Upgrade BIG-IP Next for Kubernetes (Host) from 2.4.1 to 2.4.2 using Helm

If your deployment is on a specific version and you want to upgrade, check the Release Notes to learn about the fixes before upgrading. To successfully upgrade BNK from 2.4.1 to 2.4.2, follow the instructions provided in the following sections in the specified sequence.

1. Upgrade CRDs

2. Upgrade the cert-manager

3. Upgrade the RabbitMQ

4. Upgrade the CWC

5. Upgrade the CRD Conversion pod

6. Upgrade the Coremond

7. Upgrade the Toda-fluentd

8. Upgrade the dSSM

9. Upgrade the F5ingress

10. Upgrade the OTeL

11. Upgrade the F5-observer pod

Prereqisites

• Download BNK (Host) manifest file, helm charts, docker images, and other utilities, Install BNK using Helm.

• Obtained JWT from MyF5.

Upgrade CRDs

1. Upgrade CRDs from the CRD bundle.

   $ helm upgrade f5-spk-crds-common f5-spk-crds-common-14.91.12-0.18.1.tgz -f crds_overrides.yaml
   

   Sample output:

   NAME: f5-spk-crds-common
   LAST DEPLOYED: Mon Aug 31 12:49:06 2026
   NAMESPACE: default
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   

2. Upgrade CRDs from the CRD bundle.

   $ helm upgrade f5-spk-crds-service-proxy f5-spk-crds-service-proxy-14.91.12-0.18.1.tgz -f crd.yaml
   

   Sample output

   NAME: f5-spk-crds-service-proxy
   LAST DEPLOYED: Mon Aug 31 12:50:58 2026
   NAMESPACE: default
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   

Upgrade the cert-manager

1. Verify the cert-manager-override-values.yaml contents.

   $ cat cert-manager-override-values.yaml
   

   image:
     repository: repo.f5.com/images
    
   webhook:
     image:
       repository: repo.f5.com/images
    
   cainjector:
     image:
       repository: repo.f5.com/images
    
   startupapicheck:
     image:
       repository: repo.f5.com/images
    
   init_container:
     image:
       name: init-certmgr
       repository: repo.f5.com/images
   
   logging_sidecar:
     # Enable/Disable logging sidecar
     enabled: false
     name: logging-sidecar
     image:
       repository: repo.f5.com/images
    
     fluentbit:
       input:
         pipes:
           bufSize: 8096
       tls:
         enabled: true
     fluentd:
       host: f5-toda-fluentd.spk-utilities.svc.cluster.local
   
     global:
       imagePullSecrets:
         - name: far-secret
   

2. Upgrade the Cert Manager.

   $ helm upgrade f5-certificate-manager tar/tar/f5-cert-manager-0.27.9-0.0.6.tgz -n f5-cne-core -f cert-manager-override-values.yaml
   

   Sample Output

   Release "f5-certificate-manager" has been upgraded. Happy Helming!
   NAME: f5-certificate-manager
   LAST DEPLOYED: Mon Aug 31 12:59:31 2026
   NAMESPACE: f5-cne-core
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   NOTES:
   # Modified from and/or generated from (possibly modified), cert-manager source
   # f5-cert-manager
   

3. Verify the upgraded cert-manager:

   $ helm list -n f5-cne-core
   

Upgrade the RabbitMQ

1. Verify the rabbitmq-values.yaml contents.

   $ cat rabbitmq-values.yaml
   

   image:
     repository: repo.f5.com/images
    
   imageCredentials:
     name: far-secret
   
   
   fluentbit_sidecar:
     enabled: true
     image:
       repository: repo.f5.com/images
     fluentbit:
       input:
         pipes:
           bufSize: 8096
       tls:
         enabled: true
     fluentd:
       host: f5-toda-fluentd.spk-utilities.svc.cluster.local
   

2. Upgrade the RabbitMQ.

   $ helm upgrade rabbitmq tar/rabbitmq-0.15.2-0.0.4.tgz -n f5-cne-core -f rabbitmq-values.yaml 
   

   Sample output

   Release "rabbitmq" has been upgraded. Happy Helming!
   NAME: rabbitmq
   LAST DEPLOYED: Mon Aug 31 17:00:21 2026
   NAMESPACE: f5-cne-core
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   NOTES:
   The RabbitMQ has been installed.
   

