CNEInstance

Overview

Function

Defines the configuration for an F5 BIG-IP Cloud-Native Edition installation, including product type, deployment sizing, feature enablement, networking, telemetry, and advanced component overrides.

Names

Singular name	Plural name	Short name
cneinstance	cneinstances	—

API group and version

k8s.f5.com/v1

Scope

Namespace

Specification

spec

Field	Required	Default	Description
access object	No	—	Enables or disables access policy management (f5-access-apmd).
advanced object	No	—	Allows pass-through configuration, such as pod environment variables, for individual service components. Use this section to support non-default environments like proof-of-concept features or demonstrations.
behavioralDoS object	No	—	Enables or disables behavioral denial-of-service (DoS) protection (f5-bdosd).
certificate object	No	—	Configures certificate management settings.
cgnat object	No	—	Enables or disables Carrier-Grade Network Address Translation (CGNAT).
coreCollection object	No	—	Mounts the relevant core dump location on the host path for all containers in all pods.
deploymentSize string	Yes	—	Sets the size of the deployment. Accepted values: Tiny, Small, Medium, Large, Max. You can override specific resource sizing for individual components in the advanced section.
dpu object	No	—	Configures DPU (data processing unit) node support for this installation.
dynamicRouting object	No	—	Enables or disables dynamic routing.
eppNamespaces string array	No	—	Specifies the namespaces where the CNE Controller may create and manage Endpoint Policy Provider (EPP) stack resources. Use ["All"] to grant cluster-wide access. When empty (default), EPP RBAC is disabled. Each value must match the pattern ^$|^All$|^[a-z][a-z0-9-]*$ and be 63 characters or fewer.
externalBigip object	No	—	Enables or disables the External BIG-IP Controller.
firewallACL object	No	—	Enables or disables firewall ACL support.
intelligentLB object	No	—	Enables or disables the intelligent load balancer (f5-analyzer).
intrusionPrevention object	No	—	Enables or disables intrusion prevention.
ipIntelligence object	No	—	Enables or disables IP intelligence.
ipsec object	No	—	Configures IPsec feature settings.
manifestVersion string	Yes	—	Specifies the version to install.
networkAttachments string array	No	—	Defines the instance network attachments for typical environments. The operator parses the network attachment definitions to validate they exist, retrieve resource names, and build the ordered environment variable list for TMM. You can override these settings with advanced section attributes.
placement object	No	—	Configures pod scheduling constraints (affinity, node selection, tolerations, topology spread constraints, and priority class) for control-plane, data-plane, observability, and session-state components.
policyEnforcement object	No	—	Enables or disables policy enforcement.
product object	Yes	—	Specifies the product configuration for this installation, including the product type and Gateway API enablement.
pseudoCNI object	No	—	Enables or disables the pseudo Container Network Interface (CNI).
registry object	Yes	—	Specifies the container registry configuration for pulling images and charts.
sessionStore object	No	—	Configures the DSSM session store topology.
storageClassName string	No	—	Specifies the name of the storage class for component persistent volume claims.
telemetry object	No	—	Configures logging and metric subsystem settings.
tmmReplicas integer	No	1	When wholeCluster and dpu are both false, this field defines how many replicas of TMM to deploy.
watchNamespaces string array	No	—	Specifies the namespaces the CNE Controller watches for custom resources. Must be empty or omitted when wholeCluster is true. Each value must match the pattern ^$|^All$|^[a-z][a-z0-9-]*$ and be 63 characters or fewer.
wholeCluster boolean	No	false	When true, this installation covers the entire cluster.

spec.access

Field	Required	Default	Description
cacheResolverAddr string	No	10.96.0.10	Specifies the address of the DNS cache resolver used by the APM dispatcher.
cacheResolverPort integer	No	53	Specifies the port of the DNS cache resolver used by the APM dispatcher.
enabled boolean	No	false	Enables or disables access policy management.

