Install CNF¶
The CNF is deployed through the application of the CNEInstance CR, which allows users to specify the desired state of the CNF cluster. The F5 Lifecycle Operator (FLO) utilizes this CNEInstance CR as an input file to instantiate the CNF component CRs, which deploy the necessary CNF pods with predefined configurations. For information on the CNEInstance spec parameters featured in this example, or for a comprehensive list of available parameters that a user can use to define the desired state of CNF, see CNEInstance CRD parameters.
Note: By default, the Helm installation will install the product in the
defaultnamespace. However, this approach is not recommended. It is expected that customers provide a non-default tenant namespace when installing the FLO helm-chart. This will ensure that FLO is deployed in the designated user-provided tenant namespace. It is important that the CNEInstance CR is also deployed in the same tenant namespace.
Prerequisites¶
Before you install CNF, ensure that the following prerequisites are met:
Perform helm login and apply FAR secret to pull the artifacts from FAR. For more information, see CNFs Artifacts through F5 Artifact Registry.
Configure cert-manager to create certificates for secure communication between pods, see CNFs Cert Manager.
Create self-signed CA secret and clusterissuer, see CNFs Cert Manager.
Obtained the JWT for this cluster from your MyF5 account.
Create the F5 Artifact Registry pull secret in
default,f5-operators,f5-utilsor the namespace where you choose to install the product, see Create FAR secret in namespaces for more information.Create
storageclass, see Storage Class.Set the
fs.inotify.max_user_instanceslimit on the Kubernetes nodes to8192to ensure all the pods function as expected.Label at least one Kubernetes node with
app=f5-tmmto allow the TMM to run on it.Use the following command to label the node:
kubectl label node <NODE_NAME> app=f5-tmm
Apply CNEInstance CR¶
Create a file named
cneinstance-cr.yamlwith the following configuration.apiVersion: v1 items: - apiVersion: k8s.f5.com/v1 kind: CNEInstance metadata: annotations: cneinstance.k8s.f5.com/disable-session-state: "true" kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"k8s.f5.com/v1","kind":"CNEInstance","metadata":{"annotations":{"cneinstance.k8s.f5.com/disable-session-state":"true"},"labels":{"app.kubernetes.io/managed-by":"kustomize","app.kubernetes.io/name":"f5-lifecycle-operator"},"name":"f5-alpha-cneinstcr","namespace":"f5-alpha"},"spec":{"advanced":{"cneController":{"env":[{"name":"CLOUD_ENV","value":"true"},{"name":"CLOUD_PROVIDER","value":"ibm"},{"name":"CLOUD_TRUSTED_PROFILE","value":"Profile-8222f7db-34b4-470c-9ace-8b1405f01931"},{"name":"USE_GATEWAY_SETTINGS","value":"true"},{"name":"GSLB_DATACENTER_NAME","value":"roks-s5-7-datacenter"}]},"coremon":{"env":[{"name":"COREMOND_OVERRIDE_CORE_PATTERN","value":"true"}],"hostPath":true},"demoMode":{"enabled":false},"envDiscovery":{"enabled":false},"externalBigip":{"env":[{"name":"EXT_BIGIP_REGISTRY_CR","value":"external-bigip-registry"}]},"ipamController":{"env":[{"name":"PROVIDER","value":"infoblox"},{"name":"INFOBLOX_GRID_HOST","value":"52.197.167.88"},{"name":"INFOBLOX_WAPI_VERSION","value":"2.11.2"},{"name":"INFOBLOX_WAPI_PORT","value":"443"},{"name":"INSECURE","value":"false"},{"name":"CREDENTIAL_SECRET","value":"infoblox-login-secret"},{"name":"CERTIFICATE_SECRET","value":"infoblox-ca-cert-secret"}]},"maintenanceMode":{"enabled":false},"pseudoCNI":{"env":[{"name":"DISABLE_CHECKSUM_OFFLOAD","value":"true"}]},"tmm":{"env":[{"name":"TMM_CALICO_ROUTER","value":"default"},{"name