Overview

BIG-IP Next for Kubernetes (BNK) is F5’s unified cloud-native traffic management platform for Kubernetes. F5 supports the following deployment models:

  • BNK on Host (formerly Service Proxy for Kubernetes), optimized for CoSP/5G application traffic on OpenShift.

  • BNK on DPU, optimized for AI and other high-throughput workloads using NVIDIA BlueField-3 DPUs.

In both deployment models, BIG-IP Next for Kubernetes uses F5’s Traffic Management Microkernel (TMM), controllers, and CRDs to deliver L4-L7 traffic management, security, and policy control in Kubernetes environments.

Deployment models

BNK on Host (formerly SPK)

BNK on DPU

Where TMM runs

Host CPU (software pod)

DPU hardware

Hardware offload

None

DOCA-accelerated packet processing and enforcement

Target workloads

5G/CoSP (SCTP, NGAP, Diameter, GTP)

AI and cloud-native (TCP, UDP, HTTP/2, gRPC)

Lifecycle management

Helm or FLO

FLO

Core capabilities

BNK provides a unified capability set across host and DPU deployments.

  • L4-L7 traffic management for TCP, UDP, SCTP, HTTP/2, gRPC, NGAP, Diameter, and GTP workloads

  • Ingress and egress service control with policy-based routing and per-namespace SNAT/egress identity

  • Security enforcement with ACLs, DDoS mitigation, optional intrusion prevention, and TLS termination

  • Gateway API support for TCPRoute and UDPRoute, plus F5 CRD extensions

  • Multi-tenant design with namespace and network segmentation, including VRF/VXLAN EVPN options

  • Observability and operations with telemetry, centralized logging, diagnostics, and QKView workflows

  • AI traffic handling with intelligent load balancing and token governance

  • Flexible deployment and upgrades through Kubernetes-native lifecycle tooling

Use cases

CoSP and 5G traffic workloads

BNK on Host provides cloud-native L4-L7 traffic management for low-latency 5G signaling and data workloads in OpenShift environments.

AI inference clusters

BNK on DPU offloads traffic processing to DPU hardware and supports intelligent load balancing for AI workloads using Analyzer pod recommendations and telemetry data.

Multi-tenant Kubernetes platforms

BNK enables per-tenant policy enforcement, logging, and egress identity to reduce blast radius and improve operational isolation across shared clusters.

Per-application egress governance

BNK assigns distinct outbound identities (for example, namespace-specific SNAT pools), giving upstream systems clear and auditable application-level traffic attribution.

Key components

Component

Role

TMM (Traffic Management Microkernel)

Data-plane processing for ingress and egress traffic at L4-L7.

CNE Controller (formerly SPK Controller)

Watches Kubernetes and CR updates, then pushes service and policy configuration to TMM.

CRDs (Custom Resource Definitions)

Extend Kubernetes APIs with BNK-specific traffic, security, and lifecycle objects.

F5 Lifecycle Operator (FLO)

Installs, scales, upgrades, and validates BNK deployments.

Cluster-Wide Controller (CWC)

Handles licensing, diagnostics, and operational APIs.

dSSM

Provides distributed session state persistence for TMM.

OTEL Collector

Receives and exports metrics, logs, and traces for monitoring workflows.

Fluentd

Aggregates and forwards logs from BNK components.

Gateway API

Defines ingress/egress services and traffic policy entry points.

F5 IPAM Controller (FIC)

Optional automated VIP allocation for Gateway resources.

F5 License Proxy (FLP)

Optional licensing path for disconnected/offline environments.

f5-analyzer

Optional AI traffic analysis and dynamic routing component.

F5-IPSD

Optional intrusion prevention component for signature-based enforcement.