Upgrade BIG-IP Next for Kubernetes (Host) from 2.3.x to 2.4.0 using Helm

If your deployment is on a specific version and you want to upgrade, check the Release Notes to learn about the fixes before upgrading. To successfully upgrade BNK from 2.3.x to 2.4.0, follow the instructions provided in the following sections in the specified sequence.

1. Upgrade CRDs

2. Upgrade the cert-manager

3. Upgrade the RabbitMQ

4. Upgrade the CWC

5. Upgrade the CRD Conversion pod

6. Upgrade the Coremond

7. Upgrade the Toda-fluentd

8. Upgrade the dSSM

9. Upgrade the F5ingress

10. Upgrade the OTeL

11. Upgrade the F5-observer pod

Prereqisites

• Download BNK (Host) manifest file, helm charts, docker images, and other utilities, Install BNK using Helm.

• Obtained JWT from MyF5.

Upgrade CRDs

1. Upgrade CRDs from the CRD bundle.

   $ helm upgrade f5-spk-crds-common f5-spk-crds-common-14.91.12-0.4.7.tgz -f crds_overrides.yaml
   

   Sample output:

   NAME: f5-spk-crds-common
   LAST DEPLOYED: Mon Aug 31 12:49:06 2026
   NAMESPACE: default
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   

2. Upgrade CRDs from the CRD bundle.

   $ helm upgrade f5-spk-crds-service-proxy f5-spk-crds-service-proxy-14.91.12-0.4.7.tgz -f crd.yaml
   

   Sample output

   NAME: f5-spk-crds-service-proxy
   LAST DEPLOYED: Mon Aug 31 12:50:58 2026
   NAMESPACE: default
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   

Upgrade the cert-manager

1. Verify the cert-manager-override-values.yaml contents.

   $ cat cert-manager-override-values.yaml
   

   image:
     repository: repo.f5.com/images
    
   webhook:
     image:
       repository: repo.f5.com/images
    
   cainjector:
     image:
       repository: repo.f5.com/images
    
   startupapicheck:
     image:
       repository: repo.f5.com/images
    
   init_container:
     image:
       name: init-certmgr
       repository: repo.f5.com/images
   
   logging_sidecar:
     # Enable/Disable logging sidecar
     enabled: false
     name: logging-sidecar
     image:
       repository: repo.f5.com/images
    
     fluentbit:
       input:
         pipes:
           bufSize: 8096
       tls:
         enabled: true
     fluentd:
       host: f5-toda-fluentd.spk-utilities.svc.cluster.local
   
     global:
       imagePullSecrets:
         - name: far-secret
   

2. Upgrade the Cert Manager.

   $ helm upgrade f5-certificate-manager tar/f5-cert-manager-0.27.9-0.0.2.tgz -n spk-utilities -f cert-manager-override-values.yaml
   

   Sample Output

   Release "f5-certificate-manager" has been upgraded. Happy Helming!
   NAME: f5-certificate-manager
   LAST DEPLOYED: Mon Aug 31 12:59:31 2026
   NAMESPACE: spk-utilities
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   NOTES:
   # Modified from and/or generated from (possibly modified), cert-manager source
   # f5-cert-manager
   

3. Verify the upgrated cert-manager in spk-utilities namespace.

   $ helm list -n spk-utilities
   

Upgrade the RabbitMQ

1. Verify the rabbitmq-values.yaml contents.

   $ cat rabbitmq-values.yaml
   

   image:
     repository: repo.f5.com/images
    
   imageCredentials:
     name: far-secret
   
   
   fluentbit_sidecar:
     enabled: true
     image:
       repository: repo.f5.com/images
     fluentbit:
       input:
         pipes:
           bufSize: 8096
       tls:
         enabled: true
     fluentd:
       host: f5-toda-fluentd.spk-utilities.svc.cluster.local
   

2. Upgrade the RabbitMQ.

   $ helm upgrade rabbitmq tar/rabbitmq-0.15.2.tgz -n spk-utilities -f rabbitmq-values.yaml 
   

   Sample output

   Release "rabbitmq" has been upgraded. Happy Helming!
   NAME: rabbitmq
   LAST DEPLOYED: Mon Aug 31 17:00:21 2026
   NAMESPACE: spk-utilities
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   NOTES:
   The RabbitMQ has been installed.
   

