Cloud-Native Network Functions on Robin 2.2.5 release notes¶
About this release¶
Introduction¶
These release notes describe the differences between CNFs on Robin 2.2.4 and 2.2.5.
Note
This is a critical release. See Overview of F5 Critical Releases for more information and treat every release as though it closes a critical gap.
The following table summarizes the impact of Critical and High severity vulnerabilities in the data plane across the F5 product portfolio.
| Data Plane | ||
|---|---|---|
| Product | Critical | High |
| F5 Distributed Cloud Services | No | No |
| BIG-IP TMOS | Yes | Yes |
| BIG-IP Access Policy Manager (APM) Clients | No | Yes |
| BIG-IP SSL Orchestrator | Yes | Yes |
| F5OS - Appliance | Yes | Yes |
| F5OS - Chassis | Yes | Yes |
| BIG-IQ | Yes | Yes |
| F5 Insight | Yes | Yes |
| BIG-IP Next for Kubernetes | Yes | Yes |
| F5 BIG-IP Cloud-Native Network Functions (CNFs) | Yes | Yes |
| BIG-IP Next for Kubernetes (Host) | Yes | Yes |
| BIG-IP eBPF Observability (EOB) | No | No |
| BIG-IP Container Ingress Services (CIS) | No | No |
| Aspen Mesh | No | No |
| F5 NGINX Plus | No | Yes |
Supported container-orchestration platforms¶
This release is officially supported on these container-orchestration platforms and versions:
| Platform | Version | Recommended Helm version |
|---|---|---|
| Robin | 5.4.3-616 | 3 or later |
| Robin | 5.4.3-564 | 3 or later |
| Robin | 5.4.3-302 | 3 or later |
| Robin | 5.3.11-217 | 3 or later |
Security updates¶
> Click to expand
List of other CVEs¶
Click to expand
| CVE Number | Bug IDs | Image Names | Package Name |
|---|---|---|---|
| CVE-2025-59777 | 2477633 | postgresql | libmicrohttpd |
| CVE-2025-62689 | 2477637 | postgresql | libmicrohttpd |
| CVE-2026-10722 | 2477449 | opentelemetry-collector-contri | github.com/cilium/ebpf |
| CVE-2026-10723 | 2478293 | f5-debug-sidecar | bind9-dnsutils |
| CVE-2026-10822 | 2478297 | f5-debug-sidecar | bind9-dnsutils |
| CVE-2026-11331 | 2478301 | f5-debug-sidecar | bind9-dnsutils |
| CVE-2026-11622 | 2478305 | f5-debug-sidecar | bind9-dnsutils |
| CVE-2026-11721 | 2478309 | f5-debug-sidecar | bind9-dnsutils |
| CVE-2026-11856 | 2361253, 2361293, 2361329, 2361365, 2478329 | crd-installer, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-11979 | 2477641 | postgresql | libxml2 |
| CVE-2026-12617 | 2478313 | f5-debug-sidecar | bind9-dnsutils |
| CVE-2026-13321 | 2478317 | f5-debug-sidecar | bind9-dnsutils |
| CVE-2026-14456 | 2477645 | postgresql | openssl |
| CVE-2026-14662 | 2477649 | postgresql | postgresql |
| CVE-2026-14663 | 2477753 | postgresql | postgresql |
| CVE-2026-14664 | 2477653 | postgresql | postgresql |
| CVE-2026-14666 | 2477757 | postgresql | postgresql |
| CVE-2026-14668 | 2477657 | postgresql | postgresql |
| CVE-2026-14669 | 2477661 | postgresql | postgresql |
| CVE-2026-14670 | 2477665 | postgresql | postgresql |
| CVE-2026-14671 | 2477669 | postgresql | postgresql |
| CVE-2026-14672 | 2477761 | postgresql | postgresql |
| CVE-2026-14673 | 2477793 | postgresql | postgresql |
| CVE-2026-14676 | 2477673 | postgresql | postgresql |
| CVE-2026-14677 | 2477677 | postgresql | postgresql |
| CVE-2026-14678 | 2477765 | postgresql | postgresql |
| CVE-2026-14679 | 2477681 | postgresql | postgresql |
