CNEInstance CR

The CNF is deployed through the application of the CNEInstance CR, which allows users to specify the desired state of the CNF cluster.

The table below describes the spec parameter.

Parameter Description Default Values
certificate.clusterIssuer
string
Specifies the name of the ClusterIssuer to be used for managing TLS certificates in the cluster. -
cgnat
object
Enables CGNAT functionality. -
coreCollection.enabled
boolean
Enables or disables mounting of relevant core dump locations on the hostPath for the system in all containers and Pods. true
deploymentSize
string
Specifies how large the deployment should be, like small, medium, or large, depending on resource requirements. Available options: Small, Medium, Large, Max -
dynamicRouting.enabled
boolean
Enables or disables the dynamic routing capability. true
firewallACL.enabled
boolean
Enables or disables the Firewall Access Control List (ACL) feature, which manages traffic rules for the system's network. true
registry.uri
string
Specifies the uri from which to pull the container registry for the CNEInstance CR.
Example: repo.f5.com/images.
-
registry.imagePullSecrets.name
string
Specifies the name of the secret for authenticating with private registries. -
registry.imagePullPolicy
string
Specifies the image pull policy. Available values: Always, IfNotPresent, Never IfNotPresent
manifestVersion
string
Specifies the version of the CNE software that should be installed. -
product.type
string
The product type for this installation. -
watchNamespaces
string
The namespaces CNE Controller should watch for CRs. If WholeCluster mode is true, this is ignored.The special "Any" namespace can be used to watch all namespaces when WholeCluster is false. Watches no namespaces
TMMReplicas
integer
When WholeCluster and DPU are both false, this defines how many replicas of TMM should be deployed. 1
dpu.dpf.dpucluster
array
The DPU Clusters this CNE Installation is associated. -
intrusionPrevention.enabled
boolean
Enables Intrusion prevention functionality. Note: This is applicable when the product type parameter is set to CNF. false
ipIntelligence.enabled
boolean
Enables ipIntelligence functionality. Note: This is applicable when the product type parameter is set to CNF. -
pseudoCNI.enabled
boolean
Enables or disables pseudo CNI (Container Network Interface) functionality. true
networkAttachments.items
string
Lists the network interfaces the deployment will use. It’s like specifying which network cables to plug into the system. -
policyEnforcement.enabled
boolean
Enables policy enforcement functionality.Note: This is applicable when the product type parameter is set to CNF. false
telemetry.loggingSubsystem.enabled
boolean
Enables or disables the logging subsystem for centralized collection and management of container logs across the system. true
telemetry.metricSubsystem.enabled
boolean
Enables or disables the metrics subsystem for collecting and managing performance metrics, exposing them for monitoring and analysis. true
storageClassName
string
Defines a global Storage Class for all Persistent Volume Claims used by components requiring persistent storage. It ensures consistent storage management across components but does not allow different storage classes for individual components. Ensure the configured Storage Class is provisioned with adequate capacity. It is recommended to periodically manage and offload large files like core dumps to permanent storage. -

The table below describes the spec.advance parameters.

Parameter Description Default Values
crdListConfigMap
object
The ConfigMap that contains a list of CRs to watch. By default, CneController will list all installed CRDs and watch the known CRs. This field is optional. -

The table below describes the spec.advanced.cneController.env.items parameters used to configure environment variables for the CNE Controller.

