F5BigGlobalOptions¶

Overview¶

The F5BigGlobalOptions Custom Resource (CR) contains optional settings that allow ‌users to enable non-standard behaviors or features. By default, these non-standard behaviors and features are disabled in the global settings and these values may need to be enabled for some use cases. If a user has to change these non-standard optional behaviors or features, they must understand and acknowledge the consequences before changing the global settings from their default values.

These settings affect the global operation of the system. Currently, there is no provision to selectively enable any of them on a per-object basis. Any configured entities recognizing a F5BigGlobalOptions setting will be affected.

CR Parameters¶

The following tables list the F5BigGlobalOptions CR parameters:

Metadata¶

Parameter	Description
name	Name of the GlobalOptions Reference CR by which the k8s identifies the CR.

spec.dnscache¶

Parameter	Description
`matchWildcardVip`	This parameter controls the instances of the DNS cache to match a catch-all (`wildcard`) listener that will be used when sending out DNS queries.

spec.ip¶

Parameter Description

acceptIpOptions This setting controls whether IPv4 packets with Options field specified are accepted at the global level. The default value for acceptIpOptions parameter is false. This means that all IPv4 packets that have Options field are dropped, except for a few such as Router Alert with IGMP option.
Note: This option can be set only if the user wants to have custom control over allowing traffic with IPv4 Option at global level.

Parameter	Description
`acceptIpOptions`	This setting controls whether IPv4 packets with `Options` field specified are accepted at the global level. The default value for `acceptIpOptions` parameter is `false`. This means that all IPv4 packets that have `Options` field are dropped, except for a few such as `Router Alert` with `IGMP` option. Note: This option can be set only if the user wants to have custom control over allowing traffic with IPv4 Option at global level.

spec.crypto¶

Parameter	Type	Default	Description
`hwAccel`	boolean	`true`	Enables or disables crypto hardware acceleration. When true (default), the system uses hardware acceleration for cryptographic operations if the platform supports it.

spec.firewall¶

Parameter	Type	Default	Description
`defaultAction`	string	`""`	The default action to apply to traffic that does not match any firewall rule in a Secure Context or Gateway. Valid values: `""` (no action), accept, reject, or drop. An empty string means no default action is applied.
`defaultActionLog`	boolean	`true`	When enabled, the system generates an HSL message when applying the `defaultAction`.
`hardwareOffload`	boolean	`true`	Enables or disables hardware offloading of firewall rules if the platform supports it.

spec.tcpOptimization¶

Parameter	Type	Default	Description
`initWindowAfterXon`	boolean	`true`	Enables use of an optimized initial congestion window after XON flow resumption.
`initWindowMultiplierAfterXon`	integer	`1`	Multiplier applied to the baseline initial congestion window after XON to scale recovery aggressiveness. Valid range: 1–100.

spec.tcpOptimization.autoTuning¶

The autoTuning settings control adaptive TCP buffer growth parameters, including minimum and maximum limits, growth cadence, and responsiveness to path characteristics.

Send buffer¶

Parameter	Type	Default	Description
`sendBufMin`	integer	`131070`	The minimum send buffer size, in bytes, applied before any adaptive growth. Valid range: 4096–1048576.
`sendBufMax`	integer	`16777216`	The maximum send buffer size, in bytes, for each progressive tuning connection. Valid range: 1048576–16777216.
`sendBufIncr`	integer	`65536`	The increment applied when growing the send buffer during adaptive tuning cycles, in bytes. Valid range: 4096–1048576.
`sendBufMinInterval`	integer	`100`	The minimum interval, in milliseconds, between attempts to enlarge the send buffer. Valid range: 10–65535.
`sendBufBDPMultiplier`	integer	`1`	Multiplier applied to the bandwidth-delay product when targeting send buffer size. Valid range: 1–10.

Receive buffer¶

Parameter	Type	Default	Description
`recvBufMin`	integer	`65535`	The minimum receive buffer size, in bytes, applied before any adaptive growth. Valid range: 4096–1048576.
`recvBufMax`	integer	`16777216`	The maximum receive buffer size, in bytes, for each progressive tuning connection. Valid range: 4194304–16777216.
`recvBufIncr`	integer	`65536`	The increment applied when growing the receive buffer during adaptive tuning cycles, in bytes. Valid range: 4096–1048576.
`recvBufMinInterval`	integer	`100`	The minimum interval, in milliseconds, between attempts to enlarge the receive buffer. Valid range: 10–65535.
`recvBufBDPMultiplier`	integer	`1`	Multiplier applied to the bandwidth-delay product when targeting receive buffer size. Valid range: 1–10.

Proxy buffer¶

Parameter	Type	Default	Description
`proxyBufMin`	integer	`65535`	The minimum proxy buffer size, in bytes, used before adaptive scaling. Valid range: 4096–1048576.
`proxyBufMax`	integer	`2097152`	The maximum proxy buffer size, in bytes, limiting adaptive growth. Valid range: 1048576–4194304.
`proxyBufOffset`	integer	`65535`	Offset added to the computed proxy buffer size for headroom safety margin, in bytes. Valid range: 4096–1048576.