| CVE-2026-14680 | 2477685 | postgresql | postgresql |
| CVE-2026-14681 | 2477769 | postgresql | postgresql |
| CVE-2026-15059 | 2478465 | baseos | libsystemd0 |
| CVE-2026-15146 | 2478269 | rabbit | wget |
| CVE-2026-15741 | 2477689 | postgresql | postgresql |
| CVE-2026-15742 | 2477693 | postgresql | postgresql |
| CVE-2026-16238 | 2477697 | postgresql | postgresql |
| CVE-2026-16239 | 2477701 | postgresql | postgresql |
| CVE-2026-16241 | 2477797 | postgresql | postgresql |
| CVE-2026-16389 | 2477621 | postgresql | nss-libs |
| CVE-2026-16742 | 2478469 | baseos | libsystemd0 |
| CVE-2026-18024 | 2477773 | postgresql | postgresql |
| CVE-2026-18408 | 2477705 | postgresql | postgresql |
| CVE-2026-19385 | 2477709 | postgresql | postgresql |
| CVE-2026-33818 | 2476769, 2476805, 2476841, 2476873, 2476913, 2476945, 2476973, 2477001, 2477029, 2477069, 2477097, 2477129, 2477153, 2477185, 2477213, 2477241, 2477297, 2477321, 2477349, 2477377, 2477413, 2477457, 2477485, 2477513, 2477537, 2477565, 2477593, 2477805, 2477809, 2477885, 2477917, 2477941, 2477969, 2477997, 2478029, 2478061, 2478089, 2478117, 2478149, 2478181, 2478213, 2478241, 2478433 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-39821 | 2359065, 2359093, 2359201, 2359345, 2359349, 2359353, 2359357, 2359361, 2359517, 2359545, 2359573, 2359601, 2359629, 2359657, 2359717, 2359745, 2359841, 2359869, 2359901, 2360089, 2360117, 2360149, 2360177, 2360285, 2360365, 2360449, 2360529, 2360609, 2360689, 2360725, 2360761, 2360841, 2360921, 2360949, 2361041, 2361069, 2476773, 2476809, 2476917, 2477245, 2477381, 2477813, 2477817, 2477889, 2478001, 2478033, 2478121, 2478437 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmrouted-img, vault, vault-init | golang.org/x/net, stdlib |
| CVE-2026-40467 | 2477713 | postgresql | gawk |
| CVE-2026-40468 | 2477625 | postgresql | gawk |
| CVE-2026-40469 | 2477629 | postgresql | gawk |
| CVE-2026-40553 | 2477717 | postgresql | gawk |
| CVE-2026-41989 | 2477777 | postgresql | libgcrypt |
| CVE-2026-44604 | 2477721 | postgresql | rpm-libs |
| CVE-2026-46600 | 2424741, 2424761, 2424777, 2424793, 2424809, 2424825, 2424841, 2424857, 2424881, 2424897, 2424945, 2424949, 2424953, 2424957, 2424961, 2424997, 2425013, 2425041, 2425077, 2425105, 2425121, 2425141, 2425169, 2425281, 2425301, 2425325, 2425361, 2425409, 2425425, 2425481, 2425549, 2425581, 2476777, 2476813, 2476877, 2476921, 2477033, 2477249, 2477385, 2477417, 2477821, 2477825, 2478125, 2478153, 2478185, 2478441 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmrouted-img | golang.org/x/net, stdlib |
| CVE-2026-48863 | 2477725 | postgresql | libsolv |
| CVE-2026-48864 | 2477729 | postgresql | libsolv |
| CVE-2026-50812 | 2478273 | rabbit | libsqlite3-0 |
| CVE-2026-50813 | 2478277 | rabbit | libsqlite3-0 |
| CVE-2026-54369 | 2477733 | postgresql | libacl |
| CVE-2026-54411 | 2478473 | baseos | libpam-modules |
| CVE-2026-5450 | 2478477 | baseos | libc-bin |