":"ENABLE_K8S_ROUTES","value":"true"},{"name":"TMM_IGNORE_GATEWAYS","value":"true"},{"name":"TMM_MAPRES_ADDL_VETHS_ON_DP","value":"TRUE"}],"rollingUpdate":{"maxSurge":0,"maxUnavailable":1}}},"certificate":{"clusterIssuer":"ibm-rok-issuer"},"coreCollection":{"enabled":true},"deploymentSize":"Tiny","dpu":{"enabled":false},"dynamicRouting":{"enabled":false},"externalBigip":{"enabled":true},"firewallACL":{"enabled":true},"intelligentLB":{"enabled":false},"manifestVersion":"2.4.0","networkAttachments":["ens3-ipvlan-l2"],"placement":{"dataPlane":{"affinity":{"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"app":"f5-tmm"}},"topologyKey":"kubernetes.io/hostname"}]}},"topologySpreadConstraints":[{"labelSelector":{"matchLabels":{"app":"f5-tmm"}},"maxSkew":1,"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"DoNotSchedule"}]}},"product":{"gatewayAPI":true,"type":"BNK"},"pseudoCNI":{"enabled":true},"registry":{"imagePullPolicy":"Always","imagePullSecrets":[{"name":"farimagesecret"}],"uri":"devrepo.f5.com"},"telemetry":{"loggingSubsystem":{"enabled":true},"metricSubsystem":{"enabled":true}},"tmmReplicas":2,"watchNamespaces":["All"],"wholeCluster":false}} creationTimestamp: "2026-09-10T08:37:44Z" finalizers: - k8s.f5.com/CNEInstanceFinalizer generation: 3 labels: app.kubernetes.io/managed-by: kustomize app.kubernetes.io/name: f5-lifecycle-operator name: f5-alpha-cneinstcr namespace: f5-alpha resourceVersion: "13367225" uid: 9aee3c84-c8d0-4a1f-aa39-bf2f20c8ddea spec: access: {} advanced: analyzer: {} bdosd: {} cneController: env: - name: CLOUD_ENV value: "true" - name: CLOUD_PROVIDER value: ibm - name: CLOUD_TRUSTED_PROFILE value: Profile-8222f7db-34b4-470c-9ace-8b1405f01931 - name: USE_GATEWAY_SETTINGS value: "true" - name: GSLB_DATACENTER_NAME value: roks-s5-7-datacenter coremon: env: - name: COREMOND_OVERRIDE_CORE_PATTERN value: "true" hostPath: true crdConversion: {} crdInstaller: {} cwc: kal: {} demoMode: enabled: false downloader: {} dssm: {} dwbld: {} envDiscovery: enabled: false externalBigip: env: - name: EXT_BIGIP_REGISTRY_CR value: external-bigip-registry firewallACL: {} fluentd: {} ipamController: env: - name: PROVIDER value: infoblox - name: INFOBLOX_GRID_HOST value: 52.197.167.88 - name: INFOBLOX_WAPI_VERSION value: 2.11.2 - name: INFOBLOX_WAPI_PORT value: "443" - name: INSECURE value: "false" - name: CREDENTIAL_SECRET value: infoblox-login-secret - name: CERTIFICATE_SECRET value: infoblox-ca-cert-secret ipsd: {} ipsec: {} maintenanceMode: enabled: false nodeLabeler: {} observer: {} otel: {} otelCollector: {} pseudoCNI: env: - name: DISABLE_CHECKSUM_OFFLOAD value: "true" rabbitmq: {} tmm: env: - name: TMM_CALICO_ROUTER value: default - name: ENABLE_K8S_ROUTES value: "true" - name: TMM_IGNORE_GATEWAYS value: "true" - name: TMM_MAPRES_ADDL_VETHS_ON_DP value: "TRUE" rollingUpdate: maxSurge: 0 maxUnavailable: 1 behavioralDoS: {} certificate: clusterIssuer: ibm-rok-issuer cgnat: {} coreCollection: enabled: true deploymentSize: Tiny dpu: enabled: false dynamicRouting: enabled: false externalBigip: enabled: true firewallACL: enabled: true intelligentLB: enabled: false intrusionPrevention: {} ipIntelligence: {} manifestVersion: 2.4.0 networkAttachments: - ens3-ipvlan-l2 placement: controlPlane: {} dataPlane: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchLabels: app: f5-tmm topologyKey: kubernetes.io/hostname topologySpreadConstraints: - labelSelector: matchLabels: app: f5-tmm maxSkew: 1 topologyKey: topology.kubernetes.io/zone whenUnsatisfiable: DoNotSchedule observability: {} sessionState: {} policyEnforcement: {} product: gatewayAPI: true type: BNK