F5BigCneIrule¶

Overview¶

Function¶

Declares an iRule for a CNE instance. An iRule extends the functionality of the BIG-IP system, enabling advanced traffic management, manipulation, and decision-making beyond what the other resources provide. You can attach an iRule to a virtual server.

For iRule syntax and supported events, see the iRules documentation.

Names¶

Singular name	Plural name	Short name
f5-big-cne-irule	f5-big-cne-irules	irule

API group and version¶

k8s.f5net.com/v1

Scope¶

Namespace

Specification¶

spec¶

Field	Required	Default	Description
`iRule` string	Yes	`""`	Specifies the iRule script. The script customizes and extends the functionality of the BIG-IP system, enabling advanced traffic management, manipulation, and decision-making beyond what the other resources provide. Maximum length is 65520 characters.
`tenant` string	No	`""`	Name of the tenant that owns the iRule. Maximum length is 255 characters. Must match the pattern `^$\|^[a-z0-9]([-a-z0-9][a-z0-9])?(\.[a-z0-9]([-a-z0-9][a-z0-9])?)*$`.
`namespace` string	No	`""`	Tenant namespace in which the iRule is created. Maximum length is 255 characters. Must match the pattern `^[0-9a-zA-Z._-]*$`.

F5BigCneIrule Manifest¶

apiVersion: k8s.f5net.com/v1
kind: F5BigCneIrule
metadata:
  name: irule-one
  namespace: gatewayns
spec:
  iRule: |
    when HTTP_RESPONSE {
      log local0.debug "Client IP Apps address"
      if { [HTTP::header exists "Content-Disposition"] } {
        log local0.debug "Client IP Apps address log2"
      }
    }

Applying the manifest.

kubectl create -f irule.yaml
f5bigcneirule.k8s.f5net.com/irule-one created

kubectl get -f irule.yaml
NAME        READY   MESSAGE                                AGE
irule-one   True    CR config sent to all grpc endpoints   3m37s

kubectl get f5-big-cne-irules -n myappns
NAME        READY   MESSAGE                                AGE
irule-one   True    CR config sent to all grpc endpoints   17m

NetPolicy¶

The NetPolicy CR supports general extensions. Refer to NetPolicy for additional details.

Sample NetPolicy CR¶

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: NetPolicy
metadata:
  name: my-test-netpolicy
  namespace: gatewayns
spec:
  extensionRefs:
  - kind: F5BigCneIrule
    name: irule-one
    group: k8s.f5net.com
  targetRefs:
  - kind: Gateway
    name: my-l4route-tcp-gateway
    group: gateway.networking.k8s.io
    sectionName: "l4-nginx-tcp"

Attaching iRules to a Gateway¶

You can now attach iRules to gateway level. This ensures that the iRule is applied to all the traffic that flows via gateway.

Applying Gateway, iRules, and NetPolicy CR¶

Create and apply the Gateway .yaml file.
Create and apply the F5BigCneIrule .yaml files.
Create and apply NetPolicy .yaml file.

Note

Make sure that Gateway, NetPolicy, and the associated iRule (F5BigCneIrule) are in the same namespace.
Make sure that GatewayClass and Gateway CRs are applied.
The required CRs can be applied in any order.
It is not required to mention the namespace in the kubectl command if the namespace is included in the CR.

Deleting Gateway, iRules, and NetPolicy CR¶

Delete the required CR using kubectl delete command from the namespace.

kubectl delete -f my-resource.yaml

For example

kubectl delete -f my-f5bigcneirule.yaml

Note

When the BIG-IP Next for Kubernetes Net policy is deleted, iRule will not be applied to any traffic.