NetPolicy¶

Overview¶

Function¶

Declares a network policy for a CNE instance, applying extension resources (such as a F5BigCneIrule, F5BigPersistenceProfile, or F5BigTcpSettingresource) to a targetedGateway` resource.

When you apply this resource, it creates the policy object by linking the specified resources with the Kubernetes Gateway API resources. The extensionRefs array specifies the extension resource configurations to apply to a gateway or specific listener. The targetRefs array specifies the gateway that receives the configurations.

This resource implements the Gateway API direct policy attachment pattern.

Sample traffic flow-L7 Ingress path and iRule policy attached at Gateway level

Names¶

Singular name	Plural name	Short name
netpolicy	netpolicies	—

API group and version¶

gateway.k8s.f5.com/v1alpha1

Scope¶

Namespace

Specification¶

spec¶

The resources in extensionRefs, targetRefs, and this resource must all be in the same namespace.

Field	Required	Default	Description
`extensionRefs` array	Yes	`[]`	References to extension resources to apply to the target gateway. Must contain 1 to 8 items.
`targetRefs` array	Yes	—	Reference to the `Gateway` resource that the extension resources apply to. Must contain exactly one item.

spec.extensionRefs[]¶

A F5BigPersistenceProfile resource and a F5BigTcpSetting resource can each appear only once in the array.

Field	Required	Default	Description
`kind` string	Yes	`F5BigCneIrule`	Kind of the extension resource. Accepted values: `F5BigCneIrule`, `F5BigPersistenceProfile`, `F5BigTcpSetting`.
`name` string	Yes	—	Name of the extension resource. Must be no more than 255 characters.
`group` string	Yes	`k8s.f5net.com`	API group of the extension resource. Must be no more than 255 characters.

spec.targetRefs[]¶

The targetRefs array is immutable after creation. To change the target gateway, delete this resource and create it again.

Field	Required	Default	Description
`kind` string	Yes	`Gateway`	Kind of the target resource. Accepted value: `Gateway`.
`name` string	Yes	—	Name of the target resource. Must be 1 to 255 characters.
`group` string	Yes	`gateway.networking.k8s.io`	API group of the target resource. Must be no more than 255 characters.
`sectionName` string	No	`""`	Listener within the target gateway. Must be no more than 253 characters.

Design rules¶

Multiple Netpolicies¶

How to apply:

You can apply multiple BIG-IP Next for Kubernetes Net Policies to a single gateway only when

A policy is applied at the gateway level to define global network behavior for the gateway.
A policy is applied at the listener level by specifying the targetRefs.sectionName in the NetPolicy CR to target specific listeners in Gateway configuration.

For example:

When there are three policies (NetPolicy1, NetPolicy2, and NetPolicy3) you can

Apply NetPolicy1 to gateway.
Apply NetPolicy2 to listener1 (http_service).
Apply NetPolicy3 to listener2 (dns_service).

How not to apply:

Multiple NetPolicies cannot be applied when,

Multiple policies are applied at the same listener level. This results in conflicting behavior at the specific listener.
Multiple policies are applied at the gateway level. A gateway cannot have conflicting global configurations.

For example:

When there are three policies (NetPolicy1, NetPolicy2, and NetPolicy3) you cannot apply two policies (NetPolicy1 and NetPolicy2) to a gateway.

Execution Order:¶

When multiple policies are applied, and traffic passes through the gateway, the gateway-level iRule is executed first, followed by the listener-level iRule.

For example

When ‌traffic flows through listener1, an iRule applied at the Gateway level is executed first, followed by an iRule applied to listener1.
When ‌traffic flows through listener2, an iRule applied at the Gateway level is executed first, followed by an iRule applied to listener2.

The NetPolicy CR supports general extensions. This CR can reference resources such as iRules.

For details on iRule application in NetPolicy, see F5 iRule in NetPolicy

Configure NetPolicy¶

Prerequisites¶

Make sure,

The GatewayClass resource is configured.
The Gateway resource is configured.
The F5BigCneIrule resource is created.

NetPolicy with F5BigCneIrule attached to Gateway¶

Apply F5BigCneIrule resource.

  apiVersion: k8s.f5net.com/v1
  kind: F5BigCneIrule
  metadata:
    name: irule-one
    namespace: gatewayns
  spec:
    iRule: |
      when HTTP_RESPONSE {
        log local0.debug "Client IP Apps address"
        if { [HTTP::header exists "Content-Disposition"] } {
          log local0.debug "Client IP Apps address log2"
        }
      }

kubectl create -f irule.yaml
f5bigcneirule.k8s.f5net.com/irule-one created

kubectl get -f irule.yaml
NAME        READY   MESSAGE                                AGE
irule-one   True    CR config sent to all grpc endpoints   3m37s

Apply NetPolicy CR

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: NetPolicy
metadata:
  name: my-test-netpolicy
  namespace: gatewayns
spec:
  extensionRefs:
  - kind: F5BigCneIrule
    name: irule-one
    group: k8s.f5net.com
  targetRefs:
  - kind: Gateway
    name: my-l4route-tcp-gateway
    group: gateway.networking.k8s.io
    sectionName: "l4-nginx-tcp"

kubectl create -f NetPolicy.yaml
NetPolicy.gateway.k8s.f5.com/my-test-netpolicy created

kubectl get -f NetPolicy.yaml
NAME                AGE
my-test-netpolicy   6s

Note

NetPolicy, Gateway, F5BigCneIrule CRs should be in the same namespace when attached to Gateway or Gateway Listener.

NetPolicy with F5BigPersistenceProfile attached to Gateway¶

Apply F5BigPersistenceProfile CR

apiVersion: k8s.f5net.com/v1
kind: F5BigPersistenceProfile
metadata:
  name: cnf-mcp-persistence
  namespace: gatewayns
spec:
  persistenceType: MODEL_CONTEXT_PROTOCOL
  mcpEncryptionPassphrase:
    secretRef:
      name: mcp-crypto-vault
      passphraseField: primary-passphrase

kubectl create -f persistence-profile.yaml
f5bigpersistenceprofile.k8s.f5net.com/cnf-mcp-persistence created

kubectl get -f persistence-profile.yaml
NAME                   READY   MESSAGE                                AGE
cnf-mcp-persistence    True    CR config sent to all grpc endpoints   1m15s

Apply NetPolicy CR

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: NetPolicy
metadata:
  name: persistence-netpolicy
  namespace: gatewayns
spec:
  extensionRefs:
  - kind: F5BigPersistenceProfile
    name: cnf-mcp-persistence
    group: k8s.f5net.com
  targetRefs:
  - kind: Gateway
    name: my-l4route-tcp-gateway
    group: gateway.networking.k8s.io
    sectionName: "l4-nginx-tcp"

kubectl create -f NetPolicy-persistence.yaml
NetPolicy.gateway.k8s.f5.com/persistence-netpolicy created

kubectl get -f NetPolicy-persistence.yaml
NAME                    AGE
persistence-netpolicy   8s