pseudoCNI: enabled: true registry: imagePullPolicy: Always imagePullSecrets: - name: farimagesecret uri: devrepo.f5.com telemetry: loggingSubsystem: enabled: true metricSubsystem: enabled: true tmmReplicas: 2 watchNamespaces: - All wholeCluster: false status: conditions: - lastTransitionTime: "2026-09-10T08:37:44Z" message: Initial processing performed observedGeneration: 3 reason: Accepted status: "True" type: Accepted - lastTransitionTime: "2026-09-10T08:37:44Z" message: "" observedGeneration: 3 reason: Reconciled status: "True" type: Reconciled - lastTransitionTime: "2026-09-10T11:01:00Z" message: "" observedGeneration: 3 reason: Available status: "True" type: Available - lastTransitionTime: "2026-09-10T08:38:05Z" message: "" observedGeneration: 3 reason: Available status: "True" type: CRDInstallerAvailable - lastTransitionTime: "2026-09-10T09:16:01Z" message: "" observedGeneration: 3 reason: Available status: "True" type: CNEControllerAvailable - lastTransitionTime: "2026-09-10T11:01:00Z" message: "" observedGeneration: 3 reason: Available status: "True" type: F5TmmAvailable - lastTransitionTime: "2026-09-10T08:38:29Z" message: "" observedGeneration: 3 reason: Available status: "True" type: AfmAvailable - lastTransitionTime: "2026-09-10T08:38:11Z" message: "" observedGeneration: 3 reason: Available status: "True" type: ExternalBigIPControllerAvailable - lastTransitionTime: "2026-09-10T08:38:25Z" message: "" observedGeneration: 3 reason: Available status: "True" type: FluentdAvailable - lastTransitionTime: "2026-09-10T08:38:16Z" message: "" observedGeneration: 3 reason: Available status: "True" type: RabbitmqAvailable - lastTransitionTime: "2026-09-10T08:38:53Z" message: "" observedGeneration: 3 reason: Available status: "True" type: CRDConversionAvailable - lastTransitionTime: "2026-09-10T08:39:33Z" message: "" observedGeneration: 3 reason: Available status: "True" type: CwcAvailable - lastTransitionTime: "2026-09-10T08:38:16Z" message: "" observedGeneration: 3 reason: Available status: "True" type: IPAMControllerAvailable - lastTransitionTime: "2026-09-10T08:38:20Z" message: "" observedGeneration: 3 reason: Available status: "True" type: CoremondAvailable - lastTransitionTime: "2026-09-10T08:38:39Z" message: "" observedGeneration: 3 reason: Available status: "True" type: CSRCAvailable - lastTransitionTime: "2026-09-10T08:38:45Z" message: "" observedGeneration: 3 reason: Available status: "True" type: ObserverAvailable - lastTransitionTime: "2026-09-10T08:38:10Z" message: "" observedGeneration: 3 reason: Available status: "True" type: OtelCollectorAvailable sessionStore: desiredDBPods: 3 kind: List metadata: resourceVersion: ""
Before applying the CNF CNEInstance CR, ensure to modify the
cneinstance-crwith the correct values for the below listed parameters. For a comprehensive list of available parameters that a user can use to define the desired state of CNF, see CNEInstance CR.If you opt to use your local registry to pull the artifacts, make sure to update the
repositoryparameter.Update the
imagePullSecrets.namewith actual secret to download artifacts from the registry.Ensure that the
certificate.clusterIssuerparameter incneinstance-cr.yamlis properly updated with themetadata.namevalue of the cluster issuer, see CNFs Cert Manager.Update the
spec.advanced.tmm.envif your cluster has calico CNI, and to add additional K8S routes to the default gateway setup by CNI.Update the
spec.containerPlatformwithOCP.Ensure that the Network Attachment Definition is created in the same namespace where you plan to install FLO and CNF, see Multus Network Attachment Definition.