Parameter Description Default Values
name
string
Specifies the name of the environment variable in a container. This must be in C_IDENTIFIER format. -
value
string
Defines the value assigned to the environment variable specified by name. This value can be a literal (hardcoded) string or utilize variable interpolation (e.g., $(VAR_NAME) for referencing other variables). -
valueFrom
string
Specifies the source for the environment variable's value, allowing configuration values to be dynamically fetched from external sources like ConfigMaps, Secrets, Pod fields, or resources. -
valueFrom.configMapKeyRef.key
string
Specifies the exact key in the ConfigMap to fetch the value from. This key must exist in the referenced ConfigMap. -
valueFrom.configMapKeyRef.name
string
Name of the ConfigMap to reference. If omitted, defaults to an empty string (""). -
valueFrom.configMapKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing ConfigMap or key will not cause an error; otherwise, it will fail. false
valueFrom.fieldRef.apiVersion
string
Specifies the version of the schema the fieldPath is based on v1. v1
valueFrom.fieldRef.fieldPath
string
Specifies the field path to select within the given API version. -
valueFrom.resourceFieldRef.containerName
string
Specifies the name of the container whose resource (e.g., CPU/memory) limits/requests are being referenced. Required for volume configurations, but optional for environment variables. -
valueFrom.resourceFieldRef.divisor
integer/string
Specifies the format for the exposed resource value. -
valueFrom.resourceFieldRef.resource
string
Required field specifying the resource to select (e.g., limits.cpu, requests.memory, limits.ephemeral-storage). -
valueFrom.secretKeyRef.key
string
Specifies the exact key in the Secret to fetch the value from. This key must exist in the referenced Secret. -
valueFrom.secretKeyRef.name
string
Name of the Secret to reference. If omitted, defaults to an empty string (""). -
valueFrom.secretKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing Secret or key will not cause an error; otherwise, it will fail. false

The table below describes the spec.advanced.cneController parameter.

Parameter Description Default Values
maxItems
integer
Specifies the maximum number of environment variable entries you can define under spec.advanced.cneController.env.items. 50

The table below describes the spec.advanced.coremond.env.items parameters used to configure environment variables for the Coremond.

Parameter Description Default Values
name
string
Specifies the name of the environment variable in a container. This must be in C_IDENTIFIER format. -
value
string
Defines the value assigned to the environment variable specified by name. This value can be a literal (hardcoded) string or utilize variable interpolation (e.g., $(VAR_NAME) for referencing other variables). -
valueFrom
string
Specifies the source for the environment variable's value, allowing configuration values to be dynamically fetched from external sources like ConfigMaps, Secrets, Pod fields, or resources. -
valueFrom.configMapKeyRef.key
string
Specifies the exact key in the ConfigMap to fetch the value from. This key must exist in the referenced ConfigMap. -
valueFrom.configMapKeyRef.name
string
Name of the ConfigMap to reference. If omitted, defaults to an empty string (""). -
valueFrom.configMapKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing ConfigMap or key will not cause an error; otherwise, it will fail. false
valueFrom.fieldRef.apiVersion
string
Specifies the version of the schema the fieldPath is based on v1. v1
valueFrom.fieldRef.fieldPath
string
Specifies the field path to select within the given API version. -
valueFrom.resourceFieldRef.containerName
string
Specifies the name of the container whose resource (e.g., CPU/memory) limits/requests are being referenced. Required for volume configurations, but optional for environment variables. -
valueFrom.resourceFieldRef.divisor
integer/string
Specifies the format for the exposed resource value. -
valueFrom.resourceFieldRef.resource
string
Required field specifying the resource to select (e.g., limits.cpu, requests.memory, limits.ephemeral-storage). -
valueFrom.secretKeyRef.key
string
Specifies the exact key in the Secret to fetch the value from. This key must exist in the referenced Secret. -
valueFrom.secretKeyRef.name
string
Name of the Secret to reference. If omitted, defaults to an empty string (""). -
valueFrom.secretKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing Secret or key will not cause an error; otherwise, it will fail. false

The table below describes the spec.advanced.coremond parameters.

Parameter Description Default Values
maxItems
integer
Specifies the maximum number of environment variable entries you can define under spec.advanced.coremond.env.items. 50
hostPath
boolean
Specifies whether a hostPath volume is mounted for the coremond component. false

The table below describes the spec.advanced.cwc.env.items parameters used to configure environment variables for the CWC.