3. View the pods in the f5-cne-core namespace.

   $ oc get pods -n f5-cne-core
   

Upgrade the CWC

1. Verify the cwc_overrides-2.4.2.yaml contents.

   $ cat cwc_overrides-2.4.2.yaml
   

2. Upgrade the CWC.

   $ helm upgrade cwc tar/cwc-0.92.22-0.0.29.tgz -n f5-cne-core -f cwc_overrides-2.4.2.yaml --set rabbitmqNamespace=f5-cne-core 
   

   Sample Output

   Release "cwc" has been upgraded. Happy Helming!
   NAME: cwc
   LAST DEPLOYED: Mon Aug 31 17:00:56 2026
   NAMESPACE: f5-cne-core
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   NOTES:
   The Cluster Wide Controller has been installed.
   ====================================================
   Admin Token Feature: DISABLED
   No authentication token is required for REST API calls.
   ====================================================
   

3. View the pods in the f5-cne-core namespace.

   $ oc get pods -n f5-cne-core
   

Upgrade the CRD Conversion pod

1. Add privileges to the crd-conv-f5-crdconversion service account.

   In this example, crd-conv-f5-crdconversion is composed of <helm name>-<helm chart>, where crd-conv represents the Helm name, and f5-crdconversion represents the Helm chart name. Update these values as per your deployment configuration.

   $ oc adm policy add-scc-to-user privileged -n f5-cne-core -z crd-conv-f5-crdconversion
   

2. Verify the crd-conv-values.yaml contents.

   $ cat crd-conv-values.yaml
   

   crdconversion:
     image:
       repository: repo.f5.com/images
   
     rabbitmqNamespace: f5-common
   
     fluentbit_sidecar:
       enabled: true
       image:
         repository: repo.f5.com/images
       fluentbit:
         input:
           pipes:
             bufSize: 8096
         tls:
           enabled: true
       fluentd:
         host: f5-toda-fluentd.f5-common.svc.cluster.local
   global:
     core:
       mountPath: /shared/core
     imagePullSecrets:
       - name: far-secret
   
   

3. Install the CRD Conversion pod.

   Note

   Ensure that you add privileges to the <helm name> before installing the CRD Conversion pod. In the below example, crd-conv is the helm name.

   In this example, the new version of f5-crdconversion helm chart is 0.124.11.

   $ helm upgrade crd-conv tar/f5-crdconversion-0.124.11-0.0.4.tgz -f crd-conv-values.yaml -n  f5-cne-core
   

   Sample output:

   Release "f5-crdconversion" has been upgraded. Happy Helming!
   NAME: f5-crdconversion
   LAST DEPLOYED: Mon Aug 31 17:02:59 2026
   NAMESPACE: f5-cne-core
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   

Upgrade the Coremond

1. Verify the coremond-values.yaml contents.

   $ cat coremond-values.yaml
   

   image:
     repository: repo.f5.com/images
   
   persistence:
     storageClass: managed-nfs-storage
   
   resources:
     limits:
       cpu: "1"
       memory: 200
     requests:
       cpu: "0.5"
       memory: 50
   
   fluentbit_sidecar:
     enabled: true
     image:
       repository: repo.f5.com/images
     fluentbit:
       input:
         pipes:
           bufSize: 8096
         tls:
           enabled: true
     fluentd:
       host: f5-toda-fluentd.f5-cne-core.svc.cluster.local
     resources:
       limits:
         cpu: "0.5"
         memory: "512Mi"
       requests:
         cpu: "0.2"
         memory: "256Mi"
   platformType: "ocp"
   imagePullSecrets:
     - name: far-secret
   

2. Upgrade the Coremond.

   $ helm upgrade f5-coremond tar/coremond-0.25.13-0.0.8.tgz -n f5-cne-core -f coremond-values.yaml 
   

   Sample output

   Release "f5-coremond" has been upgraded. Happy Helming!
   NAME: f5-coremond
   LAST DEPLOYED: Mon Aug 31 17:03:31 2026
   NAMESPACE: f5-cne-core
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   

3. View the pods in the f5-cne-core namespace.

   $ oc get pods -n f5-cne-core
   

Upgrade the Toda-fluentd

1. Verify the toda.yaml contents.

   $ cat toda.yaml
   

   image:
     repository: repo.f5.com/images
     pullPolicy: Always
    
   dssm_logs:
     enabled: true
     stdout: true
    
   f5ingress_logs:
     enabled: true
     stdout: true
    
   dssm_sentinel_logs:
     enabled: true
     stdout: true
    
   persistence:
     enabled: true
    
   tls:
     enabled: true
   imageCredentials:
     name: far-secret
   

2. Upgrade the Toda-fluentd.

   $ helm upgrade f5-toda-fluentd tar/f5-toda-fluentd-2.10.7-0.0.6.tgz -f toda.yaml -n f5-cne-core
   

