- if .tenant }}
    {{- range $nbr := .tenant.spec.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} remote-as {{ $nbr.remoteAs }}
    {{- end }}
    {{- end }}
    exit
```

Secret

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: Secret
metadata:
  name: bgp-evpn-auth
type: Opaque
stringData:
  slot0: "evpn-bgp-password"
```

GlobalRoutingConfig

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: GlobalRoutingConfig
metadata:
  name: global-config
spec:
  templateRef:
    name: evpn-overlay-template
  vxlanRef: vxlan-tenant-a
  bgp:
    startASN: 65001
    endASN: 65002
    routerIdSubnet: 22.22.22.0
    routerIdPrefix: 24
    neighbors:
      - ip: 198.51.100.10
        remoteAs: 65110
        families: ["ipv4-unicast", "l2vpn-evpn"]
  neighborSecrets:
    - address: 198.51.100.10
      secretRef:
        name: bgp-evpn-auth
        key: slot0
```

RoutingConfig (using vxlanRef)

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingConfig
metadata:
  name: tenant-a-routing
spec:
  templateRef:
    name: evpn-overlay-template
  vxlanRef: vxlan-tenant-a
  neighbors:
    - ip: 198.51.100.1
      remoteAs: 65100
      families: ["ipv4-unicast"]
  neighborSecrets:
    - address: 198.51.100.1
      secretRef:
        name: tenant-a-bgp-auth
        key: slot0
```

Use case 4: EVPN-only overlays

Use EVPN as the control plane for VXLAN without additional north–south BGP neighbors at the tenant level. A global BGP configuration is still required to establish EVPN route exchange.

Vrf

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: Vrf
metadata:
  name: tenant-evpn
spec:
  strictIsolation: true
```

Vxlan

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: Vxlan
metadata:
  name: vxlan-evpn-only
spec:
  vlan: f5-vlan-egress
  vrf: tenant-evpn
  mtu: 1430
  port: 4789
  vni: 20010
  localIpSubnet: "192.168.1.0"
  localIpPrefixlen: 18
  ipv4Subnet: "60.0.0.0"
  ipv4PrefixLen: 18
  evpn: true
```

RoutingTemplate

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingTemplate
metadata:
  name: evpn-only-template
spec:
  body: |
    nvo vxlan enable
    nvo vxlan irb

    router bgp {{ .global.spec.bgp.startASN }}
    bgp router-id {{ $routerId }}
    no bgp inbound-route-filter
    {{- range $nbr := .global.spec.bgp.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} remote-as {{ $nbr.remoteAs }}
    neighbor {{ or $nbr.ip $nbr.interface }} ebgp-multihop 255
    neighbor {{ or $nbr.ip $nbr.interface }} update-source lo
    {{- end }}
    address-family l2vpn evpn
    {{- range $nbr := .global.spec.bgp.neighbors }}
    neighbor {{ or $nbr.ip $nbr.interface }} activate
    {{- end }}
    exit-address-family
    exit
```

GlobalRoutingConfig

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: GlobalRoutingConfig
metadata:
  name: global-config
spec:
  templateRef:
    name: evpn-only-template
  vxlanRef: vxlan-evpn-only
  bgp:
    startASN: 65001
    routerIdSubnet: 22.22.22.0
    routerIdPrefix: 24
    neighbors:
      - ip: 100.100.100.200
        remoteAs: 65002
        families: ["l2vpn-evpn"]
```

RoutingConfig (no tenant-specific neighbors)

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingConfig
metadata:
  name: tenant-evpn-routing
spec:
  templateRef:
    name: evpn-only-template
  vxlanRef: vxlan-evpn-only
```

Note

The RoutingConfig has no neighbors because this is an EVPN-only overlay. All EVPN route exchange happens through the global BGP neighbors defined in GlobalRoutingConfig. A RoutingConfig is still required to associate the tenant with its VXLAN/VRF.

Use case 5: BGP Unnumbered for fabric neighborship

Simplify peering by using IPv6 link-local addresses. Neighbors are identified by interface name instead of IP address. The peering VLAN must not have any self IPs assigned.

RoutingTemplate

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: RoutingTemplate
metadata:
  name: unnumbered-template
spec:
  body: |
    nvo vxlan enable
    nvo vxlan irb

    router bgp {{ .global.spec.bgp.startASN }}
    bgp router-id {{ $routerId }}

    {{- range $nbr := .global.spec.bgp.neighbors }}
    {{- $peerId := (or $nbr.ip $nbr.interface) }}
    neighbor {{ $peerId }} remote-as {{ $nbr.remoteAs }}

    {{- range $fam := $nbr.families }}
    {{- if eq $fam "unnumbered-v4" }}
    bgp unnumbered-mode
    neighbor {{ $peerId }} remote-as external
    exit-unnumbered-mode

    address-family ipv4 unicast
    redistribute kernel
    bgp v4-unnumbered-mode
    neighbor {{ $peerId }} activate
    neighbor {{ $peerId }} soft-reconfiguration inbound
    exit-v4-unnumbered-mode
    exit-address-family
    {{- end }}

    {{- if eq $fam "l2vpn-evpn" }}
    address-family l2vpn evpn
    neighbor {{ $peerId }} activate
    exit-address-family
    {{- end }}

    {{- if eq $fam "ipv4-unicast" }}
    address-family ipv4 unicast
    neighbor {{ $peerId }} activate
    exit-address-family
    {{- end }}
    {{- end }}
    {{- end }}

    exit
```

GlobalRoutingConfig (interface-based neighbor)

```yaml
apiVersion: k8s.f5net.com/v1alpha1
kind: GlobalRoutingConfig
metadata:
  name: global-config
spec:
  templateRef:
    name: unnumbered-template
  bgp:
    startASN: 65001
    routerIdSource: "%POD_IP%"
    neighbors:
      - interface: tmm-spine1
        families: ["unnumbered-v4"]
```

Resource creation order

For all use cases, create resources in the following order:

Order

Resource

Required for

1

Secret

All use cases with BGP authentication

2

RoutingTemplate

All use cases

3

Vrf

Use cases 2, 3, 4

4

Vxlan

Use cases 3, 4

5

GlobalRoutingConfig

All use cases

6

RoutingConfig

Use cases 2, 3, 4 (one per tenant)