| CVE-2026-56853 | 2476781, 2476817, 2476845, 2476881, 2476925, 2476949, 2476977, 2477005, 2477037, 2477073, 2477101, 2477133, 2477157, 2477189, 2477217, 2477253, 2477301, 2477325, 2477353, 2477389, 2477421, 2477461, 2477489, 2477517, 2477541, 2477569, 2477597, 2477829, 2477833, 2477893, 2477921, 2477945, 2477973, 2478005, 2478037, 2478065, 2478093, 2478129, 2478157, 2478189, 2478217, 2478245, 2478445 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-56858 | 2476785, 2476821, 2476849, 2476885, 2476929, 2476953, 2476981, 2477009, 2477041, 2477077, 2477105, 2477137, 2477161, 2477193, 2477221, 2477257, 2477305, 2477329, 2477357, 2477393, 2477425, 2477465, 2477493, 2477521, 2477545, 2477573, 2477601, 2477837, 2477841, 2477897, 2477925, 2477949, 2477977, 2478009, 2478041, 2478069, 2478097, 2478133, 2478161, 2478193, 2478221, 2478249, 2478449 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-56859 | 2476789, 2476829, 2476853, 2476889, 2476933, 2476957, 2476985, 2477013, 2477045, 2477081, 2477109, 2477141, 2477165, 2477197, 2477225, 2477261, 2477309, 2477333, 2477361, 2477397, 2477429, 2477469, 2477497, 2477525, 2477549, 2477577, 2477605, 2477845, 2477849, 2477901, 2477929, 2477953, 2477981, 2478013, 2478045, 2478073, 2478101, 2478137, 2478165, 2478197, 2478225, 2478253, 2478453 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-56860 | 2476797, 2476833, 2476861, 2476893, 2476937, 2476961, 2476989, 2477017, 2477049, 2477085, 2477113, 2477145, 2477169, 2477201, 2477229, 2477265, 2477313, 2477337, 2477365, 2477401, 2477433, 2477473, 2477501, 2477529, 2477553, 2477581, 2477609, 2477853, 2477857, 2477905, 2477933, 2477957, 2477985, 2478017, 2478049, 2478077, 2478105, 2478141, 2478169, 2478201, 2478229, 2478257, 2478457 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-56862 | 2476801, 2476837, 2476865, 2476897, 2476941, 2476965, 2476993, 2477021, 2477053, 2477089, 2477117, 2477149, 2477173, 2477205, 2477233, 2477269, 2477317, 2477341, 2477369, 2477405, 2477437, 2477477, 2477505, 2477533, 2477557, 2477585, 2477613, 2477861, 2477865, 2477909, 2477937, 2477961, 2477989, 2478021, 2478053, 2478081, 2478109, 2478145, 2478173, 2478205, 2478233, 2478261, 2478461 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-56864 | 2477441 | opentelemetry-collector-contri | golang.org/x/mod |
| CVE-2026-56865 | 2477445 | opentelemetry-collector-contri | golang.org/x/mod |
| CVE-2026-5928 | 2478481 | baseos | libc-bin |
| CVE-2026-6464 | 2477741 | postgresql | postgresql |
| CVE-2026-6469 | 2477801 | postgresql | postgresql |
| CVE-2026-6470 | 2477781 | postgresql | postgresql |
| CVE-2026-6471 | 2477745 | postgresql | postgresql |
| CVE-2026-9149 | 2477785 | postgresql | libsolv |
| CVE-2026-9150 | 2477789 | postgresql | libsolv |
| CVE-2026-94127 | 2532605 |
New features¶
(No new features)
Enhancements¶
(No new enhancements)
Model changes¶
(No model changes)
Fixed Issues¶
2524777-5¶
BIG-IP APM vulnerability CVE-2026-94127
Component: Access
Symptoms: For more information, see BIG-IP APM vulnerability CVE-2026-94127, available at https://my.f5.com/manage/s/article/K000162605
Conditions: For more information, see BIG-IP APM vulnerability CVE-2026-94127, available at https://my.f5.com/manage/s/article/K000162605
Impact: For more information, see BIG-IP APM vulnerability CVE-2026-94127, available at https://my.f5.com/manage/s/article/K000162605
Fix Text: For more information, see BIG-IP APM vulnerability CVE-2026-94127, available at https://my.f5.com/manage/s/article/K000162605
2171921-10¶
TMM crash
Component: Access
Symptoms: TMM not processing traffic properly.