spec.advanced

Field	Required	Description
analyzer object	No	Overrides for the analyzer component.
bdosd object	No	Overrides for the behavioral DoS daemon component.
cneController object	No	Overrides for the CNE Controller component.
coremon object	No	Overrides for the core monitor component.
crdConversion object	No	Overrides for the CRD conversion component.
crdInstaller object	No	Overrides for the CRD installer component.
crdListConfigMap object	No	Optional reference to a ConfigMap that contains a list of custom resources to watch. By default, the CNE Controller lists all installed CRDs and watches the known custom resources.
cwc object	No	Overrides for the CWC component.
demoMode object	No	Relaxes DPU-related environment requirements so that an instance can be installed on a cluster without DPU nodes. When enabled, forces the deployment size to Tiny.
downloader object	No	Overrides for the downloader component.
dssm object	No	Overrides for the DSSM component.
dwbld object	No	Overrides for the dwbld component.
envDiscovery object	No	Overrides for the environment discovery component.
externalBigip object	No	Overrides for the External BIG-IP Controller component.
firewallACL object	No	Overrides for the firewall ACL component.
fluentd object	No	Overrides for the Fluentd component.
ipamController object	No	Overrides for the IPAM controller component.
ipsd object	No	Overrides for the IPS daemon component.
ipsec object	No	Overrides for the IPsec component.
maintenanceMode object	No	When enabled, the operator does not overwrite changes to underlying component resources.
nodeLabeler object	No	Overrides for the node labeler component.
observer object	No	Overrides for the observer component.
otel object	No	Overrides for the OpenTelemetry component.
otelCollector object	No	Overrides for the OpenTelemetry Collector component.
pseudoCNI object	No	Overrides for the pseudo CNI component.
rabbitmq object	No	Overrides for the RabbitMQ component.
tmm object	No	Overrides for the TMM component.

Note

Enabling maintenanceMode before installation prevents any components from being installed. Use this setting only for maintenance of underlying resources after initial installation.

spec.advanced.analyzer

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.bdosd

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.cneController

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.coremon

Field	Required	Description
env object array	No	A list of environment variables. See env.
hostPath boolean	No
resources object	No	Compute resource requirements. See resources.

spec.advanced.crdConversion

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.crdInstaller

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.crdListConfigMap

Field	Required	Description
name string	No	Name of the ConfigMap that contains the list of custom resources to watch.

spec.advanced.cwc

Field	Required	Description
assistant object	No	Configures the CWC assistant.
env object array	No	A list of environment variables. See env.
kal object	No	Configures the Kubernetes Aggregated Layer.
resources object	No	Compute resource requirements. See resources.

spec.advanced.cwc.assistant

Field	Required	Description
enabled boolean	No	Enables or disables the CWC assistant.
env object array	No	A list of environment variables. See env.

spec.advanced.cwc.kal

Field	Required	Default	Description
enabled boolean	No	—	Enables or disables the Kubernetes Aggregated Layer.
image string	No	—	Specifies the container image.
logLevel string	No	—	Sets the log level. Accepted values: Trace, Debug, Info, Notice, Warning, Error, Critical, Alert, Emergency.
port integer	No	—	Specifies the service port.
qkviewGrpcPort integer	No	—	Specifies the gRPC port for qkview.
version string	No	—	Specifies the image version.

spec.advanced.demoMode

Field	Required	Description
enabled boolean	No	Enables or disables demo mode. When enabled, relaxes DPU-related environment requirements and forces the deployment size to Tiny.

spec.advanced.downloader

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.dssm

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.dwbld

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.envDiscovery

Field	Required	Default	Description
disableCheckAnnotations boolean	No	false	Disables checking for required Kubernetes annotations.
disableCheckGenerics boolean	No	false	Disables generic environment checks.
disableCheckHugepages boolean	No	false	Disables checking for HugePages.
disableCheckLabels boolean	No	false	Disables checking for Kubernetes labels.
disableCheckSFConfig boolean	No	false	Disables checking for SmartNIC SR-IOV configuration.
disableCheckServerConfig boolean	No	false	Disables checking for server configuration.
disableCheckTaints boolean	No	false	Disables checking for Kubernetes taints.
disableCheckVFs boolean	No	false	Disables checking for SR-IOV Virtual Functions.
enabled boolean	No	false	Enables environment discovery jobs to run on all nodes in the cluster.
env object array	No	—	A list of environment variables. See env.
resources object	No	—	Compute resource requirements. See resources.