Parameter Description Default Values
name
string
Specifies the name of the environment variable in a container. This must be in C_IDENTIFIER format. -
value
string
Defines the value assigned to the environment variable specified by name. This value can be a literal (hardcoded) string or utilize variable interpolation (e.g., $(VAR_NAME) for referencing other variables). -
valueFrom
string
Specifies the source for the environment variable's value, allowing configuration values to be dynamically fetched from external sources like ConfigMaps, Secrets, Pod fields, or resources. -
valueFrom.configMapKeyRef.key
string
Specifies the exact key in the ConfigMap to fetch the value from. This key must exist in the referenced ConfigMap. -
valueFrom.configMapKeyRef.name
string
Name of the ConfigMap to reference. If omitted, defaults to an empty string (""). -
valueFrom.configMapKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing ConfigMap or key will not cause an error; otherwise, it will fail. false
valueFrom.fieldRef.apiVersion
string
Specifies the version of the schema the fieldPath is based on v1. v1
valueFrom.fieldRef.fieldPath
string
Specifies the field path to select within the given API version. -
valueFrom.resourceFieldRef.containerName
string
Specifies the name of the container whose resource (e.g., CPU/memory) limits/requests are being referenced. Required for volume configurations, but optional for environment variables. -
valueFrom.resourceFieldRef.divisor
integer/string
Specifies the format for the exposed resource value. -
valueFrom.resourceFieldRef.resource
string
Required field specifying the resource to select (e.g., limits.cpu, requests.memory, limits.ephemeral-storage). -
valueFrom.secretKeyRef.key
string
Specifies the exact key in the Secret to fetch the value from. This key must exist in the referenced Secret. -
valueFrom.secretKeyRef.name
string
Name of the Secret to reference. If omitted, defaults to an empty string (""). -
valueFrom.secretKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing Secret or key will not cause an error; otherwise, it will fail. false

The table below describes the spec.advanced.cwc parameter.

Parameter Description Default Values
maxItems
integer
Specifies the maximum number of environment variable entries you can define under spec.advanced.cwc.env.items. 50

The table below describes the spec.advanced.demoMode parameter.

Parameter Description Default Values
enabled
boolean
Enables or disables demo mode configuration. false

The table below describes the spec.advanced.envDiscovery.env.items parameters used to configure environment variables for the discovery jobs.

Parameter Description Default Values
name
string
Specifies the name of the environment variable in a container. This must be in C_IDENTIFIER format. -
value
string
Defines the value assigned to the environment variable specified by name. This value can be a literal (hardcoded) string or utilize variable interpolation (e.g., $(VAR_NAME) for referencing other variables). -
valueFrom
string
Specifies the source for the environment variable's value, allowing configuration values to be dynamically fetched from external sources like ConfigMaps, Secrets, Pod fields, or resources. -
valueFrom.configMapKeyRef.key
string
Specifies the exact key in the ConfigMap to fetch the value from. This key must exist in the referenced ConfigMap. -
valueFrom.configMapKeyRef.name
string
Name of the ConfigMap to reference. If omitted, defaults to an empty string (""). -
valueFrom.configMapKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing ConfigMap or key will not cause an error; otherwise, it will fail. false
valueFrom.fieldRef.apiVersion
string
Specifies the version of the schema the fieldPath is based on v1. v1
valueFrom.fieldRef.fieldPath
string
Specifies the field path to select within the given API version. -
valueFrom.resourceFieldRef.containerName
string
Specifies the name of the container whose resource (e.g., CPU/memory) limits/requests are being referenced. Required for volume configurations, but optional for environment variables. -
valueFrom.resourceFieldRef.divisor
integer/string
Specifies the format for the exposed resource value. -
valueFrom.resourceFieldRef.resource
string
Required field specifying the resource to select (e.g., limits.cpu, requests.memory, limits.ephemeral-storage). -
valueFrom.secretKeyRef.key
string
Specifies the exact key in the Secret to fetch the value from. This key must exist in the referenced Secret. -
valueFrom.secretKeyRef.name
string
Name of the Secret to reference. If omitted, defaults to an empty string (""). -

The table below describes the spec.advanced.envDiscovery parameter.

