Deploy an application with GTM¶

Overview¶

You provide: Gateway CR (with GTM annotations) + HTTPRoute CR

Important

GTM is supported only when using the BNK Gateway resources, which are available only if you specified that you want to use Gateway API during installation of F5 BIG-IP Cloud-Native Edition.

GTM is not supported when using the BNK Legacy resources.

BNK automatically creates: Virtual Servers on TMM + WideIP/Pools/Virtual Servers on GTM + VPC static routes

Important

Key rules:

WideIPs are created only for Gateway listener hostname fields. Never for HTTPRoute hostnames or certificate SANs.
HTTPRoute hostnames are for TMM-side Host header filtering only (no GTM impact).
GTM Data Servers are auto-created by BNK (1 per cluster + AZ). See scale discussion after Section 4.
The ONLY manual GTM prerequisite is the GSLB Datacenter object (one-time).

Prerequisites (Platform Team, One-Time)¶

On GTM: create datacenter¶

# On each GTM instance (one-time):
tmsh create gtm datacenter example-dc1

Data Server (auto-created by BNK)¶

BNK auto-creates Data Server objects on GTM (1 per cluster + AZ). No manual action needed.

# BNK auto-creates Data Servers. No manual step needed.
# Example of what BNK creates:
#   server_bdee68ed..._example-prod_10.1.0.0  (Zone A)
#   server_bdee68ed..._example-prod_10.2.0.0  (Zone B)
#   server_bdee68ed..._example-prod_10.3.0.0  (Zone C)

In cluster: ExternalBigIPRegistry CR¶

apiVersion: k8s.f5.com/v1
kind: ExternalBigIPRegistry
metadata:
  name: bigip-config
  namespace: f5-bnk
spec:
  fallbackLoadBalancingMode: "fallback-ip"
  availabilityZones:
    - name: "eu-de-1"
    - name: "eu-de-2"
    - name: "eu-de-3"
      # Set disabled: true to remove zone's pool members during maintenance
  dnsReplicaSets:
    - name: dns-set-1
      dnsSuffix: "gslb1.corp.net" # moved from annotation to here
      bigipEndpoints:
        - bigipMgmtURL: https://gtm-1.example.net
          bigipLoginSecret: gtm-1-credentials
          certSecret: gtm-1-trusted-cert
        - bigipMgmtURL: https://gtm-2.example.net
          bigipLoginSecret: gtm-2-credentials
        - bigipMgmtURL: https://gtm-3.example.net
          bigipLoginSecret: gtm-3-credentials

In cluster: GatewaySettings + Infra CR (IPAM pools per zone)¶

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: GatewaySettings
metadata:
  name: gw-settings-common
  namespace: app1-ns
spec:
  ingressConfig:
    defaultListenerNetwork:
      ipamRefs:
        - name: vip-listener-ipam
---
apiVersion: gateway.k8s.f5.com/v1alpha1
kind: Infra
metadata:
  name: cloud-infra
  namespace: f5-bnk
spec:
  ipams:
    # CIDR block for external VLAN
    - name: external-vlan-ipam
      infobloxNetview: default
      ipPools:
        - cidr: 10.1.0.0/24
          availabilityZone: jp-osa-1
        - cidr: 10.2.0.0/24
          availabilityZone: jp-osa-2
        - cidr: 10.3.0.0/24
          availabilityZone: jp-osa-3

    # CIDR block for VIP listener
    - name: vip-listener-ipam
      infobloxNetview: default
      ipPools:
        - cidr: 10.4.0.0/24 
          availabilityZone: jp-osa-1
        - cidr: 10.5.0.0/24 
          availabilityZone: jp-osa-2
        - cidr: 10.6.0.0/24 
          availabilityZone: jp-osa-3

What You Create (per Application)¶

Gateway CR¶

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: app1-gw
  namespace: app1-ns
spec:
  infrastructure:
    parametersRef:
      group: gateway.k8s.f5.com 
      kind: GatewaySettings
      name: gw-settings-common
    annotations:
      k8s.f5.com/external-bigip-config: |
        [
          {
            "listener": "https",
            "aliases": ["example-legacy.fr.net.intra", "example-dr.fr.net.intra"]
          }
        ]
  gatewayClassName: gateway-class
  listeners:
    - name: https
      port: 443
      protocol: HTTPS
      hostname: "app1.example.com"    # <-- WideIP created for this hostname only
      tls:
        certificateRefs:
          - name: app1-cert        # Cert CN + SANs do NOT create additional WideIPs
      allowedRoutes:
        namespaces: {from: "All"}

HTTPRoute CR¶

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app1-route
  namespace: app1-ns
spec:
  parentRefs:
    - name: app1-gw
      sectionName: https
  # hostnames here are for TMM Host-header filtering ONLY.
  # They do NOT create WideIPs. They must match a SAN in the listener cert.
  # Their DNS CNAMEs must point to the main WideIP or an alias.
  hostnames:
    - "app1.example.com"
    - "app1-internal.example.com"    # SAN in cert, CNAME -> WideIP, no WideIP created
  rules:
    - matches:
        - path: {type: PathPrefix, value: "/api"}
      backendRefs:
        - name: api-svc
          port: 8080
    - matches:
        - path: {type: PathPrefix, value: "/"}
      backendRefs:
        - name: web-svc
          port: 80