Conditions: When APM is provisioned.
Impact: TMM crashes thereby impacting traffic.
Fix Text: TMM now processing traffic properly.
2349797-1¶
Configuring dynamicCapacityReduction in F5BigAnalyzer CR triggers “Invalid request schema” in the custom analyzer plugin
Component: analyzer
Symptoms: On BNK v2.3.x, a custom Python analyzer plugin fails every analyzer cycle with “status”: “error”, “message”: “Invalid request schema.” Analyzer pod logs show the system rejects the payload before the plugin runs. Consequently, the controller removes weight annotations from L4Route and HTTPRoute CRs on each cycle, and traffic falls back to the default round-robin instead of the intended weighted distribution.
Conditions:
BNK v2.3.x is deployed with Intelligent AI Load Balancing enabled (intelligentLB: enabled: true in CNEInstance CR).
An F5BigAnalyzer CR of type “custom” is configured referencing ConfigMap-based Python plugin.
dynamicCapacityReduction is present in the F5BigAnalyzer CR spec (the issue occurs regardless of enabled: true or enabled: false).
The custom plugin uses PLUGIN_REQUEST_SCHEMA with “additionalProperties”: False — as shown in the official reference implementation (custom_plugins/custom_plugin.py) and in CloudDocs.
Impact: Custom analyzer plugins fail on every cycle, and the system never runs the weight calculation logic. The controller removes L4Route and HTTPRoute weight annotations, so traffic reverts to default round-robin. Dynamic AI load balancing fails entirely for all custom plugin deployments on BNK v2.3.x when the CR includes dynamicCapacityReduction.
Workaround: Set “additionalProperties”: True in PLUGIN_REQUEST_SCHEMA within the custom plugin ConfigMap (replace False). This change lets the plugin accept unknown fields without failing validation. If the plugin does not use it, the plugin ignores the dynamic_capacity_reduction field. After you update the ConfigMap, restart the analyzer pod: kubectl rollout restart deployment/f5-analyzer -n f5-bnk
2399937-8¶
IPSec ESP Traffic Processing Behavior
Component: CGN_ALG
Symptoms: Certain traffic conditions may cause a service interruption on the affected blade.
Impact: Traffic disrupted while TMM restarts.
2433669-2¶
DNS cache is not created when a local zone record contains double quotes
Component: dns-cache
Symptoms: The DNS cache is not created when a local zone record contains a value with double quotes, such as a TXT record.
Conditions: A local zone contains a record whose data includes double quotes.
Impact: The DNS cache creation fails, and the affected local zone records are not available through the DNS cache.
Fix Text: The system now correctly escapes double quotes in local zone record data when creating the DNS cache.
2295357-2¶
Generalize driver override support via the TMM Helm chart
Component: Drivers
Symptoms: Create a ConfigMap for xnet_init.tcl and modify the TMM deployment to mount it at /config/xnet_init.tcl in the TMM container to override the network driver.
Conditions: TMM deployment requires network driver overrides specified in xnet_init.tcl configMap.
Impact: This is an RFE over an already existing functionality for ease-of-use and generalized support.