   Sample output

   Release "f5-toda-fluentd" has been upgraded. Happy Helming!
   NAME: f5-toda-fluentd
   LAST DEPLOYED: Mon Aug 31 17:30:00 2026
   NAMESPACE: f5-cne-core
   STATUS: deployed
   REVISION: 2
   TEST SUITE: None
   NOTES:
   Log aggregator - FluentD is deployed, which get logs from fluentbit sidecars.
   FluentD outputs:
       'stdout' is "false"
       'persistent volume' is "true"
   Persistent volume claim created with:
       accessModes: "ReadWriteOnce"
       storage: "3Gi"
       
   FluentD hostname: f5-toda-fluentd.f5-cne-core.svc.cluster.local.
   FluentD port: "54321"
   Use this info to connect to it:   
   --set f5-toda-logging.fluentd.host="f5-toda-fluentd.f5-cne-core.svc.cluster.local."
   --set f5-toda-logging.fluentd.port=54321
   
   FluentD service IP family:        
       serviceIpFamily: .Values.serviceIpFamily
   

3. See the installed releases in the f5-cne-core namespace to check for newly installed cert-manager.

   helm list -n f5-cne-core
   

4. View the pods in the f5-cne-core namespace.

   $ oc get pods -n f5-cne-core
   

Upgrade the dSSM

To successfully upgrade dSSM, follow the instructions in Upgrading dSSM.

Note

The 2.4.2 chart value is tar/f5-dssm-1.81.14-0.0.22.tgz.

Upgrade the F5Ingress

With the implementation of readinessGates (config and routing gates), we have ensured TMM is available to process the network traffic with minimal traffic loss. For more information, see TMM Rolling Update.

Important

Based on the maxUnavailable, maxSurge, and TMM replicas configuration, ensure that you have:

• Enough resources available.

• Additional SelfIPs and translationIPs (SNAT and CGNAT).

1. Verify the overrides-values-2.4.2.yaml contents.

   Note

   The following parameters are configured to ensure that, during the upgrade, the TMM pod is immediately available to receive network traffic with a very less traffic loss:

   • tmm.dynamicRouting.bfd is configured.

   $ cat overrides-values-2.4.2.yaml
   

2. (Optional) If you have f5-afm pod enabled in values.yaml, add privileges to the f5-afm service account.

   $ oc adm policy add-scc-to-user privileged -n spk-ingress -z f5-afm
   

3. Upgrade the F5ingress using the new F5ingress helm chart version mentioned in the BNK (Host) 2.4.2 release-manifest version.

   Note

   Before upgrading F5ingress, ensure that readinessGates.enabled is set to true in overrides-values-2.4.2.yaml.

   $ helm upgrade f5ingress tar/f5ingress-<version>.tgz -f <values>.yaml -n namespace
   

   In this example, the Pods will be upgraded using the f5ingress-v15.1016.2-0.7.0 Helm chart.

   $ helm upgrade f5ingress tar/f5ingress-v15.1016.2-0.8.3.tgz -f overrides-values-2.4.2.yaml -n spk-ingress
   

   Sample output

   Release "f5ingress" has been upgraded. Happy Helming!
   NAME: f5ingress
   LAST DEPLOYED: Mon Aug 31 18:08:01 2026
   NAMESPACE: spk-ingress
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   NOTES:
   The F5Ingress Controller has been installed.
   TMM debug sidecar is deployed. To access: kubectl exec -it deployment/f5-tmm -c debug -n spk-ingress -- bash
   

   Note

   Need to use extra vlan IP and extra snat IP for the traffic to work seamlessly after upgrade. with maxSurge 1 and maxUnavailable 0.

4. View the list of pods associated with spk-ingress namespace/project.

   $ oc get pods -n spk-ingress -o wide
   

5. See the installed releases in spk-ingress namespace.

   In this example, the below command shows the installed releases in spk-ingress Project.

   $ helm list -n spk-ingress
   

6. During F5ingress update process, run the below command to check the status of readinessGates (ConfigurationDone and RoutingDone gates).

   In this example, the f5-tmm-7fb766f798-6bgbk is TMM pod.

   $ oc describe pod f5-tmm-7fb766f798-6bgbk
   

   Sample output

   Readiness Gates:
     Type                Status
     ConfigurationDone   True
     RoutingDone         True
   

7. If you want to use the Multiple External Gateway (MEG) with BNK (Host) 2.4.2, apply the AdminPolicyBasedExternalRoute CR. For more information, see AdminPolicyBasedExternalRoute

Upgrade the OTeL

1. Verify the otel-override.yaml contents.

   $ cat otel-override.yaml
   

   Override value file: otel-override.yaml

   enabled: true
   cert-orchestrator:
     enabled: true
   image:
     repository: repo.f5.com/images
   resources:
     requests:
       cpu: 1m
       memory: 1Mi
   exporters:
     prometheus:
       namespace: ""
   otelCustomConf: |
     exporters:
       otlp:
         endpoint: otel-test.default.svc.cluster.local:4317
         tls:
           insecure: true
         retry_on_failure:
           enabled: true
           initial_interval: 1s
           max_interval: 10s
           max_elapsed_time: 0
     service:
       pipelines:
         metrics:
           exporters: [otlp, prometheus]
   global:
     imageCredentials:
       name: far-secret
   