If you have airgapped environment, apply the CNEmanifest.
kubectl apply -f manifest.yaml
Apply the CNEInstance CR to install CNF.
kubectl apply -f cneinstance-cr.yaml
The CNF is configured as defined in the CNEInstance custom resource (CR) for the following configurations:
telemetry.loggingSubsystem (Enabled by default):
Enables Fluent Bit sidecar for each component. For more information, see [Fluent bit sidecar].
Enables Fluentd deployment.
telemetry.metricSubsystem (Enabled by default):
Enables toda-tmstats container in the TMM pod. For more information, see Distributed Toda for Stats Aggregation.
Enables OpenTelemetry Collector deployment.
Enables Observer-Operator deployment.
Enables Observer and Observer-Receiver StatefulSet.
pseudoCNI (Enabled by default):
Enables CSRC DaemonSet. For more information, see [CSRC].
dynamicRouting (Enabled by default):
Enables tmm-routing and tmrouted containers in the TMM pod.
Updates the f5-tmm-dynamic-routing-template ConfigMap for ZebOS configurations. For more information, see ZebOS ConfigMaps.
coreCollection (Enabled by default):
Enables coremond DaemonSet. For more information, see CNFs Coremond
firewallACL (Enabled by default):
Enables AFM deployment.
Enables blobd sidecar in the TMM pod.
demoMode:
Deploys TMM to run with minimal resources (single thread, without HugePages and SR-IOV resources).
maintenanceMode:
Allows manual editing of the resources. Disabling this mode will revert all manual changes.
deploymentSize (Small | Medium | Large | Max):
TMM is deployed with deployment size, Small. For more information, see CNEInstance CR
envDiscovery (Disabled by default):
Validates all nodes in the cluster for required configurations like labels, VFS, and huge pages.
Reports warnings or errors for missing configurations and suggests fixes.
Proceeds with deployment for warnings; halts deployment for errors until resolved.
Check the CNF pods status.
kubectl get pods -n alpha
Sample Output:
NAME READY STATUS RESTARTS AGE f5-afm-98755dfb4-tdnbb 2/2 Running 0 119m f5-cne-controller-5f64fcb8fc-lsk6r 4/4 Running 0 119m f5-observer-0 2/2 Running 0 119m f5-observer-operator-5bf5c99dd7-zcs88 2/2 Running 0 119m f5-observer-receiver-0 2/2 Running 0 119m f5-tmm-kdzx7 7/7 Running 0 119m flo-f5-lifecycle-operator-6cb4886fbc-hlxsx 2/2 Running 0 120m otel-collector-f889b9ff8-9ngbv 1/1 Running 0 119m
Check the CNF pods status running in
f5-utilsnamespace.kubectl get pods -n f5-utils
NAME READY STATUS RESTARTS AGE crd-installer-jzc47 0/1 Completed 0 120m f5-coremond-5th6j 2/2 Running 0 119m f5-coremond-q5zgr 2/2 Running 0 119m f5-crdconversion-7bdf7cf55f-9rw6x 2/2 Running 0 119m f5-dssm-db-0 3/3 Running 0 119m f5-dssm-db-1 3/3 Running 0 117m f5-dssm-db-2 3/3 Running 0 116m f5-dssm-sentinel-0 3/3 Running 0 119m f5-dssm-sentinel-1 3/3 Running 0 117m f5-dssm-sentinel-2 3/3 Running 0 116m f5-rabbit-6b77457475-lhnwx 2/2 Running 0 119m spk-csrc-8pwj9 2/2 Running 0 119m f5-spk-cwc-75bddd65b6-kwck6 3/3 Running 0 119m f5-toda-fluentd-7565695975-4mcwr 1/1 Running 0 119m