BNK Gateway configuration resources overview

Use the F5 BIG-IP Next for Kubernetes (BNK) custom resource definitions (CRDs) to extend the Kubernetes API and set up the Traffic Management Microkernel (TMM). TMM then handles low-latency application traffic and applies networking configurations such as interface IP addresses and static routes. For the parameters available for each resource, see its reference page.

Networking resources

Networking resources configure the networking components of TMM, such as network interfaces and static routes.

Available network management resources include:

  • F5SPKVlan - TMM interface configuration: VLANs, self IP addresses, MTU sizes, and so on.

  • F5SPKStaticRoute - TMM static routing table management.

  • F5SPKSnatpool - Allocates IP addresses for egress pod connections.

Application traffic resources

When you apply an application traffic resource, TMM acts as a proxy and distributes application traffic through protocols like TCP and UDP. TMM then receives the objects that manage this traffic. BNK supports the Gateway API open source standards and uses its route resources, such as HTTPRoute and GRPCRoute, to route ingress traffic. For more information, see Gateway API.

Object

Description

Virtual Server

An IP address and service port that receives and processes ingress or egress application traffic.

Network Virtual Server

An IP address subnet that represents a range of destination IP addresses for ingress application traffic.

Protocol Profile

Provides application traffic intelligence and options to adapt how TMM handles connections.

Load Balancing Pool

The Service object endpoints that TMM distributes traffic to using round robin load balancing.

Available traffic management resources include:

  • Ingress load balancing

    • F5 resources:

      • Apply the F5 L4Route CR to act as an application developer.

    • Gateway API community resources:

      BNK supports these community-based CRs:

      • Gateway: Apply the Gateway CR as the entry point to manage internal and external traffic. This CR takes the role of the cluster operator.

      • HTTPRoute: Use the HTTPRoute CR to define and manage routing rules for HTTP traffic in a Kubernetes cluster. This CR takes the role of the application developer.

      • GRPCRoute: Use the GRPCRoute CR to handle gRPC traffic in a Kubernetes cluster. This CR takes the role of the application developer.

      • F5BigCneIrule: Use iRules to extend the traffic processing of the TMM proxy pod.

  • Egress load balancing

    • F5SPKEgress - Manages egress application traffic for pods using SNAT, shared SNAT with flow forwarding, security protection, PseudoCNI, and VXLAN creation.

Protection resources

Use Protection resources with Traffic Management resources to protect applications against unauthorized and malicious network traffic. These resources include:

  • F5BigFwPolicy - Granular stateful-flow filtering based on access control list (ACL) policies. For firewall policy support in Gateway API, see Firewall policy in Gateway API.

  • F5BigFwRulelist - A collection of firewall rules that define and enforce traffic filtering and security policy.

  • F5BigDdosGlobal - Configures the TMM proxy pod to inspect and protect applications from denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks.

Common resources

Define global options and reference objects consumed by multiple traffic, security, and firewall CRs.

  • F5BigGlobalOptions - Options to turn crypto hardware acceleration on or off on the BlueField-3 Data Processing Unit (DPU).

The following CRs support BNK firewall logging:

Adapter resources

Bridge Gateway API resources to BNK (DPU) features by attaching traffic-management and security policies to gateways, listeners, and routes.

  • NetPolicy - Defines policies with the policy attachment pattern. It integrates iRule CRDs with Gateway API CRDs to set up traffic management for gateways and listeners.

  • SecPolicy - Attaches security policies such as ACLs, DoS, and logging profiles to Gateway API objects. It follows GEP 2648 for policy management and status tracking.

Infrastructure resources

Define the BNK (DPU) or Gateway infrastructure entry points and controller ownership for the cluster.

  • BNKGateway - Defines the BNK infrastructure entry point and controller ownership for the cluster.

  • GatewayClass: Apply the GatewayClass CR in the cluster. This CR takes the role of the infrastructure provider.

Intelligent load balancing resources

Use metric-driven, adaptive pool weighting to optimize backend traffic distribution.

  • F5BigAnalyzer: Monitors GPU and LLM performance metrics to recommend traffic weights for backend pool load balancing. It uses built-in NIM metrics or custom scripts, and it updates weights through HTTPRoute annotations.

Finalizers resources

Finalizers prevent resource deletion until BNK safely removes the backend configuration. This keeps cleanup reliable and consistent.

  • Finalizers are namespaced keys that tell Kubernetes to wait for specific conditions before it deletes a resource. The BNK Controller uses finalizers to keep CRs and backend configurations consistent.

  • The BNK Controller adds a finalizer to each new custom resource.

  • When you delete a resource, the BNK Controller first removes the backend configuration and then removes the finalizer. Kubernetes can then complete the deletion. While the finalizer remains, the resource is not deleted.

  • If the BNK Controller is offline, the finalizer prevents deletion. When the controller comes back online, it removes the backend configuration and then the finalizer. This ensures that resources are deleted only after BNK removes the backend configuration.