3. View the list of pods associated with spk-utilities namespace/project.

   $ oc get pods -n spk-utilities
   

Upgrade the CWC

1. Verify the cwc_overrides-2.4.0.yaml contents.

   $ cat cwc_overrides-2.4.0.yaml
   

   cwc:
     image:
       repository: repo.f5.com/images
   orch:
     image:
       repository: repo.f5.com/images
     persistence:
     enabled: true
     storageClass: managed-nfs-storage
     accessMode: ReadWriteOnce
     size: 3Gi
   fluentbit_sidecar:
     enabled: true
     image:
       repository: repo.f5.com/images
     fluentbit:
       input:
         pipes:
           bufSize: 8096
       tls:
         enabled: true
     fluentd:
       host: f5-toda-fluentd.f5-common.svc.cluster.local
   imageCredentials:
     name: far-secret
   kal:				
     enabled: true
     image:
       repository: repo.f5.com/images
   

2. Upgrade the CWC.

   $ helm upgrade cwc tar/cwc-0.92.22-0.0.14.tgz -n spk-utilities -f cwc_overrides-2.4.0.yaml --set rabbitmqNamespace=spk-utilities 
   

   Sample Output

   Release "cwc" has been upgraded. Happy Helming!
   NAME: cwc
   LAST DEPLOYED: Mon Aug 31 17:00:56 2026
   NAMESPACE: spk-utilities
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   NOTES:
   The Cluster Wide Controller has been installed.
   ====================================================
   Admin Token Feature: DISABLED
   No authentication token is required for REST API calls.
   ====================================================
   

3. View the list of pods associated with spk-utilities namespace/project.

   $ oc get pods -n spk-utilities
   

Upgrade the CRD Conversion pod

1. Add privileges to the crd-conv-f5-crdconversion service account.

   In this example, crd-conv-f5-crdconversion is composed of <helm name>-<helm chart>, where crd-conv represents the Helm name, and f5-crdconversion represents the Helm chart name. Update these values as per your deployment configuration.

   $ oc adm policy add-scc-to-user privileged -n spk-utilities -z crd-conv-f5-crdconversion
   

2. Verify the crd-conv-values.yaml contents.

   $ cat crd-conv-values.yaml
   

   crdconversion:
     image:
       repository: repo.f5.com/images
   
     rabbitmqNamespace: f5-common
   
     fluentbit_sidecar:
       enabled: true
       image:
         repository: repo.f5.com/images
       fluentbit:
         input:
           pipes:
             bufSize: 8096
         tls:
           enabled: true
       fluentd:
         host: f5-toda-fluentd.f5-common.svc.cluster.local
   global:
     core:
       mountPath: /shared/core
     imagePullSecrets:
       - name: far-secret
   
   

3. Install the CRD Conversion pod.

   Note

   Ensure that you add privileges to the <helm name> before installing the CRD Conversion pod. In the below example, crd-conv is the helm name.

   In this example, the new version of f5-crdconversion helm chart is 0.124.11.

   $ helm upgrade crd-conv tar/f5-crdconversion-0.124.11.tgz -f crd-conv-values.yaml -n  spk-utilities
   

   Sample output:

   Release "f5-crdconversion" has been upgraded. Happy Helming!
   NAME: f5-crdconversion
   LAST DEPLOYED: Mon Aug 31 17:02:59 2026
   NAMESPACE: spk-utilities
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   

