Cloud-Native Network Functions on Robin 2.4.1 release notes¶
About this release¶
Introduction¶
These release notes describe the differences between CNFs on Robin 2.4.0 and 2.4.1.
Supported container-orchestration platforms¶
This release is officially supported on these container-orchestration platforms and versions:
| Platform | Version | Recommended Helm version |
|---|---|---|
| Robin | 5.4.3-616 (HF5) | 3.x |
| Robin | 5.4.3-564 | 3.x |
| Robin | 5.4.3-302 | 3.x |
| Robin | 5.3.11-217 | 3.x |
Security updates¶
> Click to view table of fixed CVEs:
| CVE Number | Bug IDs | Image Names | Package Name |
|---|---|---|---|
| CVE-2023-52168 | 2459141 | f5-access-renderer | 7zip |
| CVE-2023-52169 | 2459145 | f5-access-renderer | 7zip |
| CVE-2024-2236 | 2476717 | baseos | libgcrypto20 |
| CVE-2024-24786 | 2475069, 2506137 | f5-zonerunner | google.golang.org/protobuf |
| CVE-2025-15649 | 2489445 | baseos | perl-base |
| CVE-2025-5278 | 2507945 | baseos | coreutils |
| CVE-2025-59375 | 2506341, 2506469, 2506909, 2507017, 2507169, 2507313, 2507473, 2507577, 2507745 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2025-6141 | 2506901, 2507309, 2507949 | baseos, f5-gslb-debug-sidecar, f5dr-img | libncurses6, libncursesw6 |
| CVE-2026-10722 | 2475129 | opentelemetry-collector-contrib | github.com/cilium/ebpf |
| CVE-2026-10723 | 2476245, 2506661 | f5-gslb-debug-sidecar | bind9-dnsutils |
| CVE-2026-10822 | 2476249, 2506665 | f5-gslb-debug-sidecar | bind9-dnsutils |
| CVE-2026-11331 | 2476253, 2506669 | f5-gslb-debug-sidecar | bind9-dnsutils |
| CVE-2026-11622 | 2476257, 2506673 | f5-gslb-debug-sidecar | bind9-dnsutils |
| CVE-2026-11721 | 2476261, 2506677 | f5-gslb-debug-sidecar | bind9-dnsutils |
| CVE-2026-11856 | 2476265, 2476393, 2476461, 2506681 | f5-access-apmd, f5-fluentbit, f5-gslb-debug-sidecar | curl, libcurl4t64 |
| CVE-2026-12087 | 2489449 | baseos | perl-base |
| CVE-2026-12617 | 2476269, 2506685 | f5-gslb-debug-sidecar | bind9-dnsutils |
| CVE-2026-13204 | 2506689 | f5-gslb-debug-sidecar | bind9-dnsutils |
| CVE-2026-13221 | 2489453 | baseos | perl-base |
| CVE-2026-13321 | 2476273, 2506693 | f5-gslb-debug-sidecar | bind9-dnsutils |
| CVE-2026-13595 | 2507021, 2507925, 2517373 | baseos, dnsx-img, f5-fluentd | bsdextrautils, bsdutils, libfdisk1 |
| CVE-2026-13608 | 2506449, 2506573, 2506593, 2507749, 2507897 | crd-installer, f5-debug-sidecar, f5-ipsec, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-13757 | 2476693 | baseos | libp11-kit0 |
| CVE-2026-14663 | 2476469 | f5-fluentbit | libpq5 |
| CVE-2026-14664 | 2476473 | f5-fluentbit | libpq5 |
| CVE-2026-14666 | 2476477 | f5-fluentbit | libpq5 |
| CVE-2026-14668 | 2476481 | f5-fluentbit | libpq5 |
| CVE-2026-14669 | 2476485 | f5-fluentbit | libpq5 |
| CVE-2026-14670 | 2476489 | f5-fluentbit | libpq5 |
| CVE-2026-14671 | 2476493 | f5-fluentbit | libpq5 |
| CVE-2026-14672 | 2476497 | f5-fluentbit | libpq5 |