Nagle¶

Parameter	Type	Default	Description
`autoNagleRttThreshold`	integer	`20`	The Round Trip Time (RTT) threshold, in milliseconds, used to adjust delayed send (Nagle-related) behavior automatically. Valid range: 0–200.

matchWildcardVip setting¶

By default, queries from the DNS cache towards upstream DNS servers are sent out with the self-IP address of the Traffic Management Microkernel (TMM) pod by default. However, for more control and security of the queries, an optional feature is provided. The user can configure F5BigContextSecure (listener), which is an endpoint whose destination matches all outgoing traffic, such as one targeting 0.0.0.0/0 and/or ::/0 networks, and attach a F5BigCneSnatpool to it.

If an endpoint is available when the cache attempts to connect to an external DNS server for recursive resolution, it will be used as the originator of the query. This IP address from the SNAT pool attached to the listener will be used as the source address. This helps to hide the internal network information of the user, specifically, the self-IP of the system. If a wildcard listener is not present, or one was configured without an SNAT pool, enabling this option has no effect. As par for the course with global options, this setting affects all instances of the cache configured on the system.

Installation¶

Following are the steps to install an example F5BigGlobalOptions CR:

Before applying the F5BigGlobalOptions CR, check for an instance of the same resource as the F5BigGlobalOptions CR needs to be a singleton. Creating additional instance of the F5BigGlobalOptions CR will cause an exceeded quota error.
The example F5BigGlobalOptions CR modifies acceptIpOptions parameter under the ip section, and matchWildcardVip parameter under the dnscache section, setting both the values to true. Copy and paste the following example into a YAML file (for example globaloptions-cr.yaml).

Basic configuration (IP options and DNS cache)

apiVersion: "k8s.f5net.com/v1"
kind: F5BigGlobalOptions
metadata:
  name: "globaloptions"
spec:
  ip:
    acceptIpOptions: true
  dnscache:
    matchWildcardVip: true

Firewall default action with hardware offload

apiVersion: "k8s.f5net.com/v1"
kind: F5BigGlobalOptions
metadata:
  name: "globaloptions"
spec:
  firewall:
    defaultAction: "drop"
    defaultActionLog: true
    hardwareOffload: true

TCP optimization with auto-tuning

apiVersion: "k8s.f5net.com/v1"
kind: F5BigGlobalOptions
metadata:
  name: "globaloptions"
spec:
  tcpOptimization:
    initWindowAfterXon: true
    initWindowMultiplierAfterXon: 2
    autoTuning:
      sendBufMax: 16777216
      recvBufMax: 16777216
      sendBufIncr: 131072
      recvBufIncr: 131072
      sendBufMinInterval: 50
      recvBufMinInterval: 50
      autoNagleRttThreshold: 10

Full configuration

apiVersion: "k8s.f5net.com/v1"
kind: F5BigGlobalOptions
metadata:
  name: "globaloptions"
spec:
  ip:
    acceptIpOptions: false
  dnscache:
    matchWildcardVip: true
  crypto:
    hwAccel: true
  firewall:
    defaultAction: "drop"
    defaultActionLog: true
    hardwareOffload: true
  tcpOptimization:
    initWindowAfterXon: true
    initWindowMultiplierAfterXon: 1
    autoTuning:
      sendBufMin: 131070
      sendBufMax: 16777216
      sendBufIncr: 65536
      sendBufMinInterval: 100
      sendBufBDPMultiplier: 1
      recvBufMin: 65535
      recvBufMax: 16777216
      recvBufIncr: 65536
      recvBufMinInterval: 100
      recvBufBDPMultiplier: 1
      proxyBufMin: 65535
      proxyBufMax: 2097152
      proxyBufOffset: 65535
      autoNagleRttThreshold: 20

Install the F5BigGlobalOptions CR by running the following command:
```
kubectl apply -f globaloptions-cr.yaml
```

Verify whether the F5BigGlobalOptions CR was added/updated. Check the BIG-IP Controller logs, which will show that the F5BigGlobalOptions CR was added/updated.

I0822 12:00:00.123456      13 event.go:364] Event(v1.ObjectReference{Kind:"F5BigGlobalOptions", …}): type: 'Normal' reason: 'Added/Updated' globalOptions default/globaloptions-cr was added/updated

In the example setup, acceptIpOptions is enabled, which allows IPv4 packets with Options field specified. As an example, if a F5BigDdosGlobal CR is also applied to rate-limit ipv4OptFrame vector (a flood of too many IPv4 packets with an IP options frame), then the traffic has to be rate-limited according to the ratelimit parameter specified in the F5BigDdosGlobal CR, to avoid any traffic getting dropped.
In the example setup, matchWildcardVip is also enabled, having the instances of the DNS cache match a catch-all listener for DNS queries.
If an instance of the F5BigGlobalOptions CR is created or not created, and the ip (or dnscache) section is not specified, then the ip.acceptIpOptions or dnscache.matchWildcardVip parameter value is set to false by default.

Note

If the ip, dnscache, crypto, firewall, or tcpOptimization section is not specified, all parameters within that section use their default values.

Additional CRs¶

Feedback¶

Provide your feedback to improve this document by sending an email to cnfdocs@f5.com.