Upgrade the Coremond

1. Verify the coremond-values.yaml contents.

   $ cat coremond-values.yaml
   

   image:
     repository: repo.f5.com/images
   
   persistence:
     storageClass: managed-nfs-storage
   
   resources:
     limits:
       cpu: "1"
       memory: 200
     requests:
       cpu: "0.5"
       memory: 50
   
   fluentbit_sidecar:
     enabled: true
     image:
       repository: repo.f5.com/images
     fluentbit:
       input:
         pipes:
           bufSize: 8096
         tls:
           enabled: true
     fluentd:
       host: f5-toda-fluentd.spk-utilities.svc.cluster.local
     resources:
       limits:
         cpu: "0.5"
         memory: "512Mi"
       requests:
         cpu: "0.2"
         memory: "256Mi"
   platformType: "ocp"
   imagePullSecrets:
     - name: far-secret
   

2. Upgrade the Coremond.

   $ helm upgrade f5-coremond tar/coremond-0.25.13-0.0.4.tgz -n spk-utilities -f coremond-values.yaml 
   

   Sample output

   Release "f5-coremond" has been upgraded. Happy Helming!
   NAME: f5-coremond
   LAST DEPLOYED: Mon Aug 31 17:03:31 2026
   NAMESPACE: spk-utilities
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   

3. View the list of pods associated with spk-utilities namespace/project.

   $ oc get pods -n spk-utilities
   

Upgrade the Toda-fluentd

1. Verify the toda.yaml contents.

   $ cat toda.yaml
   

   image:
     repository: repo.f5.com/images
     pullPolicy: Always
    
   dssm_logs:
     enabled: true
     stdout: true
    
   f5ingress_logs:
     enabled: true
     stdout: true
    
   dssm_sentinel_logs:
     enabled: true
     stdout: true
    
   persistence:
     enabled: true
    
   tls:
     enabled: true
   imageCredentials:
     name: far-secret
   

2. Upgrade the Toda-fluentd.

   $ helm upgrade f5-toda-fluentd tar/f5-toda-fluentd-2.10.7-0.0.2.tgz -f toda.yaml -n spk-utilities
   

   Sample output

   Release "f5-toda-fluentd" has been upgraded. Happy Helming!
   NAME: f5-toda-fluentd
   LAST DEPLOYED: Mon Aug 31 17:30:00 2026
   NAMESPACE: spk-utilities
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   NOTES:
   Log aggregator - FluentD is deployed, which get logs from fluentbit sidecars.
   FluentD outputs:
       'stdout' is "false"
       'persistent volume' is "true"
   Persistent volume claim created with:
       accessModes: "ReadWriteOnce"
       storage: "3Gi"
       
   FluentD hostname: f5-toda-fluentd.spk-utilities.svc.cluster.local.
   FluentD port: "54321"
   Use this info to connect to it:   
   --set f5-toda-logging.fluentd.host="f5-toda-fluentd.spk-utilities.svc.cluster.local."
   --set f5-toda-logging.fluentd.port=54321
   
   FluentD service IP family:        
       serviceIpFamily: .Values.serviceIpFamily
   

3. See the installed releases in spk-utilities namespace to check for newly installed cert-manager.

   helm list -n spk-utilities
   

4. View the list of pods associated with spk-utilities namespace/project.

   $ oc get pods -n spk-utilities
   

Upgrade the dSSM

To successfully upgrade dSSM, follow the instructions in Upgrading dSSM.

Note

The 2.4.0 chart value is f5-dssm-1.81.14-0.0.14.tgz.

Upgrade the F5Ingress

With the implementation of readinessGates (config and routing gates), we have ensured TMM is available to process the network traffic with minimal traffic loss. For more information, see TMM Rolling Update.

Important

Based on the maxUnavailable, maxSurge, and TMM replicas configuration, ensure that you have:

• Enough resources available.

• Additional SelfIPs and translationIPs (SNAT and CGNAT).

1. Verify the overrides-values-2.4.0.yaml contents.

   Note

   The following parameters are configured to ensure that, during the upgrade, the TMM pod is immediately available to receive network traffic with a very less traffic loss:

   • tmm.dynamicRouting.bfd is configured.