spec.advanced.externalBigip

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.firewallACL

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.fluentd

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.ipamController

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.ipsd

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.ipsec

Field	Required	Description
annotations map (string: string)	No	Annotations to apply to the IPsec pods (for example, Multus network attachments).
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.maintenanceMode

Field	Required	Description
enabled boolean	No	Enables or disables maintenance mode. When enabled, the operator does not overwrite changes to underlying component resources and does not process changes to this resource.

spec.advanced.nodeLabeler

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.observer

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.otel

Field	Required	Description
env object array	No	A list of environment variables. See env.
prometheusNamespace string	No	Specifies the Prometheus namespace for metrics collection.

spec.advanced.otelCollector

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.pseudoCNI

Field	Required	Default	Description
disablePortAutodetect boolean	No	false	Disables automatic host-port conflict detection and fallback for both CSRC host ports (the pseudo CNI gRPC server and the TCP health probe). When true, the operator always uses the default ports and never rotates them. Leave unset or set to false to keep automatic port-conflict recovery enabled.
env object array	No	—	A list of environment variables. See env.
resources object	No	—	Compute resource requirements. See resources.

spec.advanced.rabbitmq

Field	Required	Description
env object array	No	A list of environment variables. See env.
resources object	No	Compute resource requirements. See resources.

spec.advanced.tmm

Field	Required	Description
annotations map (string: string)	No	Annotations to apply to the TMM pods.
env object array	No	A list of environment variables (maximum 100 items). See env.
resources object	No	Overrides the resource requests and limits for TMM pods over the values set by the deploymentSize field. See resources.
rollingUpdate object	No	Configures rolling update behavior for TMM.

spec.advanced.tmm.rollingUpdate

Field	Required	Description
maxSurge integer or string	No	The maximum number of pods that can be created above the desired number of pods during a rolling update.
maxUnavailable integer or string	No	The maximum number of pods that can be unavailable during a rolling update.

env

The following table describes the env array used by components in the advanced section. Each item is a Kubernetes EnvVar object. Unless noted otherwise, the maximum number of items is 50.

Field	Required	Description
name string	Yes	The name of the environment variable. May contain any printable ASCII characters except =.
value string	No	The literal value for the variable. Variable references $(VAR_NAME) are expanded using previously defined environment variables. Defaults to an empty string.
valueFrom object	No	A source for the variable’s value. Cannot be used when value is not empty. Supports configMapKeyRef, fieldRef, fileKeyRef, resourceFieldRef, and secretKeyRef.

resources

The following table describes the resources object used by components in the advanced section. It follows the standard Kubernetes ResourceRequirements structure.

Field	Required	Description
claims object array	No	Lists the names of resources, defined in spec.resourceClaims, that this container uses. Requires the DynamicResourceAllocation feature gate. This field is immutable.
limits map (string: quantity)	No	Describes the maximum amount of compute resources allowed.
requests map (string: quantity)	No	Describes the minimum amount of compute resources required. When omitted, defaults to the value of limits if set. Cannot exceed limits.

Note

For a list of valid resource types you can use as keys in limits and requests, see Resource types.

spec.behavioralDoS

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables behavioral DoS protection.

spec.certificate

Field	Required	Description
clusterIssuer string	No	Specifies the cluster issuer name for certificate management.

spec.cgnat

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables CGNAT.

spec.coreCollection

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables core dump collection.

spec.dpu

Field	Required	Default	Description
dpf object	No	—	Configures DPF (DPU Platform Framework) usage. When enabled, the instance deploys TMM on DPUs using a DPUService resource.
enabled boolean	No	false	Enables or disables DPU node support.

spec.dpu.dpf

Field	Required	Default	Description
dpuCluster object array	Yes	—	Specifies the DPU clusters this installation is associated with. Each item is a Kubernetes ObjectReference. Minimum one item required.
enabled boolean	No	false	Enables or disables the DPF configuration.
mode string	No	HostTrusted	Specifies the DPF mode. Accepted values: HostTrusted, ZeroTrust.

spec.dynamicRouting

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables dynamic routing.