Fix Text: Use following xnetInit value.yaml property to provide TMM network driver overrides as below:
tmm:
xnetInit:
enabled: true
content: |
# Intel E810
device driver vendor_dev 8086:1889 dpdk
# Intel X710/XXV710/XL710
device driver vendor_dev 8086:154c iavf
2549993-1¶
bdt_cli connection list does not filter by IP address
Component: dsc-bdt_cli
Symptoms: When bdt_cli connection list is run with –cs_client_addr, –cs_server_addr, –ss_server_addr, or –ss_client_addr, the command returns the full connection table instead of only matching flows.
Conditions: SPK/CNF/BNK deployments that use bdt_cli to match specific flow(s) by specifying address(es) for –cs_client_addr, –cs_server_addr, –ss_server_addr, or –ss_client_addr
Impact: The specified address does not take effect, and no flow filtering occurs. Instead, all flows are returned.
Fix Text: bdt_cli now respects the address parameters for –cs_client_addr, –cs_server_addr, –ss_server_addr, or –ss_client_addr and returns desired matching flows.
2493309-3¶
Redis sentinel failover and DB restart duplicate some entries
Component: dssm
Symptoms: Duplicate entries with empty values present in the same aux list.
Conditions: After a Redis Sentinel failover, DNS46 sub-record entries can reference the same key multiple times in the aux-list—and transiently leave it with an empty value, because add_script unconditionally appends to KEYS[2] on every retry. If replication splits the paired SET/RPUSH between the old and new primary keys, the next extry resets the value and appends the key again, which grows the aux-list without bound across failovers.
Impact: Duplicate entries with empty values present in the same aux list.
Fix Text: We make the aux-list append idempotent by calling LREM KEYS[2] 0 KEYS[1] immediately before LINSERT (eviction path) and RPUSH (non-eviction path) in add_script’s sub-record branch. Because the Lua script runs atomically on the primary key, the LREM+append sequence ensures the key appears exactly once in the list and self-heals any residual duplicates from prior failovers.
2456769-1¶
Gradual increase in TMM memory usage
Component: Firewall (ACL)
Symptoms: TMM memory usage shows gradual increases and does not go down when traffic stops. Memory usage for ACL allocation type shows the growth.
Conditions: CNF Deployment with Firewall policy containing “Drop” action rules.
Impact: Traffic disruption after TMM memory reaches threshold level.
Fix Text: Do not initiate Hardware offload for non DPU deployments.
2399969-1¶
DSSM pod performance degradation with multiple pool members down
Component: fsm
Symptoms: When you create a pool with a pool member and a monitor, every TMM in a TMM pod sends status updates to the DSSM each time the pool member’s state changes. This behavior can degrade performance, especially when many TMM pods contain multiple TMMs, causing the problem to scale rapidly.
Impact: Multiple TMM pods and TMMs writing to DSSM at the same time can create performance bottlenecks in the DSSM pod.
Workaround: Increase the CPU allocation for the DSSM pod to prevent write operations from overloading it. Alternatively, reduce the number of TMM threads, TMM pods, or both.
Fix Text: Fixed the DSSM limits. DSSM now writes to a single TMM in a given TMM pod instead of writing to all TMMs.
2359009-1¶
While using bdt_cli incorrect routeECMP routes are displayed
Component: fsm-dynamic-routing
Symptoms: The bdt_cli route command may not properly display Equal-Cost Multi-Path (ECMP) routes learned from BGP in Cloud-Native Network Function (CNF) environments.
Conditions: Display ECMP routes using ‘bdt_cli route’ command.
Impact: Incorrect output.
Fix Text: The bdt_cli route command now correctly displays ECMP nexthops in CNF environments.
2358997-2¶
After BGP routing re-convergence ECMP routes can be incorrect
Component: fsm-dynamic-routing
Symptoms: In CNF environments, Equal-Cost Multi-Path (ECMP) routes learned from BGP may not be properly installed after routing changes or BGP session resets. This issue can result in:
Missing next-hop gateways in multi-path routes.
Incorrect number of paths displayed for ECMP routes.
