GatewaySettings

Overview

Persona

• Cluster operator

• Tenant network administrator

Function

Declares the gateway and egress gateway extension settings for a CNE instance, including source NAT pools and ingress and egress configuration. IPAM comes from the referenced Infra resource. Each ingress and egress configuration specifies its own network reference.

This resource configures tenant-specific traffic settings for Gateway and EgressGateway resources. It defines source NAT (SNAT) pools and specifies how the system handles ingress and egress traffic. This resource references infrastructure elements, such as IPAM pools and networks, defined in a separate Infra resource, which enables modular and reusable network design. Must be deployed in the same namespace as the Gateway or EgressGateway resources that references it.

Names

Singular name	Plural name	Short name
gatewaysettings	gatewaysettings	gws

API group and version

gateway.k8s.f5.com/v1alpha1

Scope

Namespace

Specification

spec

Specify at least one of ingressConfig or egressConfigs.

Field	Required	Default	Description
sourceNATPools array	No	—	Source NAT pool configuration for ingress and egress.
ingressConfig object	No	—	Configuration for handling incoming traffic.
egressConfigs array	No	—	Configuration for handling outgoing traffic.

spec.sourceNATPools[]

Field	Required	Default	Description
name string	Yes	—	Name of the source NAT pool. Must be 1 to 255 characters.
ipamRefs array	Yes	—	References to IPAM configurations in the Infra resource. The system auto-generates the source NAT pool addresses through IPAM from the referenced pools.
vrfRef object	No	—	Reference to a VRF for this source NAT pool. When you don’t set this, the system uses the default VRF.
shared boolean	No	false	Turns on source NAT address sharing across multiple TMMs. Accepted values: true, false.

spec.sourceNATPools[].ipamRefs[]

Field	Required	Default	Description
name string	Yes	—	Name of an ipams entry in the referenced Infra resource (infra.spec.ipams[].name). Must be 1 to 255 characters.

spec.sourceNATPools[].vrfRef

Field	Required	Default	Description
name string	Yes	—	Name of the VRF. Must be 1 to 255 characters.

spec.ingressConfig

Field	Required	Default	Description
defaultListenerNetwork object	No	—	Default listener network configuration for incoming traffic.

spec.ingressConfig.defaultListenerNetwork

Field	Required	Default	Description
ipamRefs array	Yes	—	References to IPAM configurations in the Infra resource for listeners. The system auto-generates listener addresses through IPAM from the referenced pools.
networkRefs array	No	—	References to Infra resource network configuration entries used as the ingress listener network context. All entries must belong to the same VRF. VXLANs take precedence over VLANs when both are present.
vrfRef object	No	—	Reference to a VRF for this default listener network. When you don’t set this, the system uses the default VRF.
sourceNATConfig object	No	—	Source NAT configuration for the listener network.

spec.ingressConfig.defaultListenerNetwork.ipamRefs[]

Field	Required	Default	Description
name string	Yes	—	Name of an ipams entry in the referenced Infra resource (infra.spec.ipams[].name). Must be 1 to 255 characters.

spec.ingressConfig.defaultListenerNetwork.networkRefs[]

Field	Required	Default	Description
name string	Yes	—	Name of the network configuration entry in the referenced Infra resource (infra.spec.networks[].name). The selected network provides the VRF and infrastructure context where default listener addresses are allocated and programmed. Must be 1 to 255 characters.

spec.ingressConfig.defaultListenerNetwork.vrfRef

Field	Required	Default	Description
name string	Yes	—	Name of the VRF. Must be 1 to 255 characters.

spec.ingressConfig.defaultListenerNetwork.sourceNATConfig

Field	Required	Default	Description
type string	Yes	Automap	Source NAT mode. Automap maps automatically. None turns off source NAT. Pool references a source NAT pool. Accepted values: Automap, None, Pool. Set sourceNATPoolRef only when type is Pool.
sourceNATPoolRef object	No	—	Reference to a source NAT pool entry defined in this resource. Required when type is Pool.