spec.externalBigip

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables the External BIG-IP Controller.

spec.firewallACL

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables firewall ACL support.

spec.intelligentLB

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables the intelligent load balancer.

spec.intrusionPrevention

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables intrusion prevention.

spec.ipIntelligence

Field	Required	Description
enabled boolean	No	Enables or disables IP intelligence.

spec.ipsec

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables IPsec.
serviceName string	No	grpc-ipsec-svc	Specifies the gRPC service name for IPsec.

spec.placement

Field	Required	Description
controlPlane object	No	Scheduling constraints for control-plane component pods.
dataPlane object	No	Scheduling constraints for data-plane component pods.
observability object	No	Scheduling constraints for observability component pods.
sessionState object	No	Scheduling constraints for session-state component pods.

All four objects share the same structure, described below.

spec.placement.controlPlane / spec.placement.dataPlane / spec.placement.observability / spec.placement.sessionState

Field	Required	Description
affinity object	No	A standard Kubernetes Affinity object that defines scheduling constraints for the component’s pods. Supports nodeAffinity, podAffinity, and podAntiAffinity.
nodeSelector object	No	A map of key-value pairs. Pods are scheduled only on nodes whose labels match all specified pairs.
priorityClassName string	No	The name of a PriorityClass to assign to the component’s pods.
tolerations object array	No	A list of standard Kubernetes Toleration objects applied to the component’s pods.
topologySpreadConstraints object array	No	A list of standard Kubernetes TopologySpreadConstraint objects applied to the component’s pods.

spec.policyEnforcement

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables policy enforcement.

spec.product

Field	Required	Default	Description
type string	Yes	—	Specifies the product type. Accepted values: BNK, CNF.
gatewayAPI boolean	No	—	Enables Gateway API support. Can only be set to true when type is BNK.

Note

When type is BNK and gatewayAPI is true, you must either set wholeCluster to true or set watchNamespaces to ["All"]. When type is CNF, gatewayAPI must be false or unset, and wholeCluster must be false or unset.

spec.pseudoCNI

Field	Required	Default	Description
enabled boolean	No	false	Enables or disables the pseudo CNI.

spec.registry

Field	Required	Default	Description
imagePullPolicy string	No	IfNotPresent	Specifies the image pull policy. Accepted values: Always, Never, IfNotPresent.
imagePullSecrets object array	No	—	A list of Kubernetes LocalObjectReference objects that specify image pull secrets.
uri string	Yes	—	Specifies the URI of the OCI-compliant container registry to pull images and charts from.

spec.registry.imagePullSecrets[]

Field	Required	Description
name string	Yes	Name of the Secret that contains the registry credentials.

spec.sessionStore

Field	Required	Description
clustered object	No	Enables Redis Cluster mode when present.

spec.sessionStore.clustered

Field	Required	Default	Description
replicasPerShard integer	No	—	Specifies the number of read replicas per primary shard. Minimum value: 0.
shardCount integer	No	—	Specifies the number of Redis primary shards. Minimum value: 1.

spec.telemetry

Field	Required	Description
loggingSubsystem object	No	Configures the logging subsystem (Fluentd, Fluentbit, and related persistent volumes).
metricSubsystem object	No	Configures the metric subsystem (OpenTelemetry Collector, tmstatsd, observer, and Prometheus settings).

spec.telemetry.loggingSubsystem

Field	Required	Default	Description
enabled boolean	No	true	Enables or disables the logging subsystem.
logLevel string	No	Info	Sets the log level. Accepted values: Trace, Debug, Info, Notice, Warning, Error, Critical, Alert, Emergency.
nostdout boolean	No	false	When true, silences stdout logging for every component’s Go containers managed by this resource.

spec.telemetry.metricSubsystem

Field	Required	Default	Description
enabled boolean	No	true	Enables or disables the metric subsystem.
exporter string	No	—	Specifies the metrics exporter mode. Accepted values: OTelAggregated (shared observer and OpenTelemetry Collector pipeline), PrometheusScrape (component-local promhttp exposure without OpenTelemetry Collector), OTel (component-local promhttp exposure with OpenTelemetry Collector scraping).