Upgrade CNFs from 2.3.3 to 2.3.4 using F5 Lifecycle Operator

This document describes how to upgrade the F5 Lifecycle Operator (FLO), migrate CPCL ConfigMaps to Secrets, upgrade the CNE Instance, and apply the License custom resource.

Important

Ensure that license content (JWT values) are removed from any values files before sharing or committing them.

Upgrade the F5 Lifecycle Operator (FLO)

1. Create or update the FLO values file.

   Example: flo-values_2.3.4.yaml

   global:
   imagePullSecrets:
       - name: far-secret
   certmgr:
       clusterIssuer: arm-ca-cluster-issuer
   
   image:
   repository: repo.f5.com/images
   pullPolicy: IfNotPresent
   
   f5-spk-crds-common:
   versionValidator:
       image:
       repository: repo.f5.com/images
   
   f5-spk-crds-service-proxy:
   versionValidator:
       image:
       repository: repo.f5.com/images
   
   f5-ipam-operator:
   image:
       repository: repo.f5.com/images
       pullPolicy: IfNotPresent
   namespace: "default"
   nameOverride: "f5-ipam-operator"
   fullnameOverride: "f5-ipam-operator"
   
   sharedComponentNamespace: "f5-utils"
   

2. Execute the Helm upgrade using the values file.

   $ helm upgrade f5-lifecycle-operator tar/f5-lifecycle-operator-v2.21.13-0.0.73.tgz -f flo-values_2.3.4.yaml
   

3. Verify the Upgrade.

   $ helm list
   

Apply the CNE Instance

1. Create the CNE Instance custom resource after the FLO upgrade completes.

   Example: cnegatewayclass-cr.yaml

   apiVersion: k8s.f5.com/v1
   kind: CNEInstance
   metadata:
   labels:
      app.kubernetes.io/name: f5-lifecycle-operator
      app.kubernetes.io/managed-by: kustomize
   name: f5-alpha-cneinstcr
   namespace: f5-alpha
   spec:
   wholeCluster: false
   product:
      type: CNF
      gatewayAPI: false
   manifestVersion: "2.3.4-3.2598.3-0.0.632"
   telemetry:
      loggingSubsystem:
        enabled: true
      metricSubsystem:
        enabled: true
   certificate:
      clusterIssuer: oss-issuer
   deploymentSize: "Small"
   registry:
      uri: "repo.f5.com"
      imagePullSecrets:
      - name: farimagesecret
      imagePullPolicy: Always
   networkAttachments:
      - "f5-alpha-cnf-intel710-external1-sriov"
      - "f5-alpha-cnf-intel710-internal-sriov"
   storageClassName: managed-nfs-storage
   # Features
   # CSRC Egress
   pseudoCNI:
      enabled: true
   # BGP
   dynamicRouting:
      enabled: true
   # AFM
   firewallACL:
      enabled: true
   # Core dump files
   coreCollection:
      enabled: true
   # CGNAT
   cgnat:
      enabled: true
   # IPSD
   intrusionPrevention:
      enabled: true
   # IP Intelligence
   ipIntelligence:
      enabled: true
   # Intelligent Load Balancer
   intelligentLB:
      enabled: false
   # DPU
   dpu:
      enabled: false
   # TMM Replicas (when not whole cluster or DPU mode)
   tmmReplicas: 2
   # Watch Namespaces
   #
   # watchNamespaces:
   #
   #- "tcpapp"
   #
   #- "udpapp"
   #
   #
   # Advanced Configuration
   advanced:
      maintenanceMode:
        enabled: false
      demoMode:
        enabled: false
      tmm:
        env:
        - name: SESSIONDB_EXTERNAL_SERVICE
          value: "f5-dssm-sentinel.f5-alpha.svc.cluster.local"
        - name: SESSIONDB_DISCOVERY_SENTINEL
          value: "true"
        - name: SSL_SERVERSIDE_STORE
          value: "/tls/tmm/mds/clt"
        - name: SSL_TRUSTED_CA_STORE
          value: "/tls/tmm/mds/clt"
        - name: TMM_MAPRES_VERBOSITY
          value: "debug"
        - name: TMM_MAPRES_USE_VETH_NAME  # Set to false to resolve the issue (BZ 1407137)
          value: "FALSE"
        - name: CONFIG_VIEWER_ENABLE
          value: "TRUE"
        - name: TMM_MAPRES_ADDL_VETHS_ON_DP
          value: "TRUE"
        - name: OPENSHIFT_VFIO_RESOURCE_1
          value: "ens25f0IntelE710Vfio"
        - name: OPENSHIFT_VFIO_RESOURCE_2
          value: "ens25f1IntelE710Vfio"
        - name: EXPORT_TMROUTED_LOGS
          value: "true"
        - name: EXPORT_BLOBD_LOGS
          value: "true"
      cneController:
        env:
        - name: ICNI20_ENABLED
          value: "true"
      envDiscovery:
        enabled: false
   

2. Apply the resource:

   $ kubectl apply -f arm/tmp/cnegatewayclass-cr.yaml -n f5-alpha
   

Verify CNE Pods

1. Verify Pods in f5-utils

   $ kubectl get pods -n f5-utils
   

2. Verify Pods in f5-alpha

   $ kubectl get pods -n f5-alpha