Architecture overview¶
Component Architecture¶
BNK includes the following components in a Kubernetes cluster:
Component |
Description |
|---|---|
Traffic Management Microkernel (TMM) |
Data plane. Runs as a DaemonSet on DPU nodes. Processes all ingress and egress traffic. Handles load balancing, firewall, DDoS, SSL and TLS, and protocol tasks. Uses DPDK and DPU hardware offload. |
CNE Controller (f5ingress) |
Control plane. Watches Gateway API and F5 custom resources. Translates them to TMM configuration through gRPC. Runs on host or control plane nodes. |
F5 Lifecycle Operator (FLO) |
Lifecycle management. Automates deployment, upgrades, and monitoring of BNK components. Installs CRDs, validates versions, and discovers DPUs automatically. |
Cluster Wide Controller (CWC) |
Cluster-level management. Handles licensing, telemetry, QKView generation, and debug REST APIs. Uses RabbitMQ for communication between components. |
dSSM (Redis Sentinel) |
Session state storage. Provides distributed Redis persistence for TMM. Runs as a StatefulSet with Sentinel for high availability. |
OTEL Collector |
Metrics collection. Receives OpenTelemetry metrics from TMM through Observer pods and Distributed TODA. Exports metrics to Prometheus on port 9090 over gRPC with mTLS. |
Fluentd |
Log aggregation. Collects and forwards logs from BNK components to external systems. |
F5 License Proxy (FLP) |
License management. Optional for clusters without internet access. Deployable as a Helm chart or as a virtual machine in QCOW2 or OVA format. |
F5 IPAM Controller (FIC) |
IP address management. Automates address allocation for Gateway resources and assigns virtual server addresses. |
Coremond |
Core dump management. Monitors, rotates, and stores TMM core files for debugging on DPU and host platforms. |
Debug Sidecar |
Diagnostics. Provides tools such as tmctl, tcpdump, core-tmm, bdt_cli, mrfdb, configview, ping, traceroute, and netkvest for TMM inspection and troubleshooting. |
Traffic Flow¶
BNK traffic flow on a DPU follows this sequence:
External traffic enters through the physical NIC on the host.
SR-IOV sends the traffic through scalable functions (SFs) on the BlueField 3 DPU to the TMM pod.
TMM processes the traffic, including SSL termination, firewall checks, and load balancing.
Ingress: TMM sends traffic to application pods through the internal VLAN and the host virtual functions (VFs).
Egress: Pod traffic routes to TMM on the DPU. TMM applies SNAT and sends the traffic through the external VLAN.
OVS bridges on the DPU provide layer 2 switching between SFs on the DPU and VFs on the host.
TMM streams OpenTelemetry metrics to the Observer, then the Receiver, then the OTEL Collector, and then Prometheus.
Deployment Topologies¶
BNK supports the following deployment models:
Daemon-Set Mode (Required)¶
In daemon‑set mode, also called whole‑cluster mode, a single BNK instance manages all ingress and egress traffic for every namespace. The TMM workload runs as a daemon set on DPU‑labeled nodes. The CNE-instance controller also runs in this mode and watches all namespaces.