Configure tenant traffic settings with GatewaySettings

Overview

The GatewaySettings Custom Resource (CR) configures tenant-specific traffic settings for Gateway and EgressGateway resources. Use GatewaySettings to define Source NAT (SNAT) pools, ingress listener networks, and egress traffic paths. GatewaySettings references IPAM pools and networks defined in the Infra CR, which keeps infrastructure concerns centralized and separate from tenant configuration.

Before you begin

Make sure you have the following:

  • An Infra CR is deployed and shows Programmed: True in its status conditions.

  • You know the names of the IPAM pools, networks, and VRFs defined in the Infra CR that this tenant needs to reference.

  • You have the required permissions to create resources in the target namespace.

  • You know the SNAT requirements for your deployment:

    • Automap — automatic SNAT address mapping (default)

    • None — no SNAT

    • Pool — a specific SNAT pool with IPAM-allocated addresses

    • UseIngressAddress — use the ingress path source address for egress SNAT (egress only)

Create the GatewaySettings CR

  1. Define Source NAT pools (optional).

    If you need deterministic SNAT addresses (rather than Automap), define one or more Source NAT pools. The pool addresses are auto-generated by IPAM from the pools defined in the Infra CR.

    spec:
  sourceNATPools:
    - name: ingress-snat
      ipamRefs:
        - name: server-pool
      shared: false
    - name: egress-snat
      ipamRefs:
        - name: server-pool
      vrfRef:
        name: tenant-a-vrf
      shared: false

    Note

    • Set shared to true if you need SNAT address sharing across multiple TMMs.

    • Use vrfRef to scope the SNAT pool to a specific VRF. If omitted, the default VRF is used.

    • Skip this step if you only need Automap or None SNAT behavior.

  1. Configure ingress settings.

The ingressConfig section defines how the tenant handles incoming traffic. At a minimum, specify IPAM references for listener address allocation.

Minimal ingress (IPAM-based listener addresses with Automap SNAT):

spec:
  ingressConfig:
    defaultListenerNetwork:
      ipamRefs:
        - name: listener-pool
      sourceNATConfig:
        type: Automap

Routed ingress (with specific network context and deterministic SNAT):

spec:
  ingressConfig:
    defaultListenerNetwork:
      ipamRefs:
        - name: listener-pool
      networkRefs:
        - name: tmm-client
      vrfRef:
        name: tenant-a-vrf
      sourceNATConfig:
        type: Pool
        sourceNATPoolRef:
          name: ingress-snat

Note

  • networkRefs[] specifies which Infra networks provide the VLAN/VRF/StaticRoute topology for listener programming. The controller resolves these references and uses those networks’ contexts.

  • vrfRef scopes the listener to a specific VRF. If omitted, the default VRF is used.

  • When sourceNATConfig.type is Pool, you must provide sourceNATPoolRef referencing a pool defined in sourceNATPools. When the type is Automap or None, do not set sourceNATPoolRef.

Skip this step if you need egress-only functionality.

  1. Configure egress settings.

The egressConfigs section defines one or more named egress configurations for outgoing traffic. Each entry requires a name and a SNAT configuration.

Simple egress (Automap SNAT):

spec:
  egressConfigs:
    - name: default-egress
      sourceNATConfig:
        type: Automap

Egress with a specific network path and SNAT pool:

spec:
  egressConfigs:
    - name: tenant-a-egress
      networkRef:
        name: tmm-server
      vrfRef:
        name: tenant-a-vrf
      sourceNATConfig:
        type: Pool
        sourceNATPoolRef:
          name: egress-snat
      hardwareAcceleration: none

Note

  • The name field is important — it is referenced by the sectionName field in EgressGateway CRs to bind a specific egress configuration to an egress gateway.

  • Set hardwareAcceleration to full, assisted, or dedicated based on your platform’s Packet Velocity ASIC (PVA) support. The default is none.

  • Use UseIngressAddress as the sourceNATConfig.type when you want egress traffic to use the same source address as the ingress path.

Skip this step if you need ingress-only functionality.

  1. Apply the GatewaySettings CR

Save the complete GatewaySettings CR to a YAML file and apply it in the same namespace where you will deploy your Gateway or EgressGateway:

kubectl apply -f gatewaysettings.yaml -n f5-gateways

Important

GatewaySettings must be deployed in the same namespace as the Gateway or EgressGateway that references it.

Verify the configuration

Check that the controller accepted the GatewaySettings CR:

kubectl get gatewaysettings -n f5-gateways

The output should show Accepted and ResolvedRefs as True:

NAME                  ACCEPTED   RESOLVEDREFS   AGE
my-gateway-settings   True       True           15s

For detailed status, inspect the CR:

kubectl describe gatewaysettings my-gateway-settings -n f5-gateways

Review the following:

Status section

What to check

Top-level conditions

Accepted and ResolvedRefs should both be True.

ingressConfig

Verify allocatedListenerAddresses shows the IP addresses allocated by IPAM. Check conditions for any errors.

egressConfigs

Check conditions for each named egress configuration.

sourceNATPools

Check allocatedIPCount to confirm addresses were allocated. Check conditions for errors.

If any condition shows False or Unknown, check the message and reason fields. Common reasons include:

  • DependencyMissing — a referenced Infra resource (IPAM pool, network, VRF) does not exist. Verify the names match the Infra CR.

  • UserError — the spec is invalid. Check field values and required fields.

Complete example

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: GatewaySettings
metadata:
name: my-gateway-settings
namespace: f5-gateways
spec:
sourceNATPools:
  - name: egress-snat
    ipamRefs:
      - name: server-pool
    shared: false

ingressConfig:
  defaultListenerNetwork:
    ipamRefs:
      - name: listener-pool
    sourceNATConfig:
      type: Automap

egressConfigs:
  - name: default-egress
    networkRef:
      name: tmm-server
    sourceNATConfig:
      type: Pool
      sourceNATPoolRef:
        name: egress-snat

Reference