Integrate Infoblox with F5 IPAM Controller¶

Overview¶

F5 IPAM Controller (FIC) manages Internet Protocol (IP) addresses and Classless Inter-Domain Routing (CIDR) ranges for Gateway application programming interface (API) resources, selfip for vlan, Vxlan and snatpool IP. With Infoblox integration, you can use your existing Infoblox Network Identity Operating System (NIOS) DNS, DHCP, and IPAM (DDI) server to handle IP address allocation and release through FIC.

FIC communicates with Infoblox through the Web API (WAPI) interface exposed by NIOS-based Infoblox Grid deployments. All IP allocation and release operations use WAPI endpoints.

Note

This integration only supports Infoblox NIOS DDI, which is the grid management-based solution. Other Infoblox products, such as BloxOne DDI, are not supported.

Use cases¶

Functional goals¶

Provide Infoblox server configurations through the CNEInstance custom resource (CR).
Use FIC and the Infoblox server to assign IP addresses to Gateway resources, selfip for vlan, Vxlan and snatpool IP.
Manage configured CIDR ranges on the Infoblox server through FIC.

Non-functional goals¶

Scalability: Scalability is achieved by increasing IP capacity through the allocation of a new CIDR range in Infoblox and reconfiguring the Infra custom resource to consume that range. Because in-place CIDR expansion is not supported, scaling requires replacing the existing CIDR configuration.

Before you begin¶

Make sure the following conditions are met before you start:

You use the Kubernetes Gateway API for ingress resources.
You use Infra custom resource for infra objects like vlan,vxlan and snatpool
You have an Infoblox NIOS server available as your third-party IPAM system.
You have created the required Network Views (Netviews) on Infoblox.
You have created the CIDR ranges on Infoblox that you plan to reference in the Infra cr.
You understand that the f5-ip-provider and Infoblox providers are mutually exclusive. You can only use one provider at a time.
You are responsible for rotating Infoblox certificates and credentials.

What is not supported¶

Infoblox products other than NIOS DDI (such as BloxOne DDI)

Install and configure the integration¶

Install F5 Lifecycle Operator (FLO) along with the BNK-specific custom resource definitions (CRDs) and IPAM CRDs. Use either Operator Lifecycle Manager (OLM) or the provided Helm chart.

Create Kubernetes secrets that contain the certificates and credentials required to connect to your Infoblox server. Run the following commands, replacing the placeholder values with your Infoblox credentials and certificate paths:

Create a Kubernetes secret with credentials:

$ kubectl -n <IPAM-controller-namespace> create secret generic <name of credentials secret> --from-literal=username=<username> 
--from-literal=password=<password>

Example

$ kubectl -n f5-utils create secret generic infoblox-creds 
--from-literal=username=admin 
--from-literal=password=infoblox

Create a Kubernetes secret with CA certificates:

$ kubectl -n <IPAM-controller-namespace> create secret generic <name of certificate secret>  --from-file=certificate=<ca cert file name or path>

Example

$ kubectl -n f5-utils create secret generic infoblox-certs 
--from-file=certificate=infoblox-ca.crt

Create and apply a CNEInstance cr that includes your Infoblox configuration. This cr defines the desired state of your BNK deployment and contains the Infoblox connection details.

Example CNEInstance CR:

apiVersion: k8s.f5.com/v1
kind: CNEInstance
metadata:
  name: cneinstance-sample
  namespace: default
  labels:
    app.kubernetes.io/name: f5-lifecycle-operator
    app.kubernetes.io/managed-by: kustomize
spec:
  advanced:
    ipamController:
      env:
      - name: PROVIDER
        value: infoblox
      - name: INFOBLOX_GRID_HOST
        value: 10.x.x.x
      - name: INFOBLOX_WAPI_VERSION
        value: "2.11.2"
      - name: INFOBLOX_WAPI_PORT
        value: "443"
      - name: INSECURE
        value: "false"
      - name: CREDENTIAL_SECRET
        value: infoblox-creds
      - name: CERTIFICATE_SECRET
        value: infoblox-certs 
  deploymentSize: Small
  manifestVersion: 2.4.0 
  product:
    type: BNK
    gatewayAPI: true
    wholeCluster: true

Important

For production environments, set INSECURE to false and provide a valid CA certificate.