Parameter Description Default Values
enabled
boolean
Enables or disables the environment discovery functionality. Controls whether discovery jobs are run across all nodes in the cluster. false
maxItems
integer
Specifies the maximum number of environment discovery functionality you can define under spec.advanced.envDiscovery.env.items. 100
runAfterSuccess
boolean
Controls whether the environment discovery jobs should continuously run after successfully completing a cycle. -
stopOnFail
boolean
Indicates whether the discovery jobs should stop executing if any failure occurs during their execution. Useful for debugging scenarios. -
sriovResourceNames
array
SRIOV network resource names to be used by env-discovery job. -
disablecheckgenerics
boolean
Disable specific environment checks. false
disablecheckannotations
boolean
DisableCheckAnnotations disables checking for required Kubernetes annotations. false
disablecheckvfs
boolean
DisableCheckVFs disables checking for SR-IOV Virtual Functions. false
disablecheckhugepages
boolean
DisableCheckHugepages disables checking for HugePages. false
disablechecksfconfig
boolean
DisableCheckSFConfig disables checking for SmartNIC SR-IOV configuration. false
disablecheckserverconfig
boolean
DisableCheckServerConfig disables checking for server configuration. false
disablechecktaints
boolean
DisableCheckTaints disables checking for Kubernetes taints. false
disablechecklabels
boolean
DisableCheckLabels disables checking for Kubernetes labels. false

The table below describes the spec.advanced.firewallACL.env.items parameters used to configure environment variables for the firewall Access Control Lists (ACLs).

Parameter Description Default Values
name
string
Specifies the name of the environment variable in a container. This must be in C_IDENTIFIER format. -
value
string
Defines the value assigned to the environment variable specified by name. This value can be a literal (hardcoded) string or utilize variable interpolation (e.g., $(VAR_NAME) for referencing other variables). -
valueFrom
string
Specifies the source for the environment variable's value, allowing configuration values to be dynamically fetched from external sources like ConfigMaps, Secrets, Pod fields, or resources. -
valueFrom.configMapKeyRef.key
string
Specifies the exact key in the ConfigMap to fetch the value from. This key must exist in the referenced ConfigMap. -
valueFrom.configMapKeyRef.name
string
Name of the ConfigMap to reference. If omitted, defaults to an empty string (""). -
valueFrom.configMapKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing ConfigMap or key will not cause an error; otherwise, it will fail. false
valueFrom.fieldRef.apiVersion
string
Specifies the version of the schema the fieldPath is based on v1. v1
valueFrom.fieldRef.fieldPath
string
Specifies the field path to select within the given API version. -
valueFrom.resourceFieldRef.containerName
string
Specifies the name of the container whose resource (e.g., CPU/memory) limits/requests are being referenced. Required for volume configurations, but optional for environment variables. -
valueFrom.resourceFieldRef.divisor
integer/string
Specifies the format for the exposed resource value. -
valueFrom.resourceFieldRef.resource
string
Required field specifying the resource to select (e.g., limits.cpu, requests.memory, limits.ephemeral-storage). -
valueFrom.secretKeyRef.key
string
Specifies the exact key in the Secret to fetch the value from. This key must exist in the referenced Secret. -
valueFrom.secretKeyRef.name
string
Name of the Secret to reference. If omitted, defaults to an empty string (""). -

The table below describes the spec.advanced.firewallACL parameter.

Parameter Description Default Values
maxItems
integer
Specifies the maximum number of environment discovery functionality you can define under spec.advanced.firewallACL.env.items. 50

The table below describes the spec.advanced.maintenanceMode parameter.

Parameter Description Default Values
enabled
boolean
Enables or disables maintenance mode for the resource. false

The table below describes the spec.advanced.Otel.env.items parameters used to configure environment variables for the Otel.