2. Upgrade the OTeL.

   $ helm upgrade otel tar/f5-stats_collector-1.0.52-0.0.2.tgz -n spk-ingress -f otel.yaml
   

   Sample output

   Release "otel" has been upgraded. Happy Helming!
   NAME: otel
   LAST DEPLOYED: Mon Aug 31 17:31:55 2026
   NAMESPACE: spk-ingress
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None
   

Upgrade the F5-observer pod

Important

Required manual steps before upgrading Observer

The Observer custom resource definitions (CRDs) have been renamed from the metrics.f5.net domain to the metrics.f5.com domain from the 2.4.2 release. The following table shows the previous and new CRDs:

Previous CRD	New CRD
scrapetemplates.metrics.f5.net	scrapetemplates.metrics.f5.com
scrapeclasses.metrics.f5.net	scrapeclasses.metrics.f5.com
scrapes.metrics.f5.net	scrapes.metrics.f5.com

Helm does not recreate CRDs during an upgrade by default. You must complete the following manual steps to apply the new CRDs before you upgrade:

1. Apply the new CRDs directly from the Observer chart:

   helm show crds .../f5-toda-observer-<UPGRADE_VERSION>.tgz | kubectl apply -f -
   

2. Remove stale objects from the old CRD group:

   kubectl delete scrapetemplate.metrics.f5.net --all --all-namespaces || true
   kubectl delete scrapeclass.metrics.f5.net --all || true
   

3. Upgrade the Observer:

   helm upgrade observer .../f5-toda-observer-<UPGRADE_VERSION>.tgz ...
   

4. Upgrade the Ingress:

   helm upgrade f5ingress .../<UPGRADE_F5INGRESS_VERSION>.tgz ...
   

5. (Optional) Remove the old CRD definitions:

   kubectl delete crd scrapetemplates.metrics.f5.net
   kubectl delete crd scrapeclasses.metrics.f5.net
   kubectl delete crd scrapes.metrics.f5.net
   

1. Verify the observer-override.yaml contents.

   $ cat observer-override.yaml
   

   Override value file: observer-override.yaml

   tolerations:
     observer:
       - key: "node.kubernetes.io/not-ready"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
       - key: "node.kubernetes.io/unreachable"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
     operator:
       - key: "node.kubernetes.io/not-ready"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
       - key: "node.kubernetes.io/unreachable"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
     receiver:
       - key: "node.kubernetes.io/not-ready"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
       - key: "node.kubernetes.io/unreachable"
         operator: "Exists"
         effect: "NoExecute"
         tolerationSeconds: 30
   
   image:
     repository: repo.f5.com/images
   imagePullSecrets:
     - name: far-secret
   
   revisionHistoryLimit: 10
   
   replicas: 3
   
   resources:
     observer:
       limits:
         cpu: 1
         memory: 1Gi
       requests:
         cpu: 1
         memory: 1Gi
     operator:
       limits:
         cpu: 1
         memory: 1Gi
       requests:
         cpu: 1
         memory: 1Gi
     receiver:
       limits:
         cpu: 1
         memory: 1Gi
       requests:
         cpu: 1
         memory: 1Gi
   
   persistence:
     enabled: true
     storageClassName: managed-nfs-storage
     size: 3Gi
   
   platformType:
   
   targets_namespaces:
     - spk-ingress
   
   ## Fluentbit sidecar values
   fluentbit_sidecar:
     image:
       repository: repo.f5.com/images
       pullPolicy: Always
     resources:
       limits:
         cpu: "0.5"
         memory: "512Mi"
       requests:
         cpu: "0.25"
         memory: "256Mi"
   
     fluentbit:
       tls:
         enabled: true
     fluentd:
       host: f5-toda-fluentd.vad-f5-spk.svc.cluster.local.
       port: 54321
    
   

2. Upgrade the F5-observer pod.

   $ helm upgrade f5-toda-observer tar/f5-toda-observer-5.36.5-0.3.4.tgz -n spk-ingress -f observer-override.yaml
   

   Sample output

   Release "f5-toda-observer" has been upgraded. Happy Helming!
   NAME: f5-toda-observer
   LAST DEPLOYED: Mon Aug 31 13:14:22 2026
   NAMESPACE: spk-ingress
   STATUS: deployed
   REVISION: 2
   DESCRIPTION: Upgrade complete
   TEST SUITE: None