Configure TMOS DNS Service Integration with Container Ingress Services¶

Overview¶

Use this guide to configure F5 BIG-IP Next for Kubernetes to integrate TMOS DNS services with Container Ingress Services (CIS). This integration lets the CNE Controller automatically push Global Server Load Balancing (GSLB) and WideIP configurations to BIG-IP Next for Kubernetes through Container Ingress Services, whenever infrastructure or application changes occur in your Kubernetes environment.

Before you begin¶

Make sure the following prerequisites are in place:

Obtain the CIS Helm chart by adding the repository with FAR token and pulling the latest chart version.
Container Ingress Services is deployed and has network connectivity to BIG-IP Global Traffic Manager.
BIG-IP Global Traffic Manager is configured and ready to accept Global Server Load Balancing configurations.
Network connectivity exists between the CNE Controller and CIS pods.
Zone-based configuration is enabled in the CNE Controller Settings. The CNE Controller pushes WideIP configurations only when this setting is active.

For example, you can update the zone configuration through the CLOUD_NETWORK_CONFIGMAP on the CNE Controller:

apiVersion: v1
kind: ConfigMap
metadata:
  name: cloud-network-mapping
  namespace: default
  labels:
    app: f5-cne-controller
    component: network-config
data:
  config.yaml: |
    availability_zones:
      - name: "az1"   # Zone Name
        subnets:
          - cidr: "10.155.15.0/24" # Zone prefix
            subnet_id: "subnet-a"
      - name: "az2"
        subnets:
          - cidr: "10.156.16.0/24"
            subnet_id: "subnet-b"
      - name: "az3"
        subnets:
          - cidr: "10.157.17.0/24"
            subnet_id: "subnet-c"

Configure Container Ingress Services for BIG-IP Next for Kubernetes¶

To enable Container Ingress Services to work with BIG-IP Next for Kubernetes, set the --bnk-mode parameter to true.

Container Ingress Services Deployment Parameters¶

Step 1: Create the BIG-IP Credentials Secret¶

Create a Kubernetes secret containing the BIG-IP login credentials:

kubectl create secret generic f5-bigip-ctlr-login --from-literal=username=admin --from-literal=password=<password> --from-literal=url=<url>

Step 2: Configure `values.yaml`¶

Update the following fields in values.yaml to match your environment:

Field	Description
`--bnk-mode`	Set to true to enable BIG-IP Next for Kubernetes mode
`bigip_login_secret: f5-bigip-ctrl-login`	f5-bigip-ctrl-login → This should be same as the secret created above
`issuerRef.name`	Set to the name to appropriate clusterIssuer from the cluster `dev@datkube-devbox:~/cis-testing$ kubectl get clusterissuer` For example, issuerRef: name: default-cert-issuer
`image.pullSecrets []`	add secret for image pull For example, pullSecrets: - secret-name
`namespace`	To install Container Ingress Services in different namespace, modify default to respective namespace In this case, create secret in the same namespace where Container Ingress Services is installed eg: namespace: default

Step 3: Install the Helm Chart¶

Run the following command from within the Helm chart directory:

helm install f5-cis -f values.yaml ./

Step 4: Verify the Installation¶

Check if CIS pods are running:

kubectl get pods | grep cis

Integration Workflow¶

After you enable the integration, the CNE Controller monitors two categories of events and pushes configuration updates to Container Ingress Services automatically:

Infrastructure events — Global Server Load Balancing server (TMM pod) added, removed, or health status changed.
Application events — Gateway API resources created, updated, or deleted.

Event flow¶

The CNE Controller monitors Global Server Load Balancing servers (TMM pods) and Gateway API resources for changes. It maintains the current state of all WideIP configurations.
When the CNE Controller detects a topology change (such as a TMM pod added, removed, or a health status change), it sends the complete Global Server Load Balancing configuration for all Gateway listeners to Container Ingress Services as a single consolidated update. For application lifecycle events on a Gateway resource (create, update, or delete), the CNE Controller sends the GSLB configuration individually per Gateway Custom Resource (CR) to CIS.
Container Ingress Services validates the configuration and converts it to internal data structures for WideIP.
Container Ingress Services applies the validated configuration to BIG-IP Global Traffic Manager through the iControl REST API.