   $ cat overrides-values-2.4.0.yaml
   

   f5-tmm:
     enabled: true
     observer:
       enabled: true
       image:
         repository: repo.f5.com/images
     fluentbit:
       enabled: true
       logLevel: debug
       image:
         repository: repo.f5.com/images
       tls:
         enabled: true
       fluentd:
         host: f5-toda-fluentd.spk-utilities.svc.cluster.local.
         port: 54321
       sidecar:
         image:
           repository: repo.f5.com/images
       tmstats:
         enabled: true
         config:
           image:
             repository: repo.f5.com/images
     debug:
       enabled: true
       rabbitmqNamespace: spk-utilities
       image:
         repository: repo.f5.com/images
     blobd:
       enabled: true
       image:
         repository: repo.f5.com/images 
     tmm:
       image:
         repository: repo.f5.com/images
       tlsStore:
         enabled: true
       logLevel: INFO
       topologyManager: "true"
       replicaCount: 3
       strategy:
         type: RollingUpdate
         rollingUpdate:
           maxSurge: 1
           maxUnavailable: 0
   
       k8sprobes:
         enabled: true
   
       grpc:
         enabled: true
   
       nodeSelector:
         tmmnode: enabled
   
       sessiondb:
         useExternalStorage: "true"
   
       dynamicRouting:
         enabled: true
         useZebosLegacy: true
         tmmRouting:
           config:
             bgp:
               asn: 64522
               bgpSecret: bgp-secret
               gracefulRestartTime: 120
               neighbors:
               - ip : 10.22.1.246
                 asn: 64521
                 acceptsIPv4: true
                 fallover: true
               - ip : fc22:1::240
                 asn: 64521            
                 acceptsIPv6: true
                 fallover: true
             bfd:
             interface: external 
             interval: 100
             minrx: 100
             multiplier: 3
           image:
             repository: repo.f5.com/images
         tmrouted:
           image:
             repository: repo.f5.com/images
   
       cniNetworks: "spk-ingress/spk-ingress-internal-sriov,spk-ingress/spk-ingress-external-sriov"
   
   
       customEnvVars:
       - name: SESSIONDB_EXTERNAL_SERVICE
         value: "f5-dssm-sentinel.spk-utilities"
       - name: SESSIONDB_DISCOVERY_SENTINEL
         value: "true"
       - name: OPENSHIFT_VFIO_RESOURCE_1
         value: "sriovEns21f0np0Mlx5NetdevPolicy"
       - name: OPENSHIFT_VFIO_RESOURCE_2
         value: "sriovEns21f1np1Mlx5NetdevPolicy"
       - name: SSL_SERVERSIDE_STORE
         value: "/tls/tmm/mds/clt"
       - name: SSL_TRUSTED_CA_STORE
         value: "/tls/tmm/mds/clt"
       - name: TMM_DEFAULT_MTU
         value: "9000"
       - name: CONFIG_VIEWER_ENABLE
         value: "TRUE"
   
       icni2:
         enabled: false
       ovn_meg:
         enabled: true
       network:
         vfio:
           enabled: false
         attachment:
           definitionName: spk-ingress/internal-sriov
   
   ## AFM Pod Values 
   f5-afm:
     enabled: true
     afm:
       enabled: true
       pccd:
         enabled: true
         debug: true
         image:
           repository: repo.f5.com/images
           pullPolicy: IfNotPresent   
         securityContext:
           allowPrivilegeEscalation: false
           runAsUser: 10000
       fluentbit_sidecar:
         enabled: true
         image:
           repository: repo.f5.com/images
           pullPolicy: IfNotPresent
         fluentbit:
           tls:
             enabled: true
         fluentd:
           host: f5-toda-fluentd.spk-utilities.svc.cluster.local.
           port: 54321
   
   global:
     tmmDefaultMTU: 9000
     controller:
       crdupdater:
         enabled: true
         grpc:
           port: 8752
     afm:
       enabled: true
       pccd:
         enabled: true
     imageCredentials:
       name: far-secret
   
   f5-stats_collector:
     enabled: true
     image:
       repository: repo.f5.com/images
   
