F5BigGlobalOptions

Overview

Function

Declares global options for a CNE instance, including IP, DNS cache, crypto, firewall, and TCP optimization behaviors that apply across all TMM instances.

Names

Singular name	Plural name	Short name
f5-big-global-options	f5-big-global-optionses	—

API group and version

k8s.f5net.com/v1

Scope

Namespace

Specification

spec

Field	Required	Default	Description
ip object	No	{}	IP behaviors applied at the global level, such as whether IP options are accepted.
dnscache object	No	{}	DNS cache options applied at the global level.
crypto object	No	{}	Crypto behaviors applied at the global level, such as hardware acceleration.
firewall object	No	{"defaultAction": "", "defaultActionLog": true, "hardwareOffload": true}	Firewall behaviors applied at the global level, such as the default action to apply on traffic.
tcpOptimization object	No	{}	Global TCP optimization settings that affect initial congestion window sizing and adaptive buffer growth.

spec.ip

Field	Required	Default	Description
acceptIpOptions boolean	No	false	Specifies whether IP options are accepted at the global level. Accepted values: true, false.

spec.dnscache

Field	Required	Default	Description
matchWildcardVip boolean	No	false	Allows Unbound back-end service resolution to match a wildcard virtual server. The virtual server must be fully wildcard (0.0.0.0/0 or ::/0) and must have a source-address translation of a SNAT pool. Use this to SNAT back-end resolutions. Accepted values: true, false.

spec.crypto

Field	Required	Default	Description
hwAccel boolean	No	true	Turns crypto hardware acceleration on or off. Accepted values: true, false.

spec.firewall

Field	Required	Default	Description
defaultAction string	No	""	Default action to apply on traffic that doesn’t match any firewall rule in a secure context or gateway. Accepted values: "", accept, reject, drop.
defaultActionLog boolean	No	true	Specifies whether to generate an HSL message when the default action is applied. Accepted values: true, false.
hardwareOffload boolean	No	true	Turns hardware offloading of firewall rules on or off when the platform supports it. Accepted values: true, false.

spec.tcpOptimization

Field	Required	Default	Description
initWindowAfterXon boolean	No	true	Turns on use of the optimized initial congestion window after XON flow resumption. Accepted values: true, false.
initWindowMultiplierAfterXon integer	No	1	Multiplier applied to the baseline initial congestion window after XON to scale recovery aggressiveness. Accepted values: 1 to 100.
autoTuning object	No	{}	Adaptive TCP buffer growth parameters that control minimum and maximum limits, growth cadence, and responsiveness to path characteristics.

spec.tcpOptimization.autoTuning

Field	Required	Default	Description
sendBufMax integer	No	16777216	Maximum allowed send buffer size, in bytes, for each progressive tuning connection. Accepted values: 1048576 to 16777216.
recvBufMax integer	No	16777216	Maximum allowed receive buffer size, in bytes, for each progressive tuning connection. Accepted values: 4194304 to 16777216.
sendBufIncr integer	No	65536	Increment applied when the send buffer grows during adaptive progressive tuning cycles. Accepted values: 4096 to 1048576.
recvBufIncr integer	No	65536	Increment applied when the receive buffer grows during adaptive progressive tuning cycles. Accepted values: 4096 to 1048576.
sendBufMin integer	No	131070	Minimum send buffer size, in bytes, applied before any adaptive growth decisions. Accepted values: 4096 to 1048576.
recvBufMin integer	No	65535	Minimum receive buffer size, in bytes, applied before any adaptive growth decisions. Accepted values: 4096 to 1048576.
sendBufMinInterval integer	No	100	Minimum interval, in milliseconds, between attempts to enlarge the send buffer. Accepted values: 10 to 65535.
recvBufMinInterval integer	No	100	Minimum interval, in milliseconds, between attempts to enlarge the receive buffer. Accepted values: 10 to 65535.
sendBufBDPMultiplier integer	No	1	Multiplier applied to the bandwidth-delay product when targeting the send buffer size. Accepted values: 1 to 10.
recvBufBDPMultiplier integer	No	1	Multiplier applied to the bandwidth-delay product when targeting the receive buffer size. Accepted values: 1 to 10.
proxyBufMin integer	No	65535	Minimum proxy buffer size, in bytes, used before adaptive scaling. Accepted values: 4096 to 1048576.
proxyBufMax integer	No	2097152	Maximum proxy buffer size, in bytes, that limits adaptive growth. Accepted values: 1048576 to 4194304.
proxyBufOffset integer	No	65535	Offset added to the computed proxy buffer size for headroom safety margin. Accepted values: 4096 to 1048576.
autoNagleRttThreshold integer	No	20	RTT threshold, in milliseconds, used to adjust delayed send (Nagle-related) behavior automatically. Accepted values: 0 to 200.

Example manifest

apiVersion: k8s.f5net.com/v1
kind: F5BigGlobalOptions
metadata:
  name: global-options
  namespace: f5-bnk
spec:
  crypto:
    hwAccel: false
  firewall:
    defaultAction: accept
    defaultActionLog: true
    hardwareOffload: true

Disabling Crypto Hardware Acceleration on the BlueField-3 DPU

Follow the steps below to disable crypto hardware acceleration on the BlueField-3 DPU:

1. Copy the F5BigGlobalOptions example CR below to a YAML file. Set the crypto.hwAccel parameter to false and save:

    apiVersion: k8s.f5net.com/v1
    kind: F5BigGlobalOptions
    metadata:
      name: global-options
      namespace: f5-bnk
    spec:
      crypto:
        hwAccel: false
   

2. Apply the F5BigGlobalOptions CR that you have created:

   kubectl apply -f f5-global-options.yaml
   

The crypto hardware acceleration is now disabled on the BlueField-3 DPU, and a software-based codec will be enabled.

Enabling Crypto Hardware Acceleration on the BlueField-3 DPU

Prerequisites:

To enable crypto hardware acceleration on the BlueField-3 Data Processing Unit (DPU), ensure you have the following:

1. A BlueField-3 DPU must have a crypto-capable device.

2. A Scalable Function (SF) must be created on the BlueField-3 DPU.

Follow the steps below to enable ‌crypto hardware acceleration on the BlueField-3 DPU:

1. Copy the F5BigGlobalOptions example CR below to a YAML file. Set the crypto.hwAccel parameter to true and save:

    apiVersion: k8s.f5net.com/v1
    kind: F5BigGlobalOptions
    metadata:
      name: global-options
      namespace: f5-bnk
    spec:
      crypto:
        hwAccel: true
   

2. Apply the F5BigGlobalOptions CR that you have created:

   kubectl apply -f f5-global-options.yaml
   

The crypto hardware acceleration is now enabled on the BlueField-3 DPU, and a software-based codec will be disabled.

Enabling/Disabling ACL HW offload on the BlueField-3 DPU

Note

ACL HW Offload is enabled by default.

1. To disable the ACL HW Offload, set the firewall.hardwareOffload parameter to false and save:

    apiVersion: k8s.f5net.com/v1
    kind: F5BigGlobalOptions
    metadata:
      name: global-options
      namespace: f5-bnk
    spec:
      firewall:
        defaultAction: accept
        defaultActionLog: true
        hardwareOffload: false
   

2. Apply the F5BigGlobalOptions CR that you have created:

   kubectl apply -f f5-global-options.yaml
   

The hardware acceleration is now disabled on the BlueField-3 DPU.

Note

To enable the ACL HW Offload, set the firewall.hardwareOffload parameter to true and apply CR. ACL HW Offload works only for the rules with drop action configured in F5BigFwPolicy CR.