F5BigFwRulelist

Overview

Function

Declares a firewall rule list for a CNE instance, defining the ordered rules that match traffic by protocol, source, and destination, and the action to apply.

Names

Singular name	Plural name	Short name
f5-big-fw-rulelist	f5-big-fw-rulelists	fwrl

API group and version

k8s.f5net.com/v1

Scope

Namespace

Specification

metadata

Parameter	Description
name	The name of the F5BigFwRuleList.
namespace	The namespace of Kubernetes in which the firewall rule list is installed.

spec

Field	Required	Default	Description
rule array	No	[]	List of firewall rules.
description string	No	""	Description of the rule list.

spec.rule[]

Field	Required	Default	Description
name string	Yes	—	Name of the rule. Maximum length is 255 characters.
action string	Yes	—	Action to apply to matching traffic. Accepted values: accept, accept-decisively, reject, drop.
ipProtocol string	No	any	IP protocol to match. Accepted values include any, tcp, udp, sctp, icmp, and other IANA protocol names. When ipProtocol isn’t tcp, udp, or sctp, don’t set source or destination ports or port lists.
description string	No	""	Description of the rule.
source object	No	{}	Source match criteria for the rule.
destination object	No	{}	Destination match criteria for the rule.
logging boolean	No	false	Turns on logging for the rule. Accepted values: true, false.
servicePolicy string	No	—	Name of the service policy to apply. Maximum length is 255 characters.

Note

When a rule specifies any VLAN zone in the source or destination, the rule can’t specify source VLANs.

spec.rule[].source

Field	Required	Default	Description
vlans array	No	[]	Source VLAN names. Each name is up to 255 characters.
zones array	No	[]	Source zone names. Each name is up to 255 characters.
addresses array	No	[]	Source IPv4 or IPv6 addresses, CIDR ranges, or address ranges.
addressLists array	No	[]	Source address list names. Each name is up to 255 characters.
ports array	No	[]	Source ports or port ranges. Accepted values: 0 to 65535, or a range such as 80-443.
portLists array	No	[]	Source port list names. Each name is up to 255 characters.
geos array	No	[]	Source geographic location codes. Each value is up to 255 characters.
fqdns array	No	[]	Source fully qualified domain names. Each name is up to 254 characters.
namespaces array	No	[]	Kubernetes namespaces to match. Each name is up to 63 characters.

spec.rule[].destination

Field	Required	Default	Description
zones array	No	[]	Destination zone names. Each name is up to 255 characters.
addresses array	No	[]	Destination IPv4 or IPv6 addresses, CIDR ranges, or address ranges.
addressLists array	No	[]	Destination address list names. Each name is up to 255 characters.
ports array	No	[]	Destination ports or port ranges. Accepted values: 0 to 65535, or a range such as 80-443.
portLists array	No	[]	Destination port list names. Each name is up to 255 characters.
geos array	No	[]	Destination geographic location codes. Each value is up to 255 characters.
fqdns array	No	[]	Destination fully qualified domain names. Each name is up to 254 characters.
namespaces array	No	[]	Kubernetes namespaces to match. Each name is up to 63 characters.

Example manifest

apiVersion: "k8s.f5net.com/v1"
kind: F5BigFwRulelist
metadata:
  name: firewallrule
  namespace: f5-bnk
spec:
  rule:
  - name: sc-rule-tcp-fw_rule-1
    ipProtocol: tcp
    source:
      addresses:
      - 11.19.10.10/32
      addressLists:
      - fw-drop-ipaddresses
    logging: true
    action: drop
  - name: sc-rule-tcp-fw-rule-2
    ipProtocol: tcp
    source:
      addresses:
      - 11.19.10.9/32
      portLists:
      - drop-ports
    logging: true
    action: drop

Note

The firewall rule list set is declared in the metadata.annotations section of the resource. This rule list must not exceed the metadata.annotations section limit of 262144 bytes of data.

Create and apply the manifest.

1. Copy the sample CR into a YAML <firewallrule.yaml> file.

2. Apply the F5BigFwRulelist CR:

   kubectl apply -f firewallrule.yaml
   f5bigfwrulelist.k8s.f5net.com/firewallrule created
   
   kubectl get -f firewallrule.yaml -n f5-bnk
   NAME           READY   MESSAGE                                AGE
   firewallrule   True    CR config sent to all grpc endpoints   7s
   

3. You must specify the firewall rule list name within the F5BigFwPolicy CR. For additional details, refer to the F5BigFwPolicy CR.