   controller:
     cwcNamespace: spk-utilities
     watchNamespace: "appns-1,appns-2"
     enableCustomResources: false
     csrcNamespace: spk-utilities
     image:
       repository: repo.f5.com/images
     vlan_grpc:
       enabled: true
     fluentbit_sidecar:
       enabled: true
       fluentd:
         host: f5-toda-fluentd.spk-utilities.svc.cluster.local
       image:
           repository: repo.f5.com/images
       fluentbit:
         tls:
           enabled: true
   
     tmm_pod_manager:
       enabled: true
       image:
         repository: repo.f5.com/images
   
     f5_lic_helper:
       enabled: true
       name: f5-lic-helper
       rabbitmqNamespace: spk-utilities
       image:
           repository: repo.f5.com/images
   
   debug:
     image:
       repository: repo.f5.com/images
   
   afm:
     name: f5-afm
     enabled: false
   imageCredentials:
     name: far-secret
   

2. (Optional) If you have f5-afm pod enabled in values.yaml, add privileges to the f5-afm service account.

   $ oc adm policy add-scc-to-user privileged -n spk-ingress -z f5-afm
   

3. Upgrade the F5ingress using the new F5ingress helm chart version mentioned in the BNK (Host) 2.4.0 release-manifest version.

   Note

   Before upgrading F5ingress, ensure that readinessGates.enabled is set to true in overrides-values-2.4.0.yaml.

   $ helm upgrade f5ingress tar/f5ingress-<version>.tgz -f <values>.yaml -n namespace
   

   In this example, the Pods will be upgraded using the f5ingress-v15.1016.2-0.4.115 Helm chart.

   $ helm upgrade f5ingress tar/f5ingress-v15.1016.2-0.4.115.tgz -f overrides-values-2.4.0.yaml -n spk-ingress
   

   Sample output

   Release "f5ingress" has been upgraded. Happy Helming!
   NAME: f5ingress
   LAST DEPLOYED: Mon Aug 31 18:08:01 2026
   NAMESPACE: spk-ingress
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   NOTES:
   The F5Ingress Controller has been installed.
   TMM debug sidecar is deployed. To access: kubectl exec -it deployment/f5-tmm -c debug -n spk-ingress -- bash
   

   Note

   Need to use extra vlan IP and extra snat IP for the traffic to work seamlessly after upgrade. with maxSurge 1 and maxUnavailable 0.

4. View the list of pods associated with spk-ingress namespace/project.

   $ oc get pods -n spk-ingress -o wide
   

5. See the installed releases in spk-ingress namespace.

   In this example, the below command shows the installed releases in spk-ingress Project.

   $ helm list -n spk-ingress
   

6. During F5ingress update process, run the below command to check the status of readinessGates (ConfigurationDone and RoutingDone gates).

   In this example, the f5-tmm-7fb766f798-6bgbk is TMM pod.

   $ oc describe pod f5-tmm-7fb766f798-6bgbk
   

   Sample output

   Readiness Gates:
     Type                Status
     ConfigurationDone   True
     RoutingDone         True
   

7. If you want to use the Multiple External Gateway (MEG) with BNK (Host) 2.4.0, apply the AdminPolicyBasedExternalRoute CR. For more information, see AdminPolicyBasedExternalRoute

Upgrade the OTeL

1. Verify the otel-override.yaml contents.

   $ cat otel-override.yaml
   

   Override value file: otel-override.yaml

   enabled: true
   cert-orchestrator:
     enabled: true
   image:
     repository: repo.f5.com/images
   resources:
     requests:
       cpu: 1m
       memory: 1Mi
   exporters:
     prometheus:
       namespace: ""
   otelCustomConf: |
     exporters:
       otlp:
         endpoint: otel-test.default.svc.cluster.local:4317
         tls:
           insecure: true
         retry_on_failure:
           enabled: true
           initial_interval: 1s
           max_interval: 10s
           max_elapsed_time: 0
     service:
       pipelines:
         metrics:
           exporters: [otlp, prometheus]
   global:
     imageCredentials:
       name: far-secret
   

2. Upgrade the OTeL.

   $ helm upgrade otel tar/f5-stats_collector-1.0.52.tgz -n spk-ingress -f otel.yaml
   