Incomplete routing information on some pods.
The problem typically occurs when BGP neighbors re-establish connections or when routing topology changes trigger route updates, particularly in complex environments with multiple BGP peering relationships (eBGP and iBGP).
Conditions: Occurs when:
BGP routes are updated during network convergence events.
Multipath ECMP routes are in use.
Impact: Incorrect ECMP routes cause traffic loss.
Fix Text: Fixed ECMP nexthops to install correctly when routes change.
2460921-2¶
Malformed tmctl --csv output from embedded commas in text columns
Component: fsm-libtmstat
Symptoms: Malformed Tmctl –csv outputs due to data within the table containing columns that are comma separated.
For example, when printing the table without the csv option: /tmctl -d blade tmm/xnet/device_probed id available_drivers driver_selected driver_in_use
xeth0 sock, dpdk, sock Yes 0000:d8:0e.2 sock, dpdk, dpdk Yes 0000:d8:13.7 sock, dpdk, dpdk Yes
/tmctl -d blade tmm/xnet/device_probed –csv id,available_drivers,driver_selected,driver_in_use xeth0,sock, dpdk, ,sock,Yes 0000:d8:0e.2,sock, dpdk, ,dpdk,Yes 0000:d8:13.7,sock, dpdk, ,dpdk,Yes
Due to the available_drivers being comma separated, there are double commas that causes the csv issue.
Conditions: Running the tmctl command with the --csv or -c flag on a table that contains comma-separated values in a column produces malformed output.
Impact: Output of tmstat table columns are malformed when using –csv option.
Fix Text: Wrap comma-separated strings in tmctl --csv output in double quotes (eg: “val1, val2”) to follow the CSV format.
root@tmm-gcalvert-20260820-203915-8:/config# tmctl -d blade -i tmm/xnet/device_probed –csv id,available_drivers,driver_selected,driver_in_use xeth0,”sock, “,sock,Yes 0000:b1:11.3,”dpdk_mlnx, dpdk, iavf, “,dpdk,Yes 0000:b1:12.3,”dpdk_mlnx, dpdk, iavf, “,dpdk,Yes 0000:b1:14.0,”dpdk_mlnx, dpdk, iavf, “,dpdk,Yes
2455165-6¶
BIG-IP may experience increased resource usage under certain traffic conditions.
Component: fsm-protocols
Symptoms: Under certain conditions, protocol interactions may lead to a minor increase in BIG-IP memory usage.
Conditions: The virtual server is configured to handle the affected traffic.
Impact: Over time, BIG-IP may experience resource constraints that could affect traffic processing.
Fix Text: Issue is fixed.
2224957-1¶
IPFix Templates not retransmitted at configured periodic intervals
Component: HSL
Symptoms: When using HSL Publisher with IPFix Format destination, IPFix Template information is not being retransmitted.
Note that for every new UDP socket connection established to log server, a single HSL template is transmitted once for a session, but never retransmitted.
Conditions: When using IPFix Format destination for HSL log publisher, the log collector may not receive continuous updates of IPFix Template information at configured intervals (default being 30 seconds).
Impact: Log collector will not receive IPFIX Template updates at configured intervals.
Fix Text: After the fix, the conditions under IPFIX template is transferred are listed below for UDP.
No template transmission will happen on idle logging scenario.
On every new UDP socket connect to log collector from Tmm, template is transferred to log server at the beginning. Under no logging activity, UDP socket may get closed & only when new socket is opened again on logging activity, the Templates are transmitted again.
When logs are continously generated to a IPFix destination, IPFix Tempaltes are transmitted during log data transmission at the configured periodic interval.
2501773¶
NAT46/DNS64 translation entries expire during active use, causing intermittent connection failures
Component: ingress
Symptoms: When you enable DNS64/NAT46 on a virtual server, clients intermittently fail to connect to synthesized IPv4 addresses with a TCP reset (“No route to host”), even while they continuously resolve the domain and actively use the connection. These failures recur in multi-second windows tied to the configured DNS64/NAT46 TTL; outside these windows, connections succeed normally. During the failure window, DNS responses still show the mapping as valid with a non-zero remaining TTL, even as new connections to the translated address reset.