spec.ingressConfig.defaultListenerNetwork.sourceNATConfig.sourceNATPoolRef

Field	Required	Default	Description
name string	Yes	—	Name of a source NAT pool entry defined in this resource. Must be 1 to 255 characters.

spec.egressConfigs[]

Field	Required	Default	Description
name string	Yes	—	Name of the egress configuration. Must be 1 to 255 characters. The sectionName field in an EgressGateway resource references this name.
sourceNATConfig object	Yes	—	Source NAT configuration for the egress path.
vrfRef object	No	—	Reference to a VRF for this egress configuration.
networkRef object	No	—	Reference to one Infra resource network configuration entry used as the egress network context.
hardwareAcceleration string	No	none	Preferred acceleration mode for the Packet Velocity ASIC (PVA). Accepted values: none, full, assisted, dedicated.

spec.egressConfigs[].vrfRef

Field	Required	Default	Description
name string	Yes	—	Name of the VRF. Must be 1 to 255 characters.

spec.egressConfigs[].networkRef

Field	Required	Default	Description
name string	Yes	—	Name of the network configuration entry in the referenced Infra resource (infra.spec.networks[].name). The selected network provides the VRF and infrastructure context used when programming egress behavior. Must be 1 to 255 characters.

spec.egressConfigs[].sourceNATConfig

Field	Required	Default	Description
type string	Yes	Automap	Source NAT mode. Automap maps automatically. None turns off source NAT. Pool references a source NAT pool. UseIngressAddress uses the egress path source address as the source NAT address. Accepted values: Automap, None, Pool, UseIngressAddress. Set sourceNATPoolRef only when type is Pool.
sourceNATPoolRef object	No	—	Reference to a source NAT pool entry defined in this resource. Required when type is Pool.

spec.egressConfigs[].sourceNATConfig.sourceNATPoolRef

Field	Required	Default	Description
name string	Yes	—	Name of a source NAT pool entry defined in this resource. Must be 1 to 255 characters.

Source NAT modes

The sourceNATConfig.type field accepts these modes.

Mode	Behavior
Automap	Default. Maps traffic automatically to available source NAT addresses.
None	Turns off source NAT.
Pool	Uses a specific source NAT pool referenced by sourceNATPoolRef.
UseIngressAddress	Uses the ingress path source address as the source NAT address. Available for egress only.

Configuration patterns

Pattern	What to configure
Minimal ingress	Set only ingressConfig.defaultListenerNetwork.ipamRefs for listener address allocation.
Routed ingress	Add networkRefs and vrfRef to defaultListenerNetwork.
Deterministic ingress source NAT	Set sourceNATConfig.type to Pool and provide sourceNATPoolRef.
Simple egress	Set egressConfigs with a name and a sourceNATConfig of type Automap. The system creates VXLAN tunnels internally.
Egress with a specific path	Add networkRef for a specific egress network and vrfRef for route domain control.
Combined ingress and egress	Configure both ingressConfig and egressConfigs, with shared or distinct source NAT pools.
Egress-only deployment	Configure only egressConfigs.
Ingress-only deployment	Configure only ingressConfig.

Example manifest

The following manifest defines a source NAT pool, an ingress listener network with automatic source NAT, and an egress configuration that uses the source NAT pool.

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: GatewaySettings
metadata:
  name: my-gateway-settings
  namespace: f5-gateways
spec:
  sourceNATPools:
    - name: egress-snat
      ipamRefs:
        - name: server-pool
      shared: false
  ingressConfig:
    defaultListenerNetwork:
      ipamRefs:
        - name: listener-pool
      sourceNATConfig:
        type: Automap
  egressConfigs:
    - name: default-egress
      networkRef:
        name: tmm-server
      sourceNATConfig:
        type: Pool
        sourceNATPoolRef:
          name: egress-snat