   Sample output

   Release "otel" has been upgraded. Happy Helming!
   NAME: otel
   LAST DEPLOYED: Mon Aug 31 17:31:55 2026
   NAMESPACE: spk-ingress
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   

Upgrade the F5-observer pod

Important

Required manual steps before upgrading Observer

The Observer custom resource definitions (CRDs) have been renamed from the metrics.f5.net domain to the metrics.f5.com domain from the 2.4.0 release. The following table shows the previous and new CRDs:

Previous CRD	New CRD
scrapetemplates.metrics.f5.net	scrapetemplates.metrics.f5.com
scrapeclasses.metrics.f5.net	scrapeclasses.metrics.f5.com
scrapes.metrics.f5.net	scrapes.metrics.f5.com

Helm does not recreate CRDs during an upgrade by default. You must complete the following manual steps to apply the new CRDs before you upgrade:

1. Apply the new CRDs directly from the Observer chart:

   helm show crds .../f5-toda-observer-<UPGRADE_VERSION>.tgz | kubectl apply -f -
   

2. Remove stale objects from the old CRD group:

   kubectl delete scrapetemplate.metrics.f5.net --all --all-namespaces || true
   kubectl delete scrapeclass.metrics.f5.net --all || true
   

3. Upgrade the Observer:

   helm upgrade observer .../f5-toda-observer-<UPGRADE_VERSION>.tgz ...
   

4. Upgrade the Ingress:

   helm upgrade f5ingress .../<UPGRADE_F5INGRESS_VERSION>.tgz ...
   

5. (Optional) Remove the old CRD definitions:

   kubectl delete crd scrapetemplates.metrics.f5.net
   kubectl delete crd scrapeclasses.metrics.f5.net
   kubectl delete crd scrapes.metrics.f5.net
   

1. Verify the observer-override.yaml contents.

   $ cat observer-override.yaml
   

   Override value file: observer-override.yaml

   tolerations:
     observer:
       - key: "node.kubernetes.io/not-ready"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
       - key: "node.kubernetes.io/unreachable"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
     operator:
       - key: "node.kubernetes.io/not-ready"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
       - key: "node.kubernetes.io/unreachable"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
     receiver:
       - key: "node.kubernetes.io/not-ready"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
       - key: "node.kubernetes.io/unreachable"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
   
   image:
     repository: repo.f5.com/images
   imagePullSecrets:
     - name: far-secret
   
   revisionHistoryLimit: 10
   
   replicas: 3
   
   resources:
     observer:
       limits:
         cpu: 1
         memory: 1Gi
       requests:
         cpu: 1
         memory: 1Gi
     operator:
       limits:
         cpu: 1
         memory: 1Gi
       requests:
         cpu: 1
         memory: 1Gi
     receiver:
       limits:
         cpu: 1
         memory: 1Gi
       requests:
         cpu: 1
         memory: 1Gi
   
   persistence:
     enabled: true
     storageClassName: managed-nfs-storage
     size: 3Gi
   
   platformType:
   
   targets_namespaces:
     - spk-ingress
   
   ## Fluentbit sidecar values
   fluentbit_sidecar:
     image:
       repository: repo.f5.com/images
       pullPolicy: Always
     resources:
       limits:
         cpu: "0.5"
         memory: "512Mi"
       requests:
         cpu: "0.25"
         memory: "256Mi"
   
     fluentbit:
       tls:
         enabled: true
     fluentd:
       host: f5-toda-fluentd.vad-f5-spk.svc.cluster.local.
       port: 54321
    
   

2. Upgrade the F5-observer pod.

   $ helm upgrade f5-toda-observer tar/f5-toda-observer-5.36.5-0.3.2.tgz -n spk-ingress -f observer-override.yaml
   

   Sample output

   Release "f5-toda-observer" has been upgraded. Happy Helming!
   NAME: f5-toda-observer
   LAST DEPLOYED: Mon Aug 31 13:14:22 2026
   NAMESPACE: spk-ingress
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None