Conditions
DNS64/NAT46 is enabled on the virtual server (dnsNat46Enabled: true).
A client resolves an AAAA-only hostname through the NAT46 resolver and receives a synthesized A record.
The client keeps using that synthesized address continuously (repeated DNS lookups and/or ongoing data connections) for longer than the configured maxDNS46TTL.
Impact: Client applications that maintain long-lived or frequent connections to a DNS64/NAT46-synthesized address periodically encounter intermittent “No route to host” failures, even while continuously using the mapping.
Fix Text: Perform a “touch” on DNS queries to update the DSSM entry timestamp and refresh the NAT46 record. This synchronizes expiration so the DNS entry and NAT record expire together, preventing the DNS entry from outliving the NAT record.
2297617-1¶
Expose OTel memory_limiter processor settings via Helm values
Component: toda_otel
Symptoms: The processors.memory_limiter settings are not in values.yaml. User cannot configure it through the standard Helm interface.
Conditions: User needs to configure the processors.memory_limiter settings with values different from the defaults.
Impact: Without chart-level exposure, user had to either customize the Helm chart before deployment or manually patch the ConfigMap after deployment. Manual changes are error-prone and get overwritten on the next Helm upgrade.
Fix Text: Fixed processors.memory_limiter settings in values.yaml and templated them into the ConfigMap, replacing static values and enabling memory limit configuration via Helm.
2560921-2¶
F5ngress Helm install fails with release names over 36 characters
Component: toda_spk
Symptoms: If you use a release name longer than 36 characters (e.g., spk-automation-spk-operator-app-destination), the chart generates volume names that exceed Kubernetes’ 63-character limit, causing the installation to fail.
Conditions Install the ingress chart with a release name longer than 36 characters (e.g., spk-automation-spk-operator-app-destination).
Impact: When you use a release name longer than 36 characters, the f5ngress Helm chart generates a volume name that exceeds Kubernetes’ 63-character limit, causing the installation to fail. Helm reports: “spec.template.spec.volumes[44].name: Invalid value: “spk-automation-spk-operator-app-destination-f5-tmm-fluentbit-config”: must be no more than 63 characters.” The observer ConfigMap encounters the same issue.
Workaround: Shorten the ingress Helm chart release name to ensure the generated volume names (-fluentbit-config, -observer-config, -logs-config) stay within the 63-character Kubernetes limit.
Fix Text: Build a config map/object name that fits within Kubernetes’ 63-character limit without collisions: truncate only the base (tmm.name), always preserve the descriptive suffix, and append a short deterministic hash of the full name for uniqueness when truncation is required.
Known Issues¶
2288497-6¶
CR status may report success even when configuration was not applied to f5-tmm
Component ingress
Symptoms The f5ingress controller CR status field can report READY=true with the message “CR config sent to all grpc endpoints” even when f5-tmm did not receive or successfully apply the configuration. This gives a false-positive indication of successful configuration delivery, as the status only reflects that the gRPC send call completed without a transport-level error, not that f5-tmm actually applied the configuration internally.
Conditions
An f5-tmm pod is evicted/rescheduled (e.g., during node draining) while configuration is in-flight, causing partial delivery when the connection is re-established.
A transient network interruption occurs while an f5-tmm pod is restarting, resulting in some objects being delivered before the interruption and others after, leaving f5-tmm with a partial configuration set.
f5-tmm receives the gRPC message without a transport error but fails to apply the configuration internally (e.g., due to a transient internal error or state inconsistency), most frequently observed in clusters with a large number of f5-tmm replicas.
Impact Configuration expected to be present on f5-tmm may be silently missing or only partially applied, while the Kubernetes CR status continues to report success. This can result in traffic-affecting misconfiguration (e.g., missing Snatpool, virtual server, or pool objects) with no indication to the customer or operator that remediation is required.