Parameter Description Default Values
name
string
Specifies the name of the environment variable in a container. This must be in C_IDENTIFIER format. -
value
string
Defines the value assigned to the environment variable specified by name. This value can be a literal (hardcoded) string or utilize variable interpolation (e.g., $(VAR_NAME) for referencing other variables). -
valueFrom
string
Specifies the source for the environment variable's value, allowing configuration values to be dynamically fetched from external sources like ConfigMaps, Secrets, Pod fields, or resources. -
valueFrom.configMapKeyRef.key
string
Specifies the exact key in the ConfigMap to fetch the value from. This key must exist in the referenced ConfigMap. -
valueFrom.configMapKeyRef.name
string
Name of the ConfigMap to reference. If omitted, defaults to an empty string (""). -
valueFrom.configMapKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing ConfigMap or key will not cause an error; otherwise, it will fail. false
valueFrom.fieldRef.apiVersion
string
Specifies the version of the schema the fieldPath is based on v1. v1
valueFrom.fieldRef.fieldPath
string
Specifies the field path to select within the given API version. -
valueFrom.resourceFieldRef.containerName
string
Specifies the name of the container whose resource (e.g., CPU/memory) limits/requests are being referenced. Required for volume configurations, but optional for environment variables. -
valueFrom.resourceFieldRef.divisor
integer/string
Specifies the format for the exposed resource value. -
valueFrom.resourceFieldRef.resource
string
Required field specifying the resource to select (e.g., limits.cpu, requests.memory, limits.ephemeral-storage). -
valueFrom.secretKeyRef.key
string
Specifies the exact key in the Secret to fetch the value from. This key must exist in the referenced Secret. -
valueFrom.secretKeyRef.name
string
Name of the Secret to reference. If omitted, defaults to an empty string (""). -

The table below describes the spec.advanced.otel parameter.

Parameter Description Default Values
maxItems
integer
Specifies the maximum number of environment variable entries you can define under spec.advanced.otel.env.items. -
prometheusNamespace
string
Prometheus namespace for metrics collection. -

The table below describes the spec.advanced.pseudoCNI.env.items parameters used to configure environment variables for the pseudoCNI.

Parameter Description Default Values
name
string
Specifies the name of the environment variable in a container. This must be in C_IDENTIFIER format. -
value
string
Defines the value assigned to the environment variable specified by name. This value can be a literal (hardcoded) string or utilize variable interpolation (e.g., $(VAR_NAME) for referencing other variables). -
valueFrom
string
Specifies the source for the environment variable's value, allowing configuration values to be dynamically fetched from external sources like ConfigMaps, Secrets, Pod fields, or resources. -
valueFrom.configMapKeyRef.key
string
Specifies the exact key in the ConfigMap to fetch the value from. This key must exist in the referenced ConfigMap. -
valueFrom.configMapKeyRef.name
string
Name of the ConfigMap to reference. If omitted, defaults to an empty string (""). -
valueFrom.configMapKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing ConfigMap or key will not cause an error; otherwise, it will fail. false
valueFrom.fieldRef.apiVersion
string
Specifies the version of the schema the fieldPath is based on v1. v1
valueFrom.fieldRef.fieldPath
string
Specifies the field path to select within the given API version. -
valueFrom.resourceFieldRef.containerName
string
Specifies the name of the container whose resource (e.g., CPU/memory) limits/requests are being referenced. Required for volume configurations, but optional for environment variables. -
valueFrom.resourceFieldRef.divisor
integer/string
Specifies the format for the exposed resource value. -
valueFrom.resourceFieldRef.resource
string
Required field specifying the resource to select (e.g., limits.cpu, requests.memory, limits.ephemeral-storage). -
valueFrom.secretKeyRef.key
string
Specifies the exact key in the Secret to fetch the value from. This key must exist in the referenced Secret. -
valueFrom.secretKeyRef.name
string
Name of the Secret to reference. If omitted, defaults to an empty string (""). -

The table below describes the spec.advanced.pseudoCNI parameter.