Field	Description
`PROVIDER`	The IP address or hostname of your Infoblox Grid server
`INFOBLOX_GRID_HOST`	The IP address or hostname of your Infoblox Grid server
`INFOBLOX_WAPI_PORT`	The port used for WAPI connections (typically 443)
`INFOBLOX_WAPI_VERSION`	The WAPI version supported by your Infoblox server
`CREDENTIAL_SECRET`	The name of the Kubernetes secret that holds Infoblox credentials
`CERTIFICATE_SECRET`	The name of the Kubernetes secret that holds the CA certificate for Infoblox
`INSECURE`	Set to true to skip SSL verification, or false to enforce it

FLO reads this CR and installs the required components for a full BNK installation, including F5 IPAM Controller.

Create a BNKGateway CR to define the IP address ranges that FIC manages.

Example Infra CR:

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: Infra
metadata:
  name: infra
  namespace: f5-bnk
spec:
  ipams:
    - name: gateway-vip-ipv4
      infobloxNetview: default
      ipPools:
      - availabilityZone: ca-tor-1
        rangeStart: 10.222.9.10
        rangeEnd: 10.222.9.41
      - availabilityZone: ca-tor-2
        rangeStart: 10.223.74.10
        rangeEnd: 10.223.74.41
      - availabilityZone: ca-tor-3
        rangeStart: 10.224.11.10
        rangeEnd: 10.224.11.41
    - name: external-vlan-selfip-ipv4
      infobloxNetview: default
      ipPools:
        - availabilityZone: ca-tor-1
          cidr: 10.222.20.0/24
        - availabilityZone: ca-tor-2
          cidr: 10.223.65.0/24
        - availabilityZone: ca-tor-3
          cidr: 10.224.129.0/24

  networkAttachments:
    - name: external-nad
      networkAttachmentDefinitions:
        - name: ens3-ipvlan-l2

    - name: internal-nad
      networkAttachmentDefinitions:
        - name: macvlan-conf

  networks:
    - name: external-vlan
      type: vlan
      vlan:
        mtu: 1500
        networkAttachmentRef:
          name: external-nad
        ipamRefs:
          - name: external-vlan-selfip-ipv4

Note

A Network View (Netview) in Infoblox NIOS DDI is a logical container for IP address space. Infoblox uses Netviews to support environments with multiple tenants, overlapping networks, labs, staging, and isolated routing domains. Infoblox manages IP addresses at the CIDR block level. It does not support managing smaller ranges within a CIDR block.
The network names denoted by the field name should be unique.

Verify that a GatewayClass resource exists; if not, create one before creating the Gateway.
Create a Gateway resource. The CNE controller reads the Gateway and requests an IP address from FIC using the IPAM CR.

How IP address allocation works¶

After you complete the configuration steps, the following workflow runs automatically:

The CNE controller reads the Infra CR and creates an IPAMRange CR.
FIC reads the IPAMRange CR, updates its status, and begins managing the defined ranges.
For Infra objects and Gateway resource, the CNE controller reads it and requests an IP address from FIC through the IPAM CR.
FIC reads the IPAM CR.
FIC reserves and allocates the IP address on the Infoblox server.
FIC updates the IPAM CR status with the reserved IP address.
The CNE controller reads the IP address from the IPAM CR status. It then configures Traffic Management Microkernel (TMM) with the IP address as a virtual IP address for gateway, self ip for vlan,vxlan and snat ip . This step requires all other dependencies, such as routes, to be resolved first.
The CNE controller updates the Gateway resource status with the allocated IP address.

CIDR configuration workflow¶

Apply one or more configuration-focused CRs in any order. The CNE controller receives them for processing.
The CNE controller reads the CRs and creates the IPAMRange CR.
FIC reads the IPAMRange CR and verifies the CIDR and Netview configuration on the Infoblox server.
FIC updates the IPAMRange CR status.
The CNE controller reads the status and processes further.
The CNE controller takes any actions required to complete the configuration.

IP address reservation workflow¶

Apply one or more configuration-focused CRs in any order. The CNE controller receives them for processing.
The CNE controller reads the CRs and requests an IP address from FIC through the IPAM CR.
FIC reads the IPAM CR, reserves the IP address on Infoblox, and updates the IPAM CR status.
The CNE controller reads the IP address from the IPAM CR status and processes further.
The CNE controller takes any actions required to bring the TMM configuration into the desired state.

API reference¶

IPAMRange CR¶

The IPAMRange CR defines the CIDR ranges that FIC manages through Infoblox.