Workaround F5ingress restart. If issues persist even after an f5ingress pod restart, the restart removes the missing configuration and forces f5ingress to send a new configuration.
2390145-5¶
Egress traffic is disrupted during the upgrade process
Component: egress
Symptoms: Egress traffic from the application pod will fail following the upgrade.
Conditions: Version upgrade and TMM Pod restart.
Impact: VXLAN interfaces and IP routes are wrongly provisioned on node and TMM, resulting in disruption of egress traffic.
Workaround: Delete Egress CR and restart the cne-controller pod. Improved the APP-TMM pod IP mappings synchronization logic in BIG-IP Next for Kubernetes 2.3.0 and higher versions.
2330929-9¶
ACL hardware stat intermittently out of sync
Component: Firewall (ACL)
Symptoms: The hw_counter field in the fw_rule_stat tmctl table may intermittently fail to increment.
Conditions: This occurs intermittently for gateway attached firewall policies.
Impact: ACL hw_counter stat may report values lower than actual traffic counts.
Workaround: Remove and reapply the configurations to reset the stats.
2183833-3¶
SIP egress CRD installation is not supported by FLO
Component: egress
Symptoms: SIP egress CRD is not installed when installing BNK via the F5 Lifecycle Operator (FLO).
Conditions: CRD installation is done using only FLO.
Impact: SIP egress CRD will be missing in the CRDs installed using FLO and SIP egress functionality will not be supported.
Workaround: Install SIP egress CRD using helm.
2391145-6¶
HTTP/2 egress traffic is not forwarded on OpenShift 4.18.39 with ConnectX-7 (CX7) adapters
Component: Drivers
Symptoms: HTTP/2 client requests time out occurs when TMM does not forward HTTP/2 egress traffic to the backend server, even though the HTTP/2 virtual servers are configured and operational.
Conditions: This issue occurs on OpenShift 4.18.39 deployments using NVIDIA ConnectX-7 (CX7) adapters with HTTP/2 egress traffic. The issue is not observed on equivalent ConnectX-6 (CX6) deployments.
Impact: HTTP/2 egress connections fail, preventing client applications from communicating with backend HTTP/2 servers.
2302053-5¶
Core File Streaming Supported from BNK 2.3.0 and higher
Component toda_coremon
Symptoms Initially core files were written to host volume. hostPath presents limitations in security, and flexibility, especially in cloud-native environments. In BNK 2.3.0 we introduced the streaming functionality to address this. For full feature documentation, see https://clouddocs.f5.com/cnfs/robin/latest/cnf-coremond.html. This feature is not supported in releases BNK 2.2.0 and lower.
Condition Streaming=false
Workaround HostPath volume gets created, and security violation gets triggered.
Fix Text Set streaming=true in the override file. This would enable streaming in the supported platforms thus avoiding mounting the hostPath Volume that triggers security violations.
2547629-1¶
During upgrade traffic drops if BGP routing is used
Component fsm-dynamic-routing
Symptoms Ingress and egress traffic are dropped while TMM pods are replaced during an upgrade. Routes to the pods being replaced can remain advertised until the upgrade completes.
Condition
BGP is used to route traffic to the TMM pods.
An upgrade replaces the TMM pods.
Impact Connections fail or time out until the upgrade completes.
Workaround Perform the upgrade during a maintenance window. Before the upgrade, remove the running BGP configuration from each TMM pod so that its routes are withdrawn.
List the TMM pods:
kubectl get pods -n <namespace> -l app=f5-tmmFor each pod, run:
kubectl exec -n <namespace> <pod-name> -c f5-tmm-routing -- imish -e 'enable' -e 'configure terminal' -e 'no router bgp <local-ASN>'Confirm that your upstream routers no longer list the pods’ routes, then start the upgrade.
The replacement pods load the configured BGP settings. Traffic is interrupted until they establish their BGP sessions.