Parameter Description Default Values
maxItems
integer
Specifies the maximum number of environment discovery functionality you can define under spec.advanced.pseudoCNI.env.items. 50

The table below describes the spec.advanced.tmm.env.items parameters used to configure environment variables for the TMM.

Parameter Description Default Values
name
string
Specifies the name of the environment variable in a container. This must be in C_IDENTIFIER format. -
value
string
Defines the value assigned to the environment variable specified by name. This value can be a literal (hardcoded) string or utilize variable interpolation (e.g., $(VAR_NAME) for referencing other variables). -
valueFrom
string
Specifies the source for the environment variable's value, allowing configuration values to be dynamically fetched from external sources like ConfigMaps, Secrets, Pod fields, or resources. -
valueFrom.configMapKeyRef.key
string
Specifies the exact key in the ConfigMap to fetch the value from. This key must exist in the referenced ConfigMap. -
valueFrom.configMapKeyRef.name
string
Name of the ConfigMap to reference. If omitted, defaults to an empty string (""). -
valueFrom.configMapKeyRef.optional
boolean
Determines whether the environment variable is optional. If true, a missing ConfigMap or key will not cause an error; otherwise, it will fail. false
valueFrom.fieldRef.apiVersion
string
Specifies the version of the schema the fieldPath is based on v1. v1
valueFrom.fieldRef.fieldPath
string
Specifies the field path to select within the given API version. -
valueFrom.resourceFieldRef.containerName
string
Specifies the name of the container whose resource (e.g., CPU/memory) limits/requests are being referenced. Required for volume configurations, but optional for environment variables. -
valueFrom.resourceFieldRef.divisor
integer/string
Specifies the format for the exposed resource value. -
valueFrom.resourceFieldRef.resource
string
Required field specifying the resource to select (e.g., limits.cpu, requests.memory, limits.ephemeral-storage). -
valueFrom.secretKeyRef.key
string
Specifies the exact key in the Secret to fetch the value from. This key must exist in the referenced Secret. -
valueFrom.secretKeyRef.name
string
Name of the Secret to reference. If omitted, defaults to an empty string (""). -

The table below describes the spec.advanced.tmm parameter.

Parameter Description Default Values
maxItems
integer
Specifies the maximum number of environment discovery functionality you can define under spec.advanced.tmm.env. 50
annotations
object
Used to override the annotations applied to the TMM pods. -
resources
object
Used to override the resource requests/limits for the TMM pods over the values set by the deployment Size attribute. -

The table below describes the status.condition.items parameter.

Parameter Description Default Values
lastTransitionTime
string (date-time)
The timestamp indicating the last moment the condition transitioned from one state to another. Used for tracking state change events. -
message
string
A human-readable message describing details about the condition’s transition or current state. -
observedGeneration
integer
The generation of the resource metadata at the time the condition was last updated. Helps ensure the condition aligns with the latest resource version. -
reason
string
A programmatic identifier (in CamelCase) explaining the reason behind the condition’s last status transition. Producers may define expected values. -
status
string
Specifies the current state of the condition. Available values: True, False or Unknown. -
type
string
Specifies the type of the condition being monitored. -

(2.2.1 and later) Schedule component pods

Describes how to configure pod scheduling fields for components so you can place them on the right nodes—for example, schedule TMM on DPUs and prevent F5 ingress, DSSM, and CWC from running on DPUs.

The below table lists the categories in spec.placement section.

Categories Included component
spec.placement.dataplane TMM
spec.placement.controlplane CNE controller, analyzer, CWC and others
spec.placement.observability fluentd, observer
spec.placement.sessionState DSSM

The table below describes the scheduling fields of each category (eg.spec.placement.dataplane.nodeSelector).

Scheduling fields Description
nodeSelector
object
Specifies the labels of nodes on which pod of the components are scheduled.
affinity
object
Defines the scheduling constraints for the component's pod.
tolerations
integer
Defines the tolerations for the component's pod.
topologySpreadConstraints
array
Schedule matching pods within the specified topology.
priorityClassName
string
Specifies the name of the Priority Class.