Example IPAMRange CR:

apiVersion: fic.f5.com/v1
kind: IPAMRange
metadata:
  name: infra-default-my-infra
  namespace: default
spec:
  ipRanges:
  - cidr: 11.11.11.150/31
    endAddress: 11.11.11.151
    ipFamily: ipv4
    ipamLabel: default_my-infra_ipamConfig_tmm-client-ipam-config_ipv4
    netview: default
    startAddress: 11.11.11.150
  - cidr: 2002::11:11:11:150/127
    endAddress: 2002::11:11:11:151
    ipFamily: ipv6
    ipamLabel: default_my-infra_ipamConfig_tmm-client-ipam-config_ipv6
    netview: default
    startAddress: 2002::11:11:11:150
  - cidr: 22.22.22.0/24
    endAddress: 22.22.22.180
    ipFamily: ipv4
    ipamLabel: default_my-infra_ipamConfig_listener-pool_ipv4
    netview: default
    startAddress: 22.22.22.100
  - cidr: 10.10.10.128/26
    endAddress: 10.10.10.182
    ipFamily: ipv4
    ipamLabel: default_my-infra_ipamConfig_snat-pool_ipv4
    netview: default
    startAddress: 10.10.10.150
  provider: f5-ip-provider
status:
  ipRangeStatus:
  - ipFamily: ipv4
    ipamLabel: default_my-infra_ipamConfig_tmm-client-ipam-config_ipv4
    status: Ok
  - ipFamily: ipv6
    ipamLabel: default_my-infra_ipamConfig_tmm-client-ipam-config_ipv6
    status: Ok
  - ipFamily: ipv4
    ipamLabel: default_my-infra_ipamConfig_listener-pool_ipv4
    status: Ok
  - ipFamily: ipv4
    ipamLabel: default_my-infra_ipamConfig_snat-pool_ipv4
    status: Ok

Field	Description
`provider`	Set to `infoblox` to use the Infoblox integration
`ipRanges.ipFamily`	The IP family: `ipv4` or `ipv6`
`ipRanges.ipamLabel`	A label that identifies this IP range
`ipRanges.cidr`	The CIDR block to manage
`ipRanges.netview`	The Infoblox Netview associated with this range

IPAM CR¶

The IPAM CR tracks individual IP address allocations for Gateway resources.

Example IPAM CR:

apiVersion: v1
items:
- apiVersion: fic.f5.com/v1
  kind: IPAM
  metadata:
    annotations:
      gateway-name: http-gw
      gateway-namespace: f5-app
    creationTimestamp: "2026-09-15T11:06:29Z"
    finalizers:
    - ipam.fic.f5.com/ipam-finalizer
    generation: 1
    labels:
      f5bnkcr: "true"
    name: gw-f5-app-http-gw
    namespace: f5-bnk
    resourceVersion: "39662141"
    uid: 047bb3e8-7027-4b11-8db5-f47ddc5aa6ae
  spec:
    hostSpecs:
    - deviceID: DP-0
      ipamLabel: f5-bnk_infra_ipamConfig_gateway-vip-ipv4_0_ipv4
      key: ca-tor-1-dp0-gw-f5-app-http-gw-v4
    - deviceID: DP-0
      ipamLabel: f5-bnk_infra_ipamConfig_gateway-vip-ipv4_1_ipv4
      key: ca-tor-2-dp0-gw-f5-app-http-gw-v4
    - deviceID: DP-0
      ipamLabel: f5-bnk_infra_ipamConfig_gateway-vip-ipv4_2_ipv4
      key: ca-tor-3-dp0-gw-f5-app-http-gw-v4
  status:
    IPStatus:
    - cidrBlock: 10.222.19.0/26
      deviceID: DP-0
      ip: 10.222.19.1
      ipamLabel: f5-bnk_infra_ipamConfig_gateway-vip-ipv4_0_ipv4
      key: ca-tor-1-dp0-gw-f5-app-http-gw-v4
      status: Ok
    - cidrBlock: 10.223.75.0/26
      deviceID: DP-0
      ip: 10.223.75.1
      ipamLabel: f5-bnk_infra_ipamConfig_gateway-vip-ipv4_1_ipv4
      key: ca-tor-2-dp0-gw-f5-app-http-gw-v4
      status: Ok
    - cidrBlock: 10.224.12.0/26
      deviceID: DP-0
      ip: 10.224.12.1
      ipamLabel: f5-bnk_infra_ipamConfig_gateway-vip-ipv4_2_ipv4
      key: ca-tor-3-dp0-gw-f5-app-http-gw-v4
      status: Ok

The IPAM CR tracks individual IP address allocations for Vlan resources.