GTM Annotation Fields¶

Key	Description	Example
`listener`	Which listener this config applies to	`"https"`
`aliases`	Additional DNS names for same WideIP pool	`["app1-legacy.fr.net.intra"]`

What BNK Creates on GTM¶

Object	Name / Value	Notes
Aliases	`app1-legacy.fr.net.intra`, `example-dr.fr.net.intra`	Resolve to same pool
Data Server (Zone A)	`server_<digitalAssetID>_<cluster>_10.1.0.1`	Auto-created by BNK
Data Server (Zone B)	`server_<digitalAssetID>_<cluster>_10.2.0.1`	Auto-created by BNK
Data Server (Zone C)	`server_<digitalAssetID>_<cluster>_10.3.0.1`	Auto-created by BNK
Pool	`pool-<digitalAssetID>-<clusterName>-app1.example.com`	TCP monitor, Round Robin
Virtual Server (Zone A)	`10.1.0.100:443`	Added to Data Server above
Virtual Server (Zone B)	`10.2.0.100:443`	Added to Data Server above
Virtual Server (Zone C)	`10.3.0.100:443`	Added to Data Server above
WideIP	`app1-example-com.gslb1.fr.net.intra`	normalized(hostname) + suffix

Important

Data Server (current behavior): BNK auto-creates one Data Server per cluster + AZ. Naming: server_<digitalAssetID>_<clusterName>_<tmmSelfIP>. With 3 AZs, this results in 3 Data Servers per cluster. See scale discussion below.

Option	Who Creates	Scale (200 clusters, 10ns each)	Notes
Current: 1 per cluster+AZ (no namespace)	BNK (auto)	200 x 3 = 600	per-AZ visibility; manageable scale

DNS resolution¶

Delegation domain¶

Corporate DNS delegates gslb1.fr.net.intra to GTM instances. WideIP name = normalized hostname + suffix. Client follows CNAME chain to reach GTM.

Aliases¶

Aliases are additional names that resolve to the same WideIP pool. No separate WideIP is created. Useful for legacy DNS names or DR names.

Gateway Mutualization (Shared Gateway, SANs)¶

Important

Rules for WideIP generation:

WideIP is created only for the Gateway listener hostname
Certificate SANs do not create WideIPs
HTTPRoute hostnames do not create WideIPs (TMM Host-header filtering only)
HTTPRoute hostnames must match a SAN in the listener certificate
DNS CNAMEs for SANs/HTTPRoute hostnames must point to the main WideIP or an alias

Example: Shared Gateway with multiple apps¶

# One Gateway, multiple listeners (one per app)
listeners:
  - name: app1-https
    hostname: "app1.group.echonet"     # WideIP created
    tls: {certificateRefs: [{name: app1-cert}]}  # Cert has 10 SANs - NO WideIPs for them
  - name: app2-https
    hostname: "app2.group.echonet"     # WideIP created
    tls: {certificateRefs: [{name: app2-cert}]}

DNS config in Infoblox (your responsibility)¶

# Main FQDN -> WideIP
app1.group.echonet.        CNAME  app1-group-echonet.gslb1.fr.net.intra.

# SANs -> same WideIP (no separate WideIP per SAN)
app1-san1.group.echonet.   CNAME  app1-group-echonet.gslb1.fr.net.intra.
app1-san2.group.echonet.   CNAME  app1-group-echonet.gslb1.fr.net.intra.
...

TMM matches incoming TLS SNI against the certificate SAN list. Routing works for all hostnames without separate WideIPs.

What BNK Manages vs What You Pre-Create¶

Object	Who	When
DNS CNAMEs (main FQDN + SANs)	Customer (Infoblox)	Per application
GTM Data Server (1 per AZ)	BNK (automatic)	Per AZ
GTM Datacenter	Customer (manual)	One-time
Health Monitors	BNK (automatic)	Per pool
Virtual Servers inside Data Server	BNK (automatic)	Per Gateway listener
VPC Static Routes	BNK (automatic)	Per VIP
WideIP + Pool + Pool Members	BNK (automatic)	Per Gateway listener

Multi-Cluster¶

Each cluster creates its OWN WideIP and pool. Each cluster manages only objects with its own Digital Asset ID.

Quick Reference¶

Decision	Where	Example
Application hostname	Gateway `listeners[].hostname`	`app1.example.com`
Delegation suffix	ExternalBigIPRegistry CR	`gslb1.fr.net.intra`
Aliases	Annotation `aliases`	`["app1-legacy.fr.net.intra"]`
LB method	ExternalBigIPRegistry CR	`"Fallback IP"`
Listening port	Gateway `listeners[].port`	`443`
TLS certificate	Gateway `listeners[].tls`	K8s Secret name
Backend services	HTTPRoute `backendRefs`	Service:port
Path routing	HTTPRoute `rules[].matches`	`/api`