- apiVersion: fic.f5.com/v1
  kind: IPAM
  metadata:
    annotations:
      infra-name: infra
      vlan-name: external-vlan
      vlan-namespace: f5-bnk
    creationTimestamp: "2026-09-06T15:13:35Z"
    finalizers:
    - ipam.fic.f5.com/ipam-finalizer
    generation: 4
    labels:
      f5bnkcr: "true"
    name: vlan-f5-bnk-external-vlan.infra
    namespace: f5-bnk
    resourceVersion: "32197856"
    uid: 156ba3bb-b067-4d72-9cb5-097569c28696
  spec:
    hostSpecs:
    - deviceID: DP-0
      ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_0_ipv4
      key: ca-tor-1-dp0-vlan-f5-bnk-external-vlan-0-ipv4
    - deviceID: DP-0
      ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_1_ipv4
      key: ca-tor-2-dp0-vlan-f5-bnk-external-vlan-1-ipv4
    - deviceID: DP-0
      ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_2_ipv4
      key: ca-tor-3-dp0-vlan-f5-bnk-external-vlan-2-ipv4
    - ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_0_ipv4
      key: vlan-f5-bnk-external-vlan-external-vlan-selfip-ipv4-0-ipv4-reserved
    - ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_1_ipv4
      key: vlan-f5-bnk-external-vlan-external-vlan-selfip-ipv4-1-ipv4-reserved
    - ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_2_ipv4
      key: vlan-f5-bnk-external-vlan-external-vlan-selfip-ipv4-2-ipv4-reserved
  status:
    IPStatus:
    - ip: 10.222.9.1
      ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_0_ipv4
      key: vlan-f5-bnk-external-vlan-external-vlan-selfip-ipv4-0-ipv4-reserved
      status: Ok
    - ip: 10.223.65.1
      ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_1_ipv4
      key: vlan-f5-bnk-external-vlan-external-vlan-selfip-ipv4-1-ipv4-reserved
      status: Ok
    - ip: 10.224.129.1
      ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_2_ipv4
      key: vlan-f5-bnk-external-vlan-external-vlan-selfip-ipv4-2-ipv4-reserved
      status: Ok
    - cidrBlock: 10.222.9.0/26
      deviceID: DP-0
      ip: 10.222.9.2
      ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_0_ipv4
      key: ca-tor-1-dp0-vlan-f5-bnk-external-vlan-0-ipv4
      status: Ok
    - cidrBlock: 10.223.65.0/26
      deviceID: DP-0
      ip: 10.223.65.2
      ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_1_ipv4
      key: ca-tor-2-dp0-vlan-f5-bnk-external-vlan-1-ipv4
      status: Ok
    - cidrBlock: 10.224.129.0/26
      deviceID: DP-0
      ip: 10.224.129.2
      ipamLabel: f5-bnk_infra_ipamConfig_external-vlan-selfip-ipv4_2_ipv4
      key: ca-tor-3-dp0-vlan-f5-bnk-external-vlan-2-ipv4
      status: Ok
kind: List
metadata:
  resourceVersion: ""

Field	Description
`hostSpecs.ipamLabel`	The label that maps this request to a configured IP range
`hostSpecs.key`	A unique key that identifies this IP allocation request
`status.IPStatus.ip`	The IP address allocated by FIC from the Infoblox server
`status.IPStatus.status`	The current status of the allocation (for example, `Ok`)

How F5 IPAM Controller processes requests internally¶

FIC uses the following internal workflow to handle IP address operations:

FIC event watchers (informers) receive create, update, or delete events from the Kubernetes API server.
The event watchers create a resource key and add it to the resource queue.
A worker reads the resource key from the queue.
The worker requests or releases the IP address on the Infoblox server.
The worker requests or releases the IP address from the local cache and places the result in the response channel.
The response handler reads the response channel.
The response handler updates the resource status.

Uninstall the integration¶

To remove the integration, delete the CNEInstance CR. FLO removes the underlying components from the installation.

Upgrade and rollback follow a similar process. FLO makes sure the installed component versions match the requirements defined in the CNEInstance CR.