| CVE-2026-14673 | 2476501 | f5-fluentbit | libpq5 |
| CVE-2026-14677 | 2476505 | f5-fluentbit | libpq5 |
| CVE-2026-14678 | 2476509 | f5-fluentbit | libpq5 |
| CVE-2026-14679 | 2476513 | f5-fluentbit | libpq5 |
| CVE-2026-14680 | 2476517 | f5-fluentbit | libpq5 |
| CVE-2026-15059 | 2476697, 2517377 | baseos, f5-fluentd | libsystemd-shared, libsystemd0 |
| CVE-2026-15308 | 2506345, 2506473, 2506701, 2506913, 2507025, 2507173, 2507321, 2507477, 2507581 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-gslb-debug-sidecar, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, spk-csrc | libpython3.12-minimal |
| CVE-2026-15534 | 2507177, 2507325, 2507965 | baseos, f5-access-apmd, f5-bnk-cis | perl-base |
| CVE-2026-15588 | 2507753 | ocnos-img | libglib2.0-0t64 |
| CVE-2026-15741 | 2476521 | f5-fluentbit | libpq5 |
| CVE-2026-15742 | 2476525 | f5-fluentbit | libpq5 |
| CVE-2026-16118 | 2507757 | ocnos-img | libglib2.0-0t64 |
| CVE-2026-16239 | 2476529 | f5-fluentbit | libpq5 |
| CVE-2026-16241 | 2476533 | f5-fluentbit | libpq5 |
| CVE-2026-16742 | 2476701, 2517381 | baseos, f5-fluentd | libsystemd-shared, libsystemd0 |
| CVE-2026-18024 | 2476537 | f5-fluentbit | libpq5 |
| CVE-2026-18374 | 2506597, 2507029, 2507181, 2507329, 2517385 | dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec | libc-bin |
| CVE-2026-18408 | 2476541 | f5-fluentbit | libpq5 |
| CVE-2026-18924 | 2506453, 2506577, 2506601, 2507761, 2507901 | crd-installer, f5-debug-sidecar, f5-ipsec, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-18938 | 2489413 | baseos | libp11-kit0 |
| CVE-2026-19385 | 2476545 | f5-fluentbit | libpq5 |
| CVE-2026-19487 | 2507185, 2507337, 2507973 | baseos, f5-access-apmd, f5-bnk-cis | perl-base |
| CVE-2026-19499 | 2506605, 2507033, 2507189, 2507341, 2507977, 2517389 | baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec | libc-bin |
| CVE-2026-19542 | 2506609, 2507037, 2507193, 2507345, 2507981, 2517393 | baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec | libc-bin |
| CVE-2026-19931 | 2506457, 2506581, 2506613, 2506709, 2507349, 2507709, 2507765, 2507905 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5-gslb-debug-sidecar, f5-ipsec, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-25680 | 2475073, 2475549, 2506141 | f5-dssm-upgrader, f5-zonerunner | golang.org/x/net |
| CVE-2026-25681 | 2475017, 2475509, 2506101 | f5-dssm-upgrader, f5-zonerunner | golang.org/x/net |
| CVE-2026-27136 | 2475021, 2475513, 2506105 | f5-dssm-upgrader, f5-zonerunner | golang.org/x/net |
| CVE-2026-27171 | 2476725 | baseos | zlib1g |
| CVE-2026-27456 | 2476349, 2476397, 2476705, 2517401 | baseos, dnsx-img, f5-access-apmd, f5-fluentd | bsdextrautils, bsdutils, libfdisk1 |
| CVE-2026-32776 | 2506349, 2506477, 2506917, 2507041, 2507197, 2507353, 2507481, 2507585, 2507769 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | expat, libexpat1 |
| CVE-2026-32777 | 2506353, 2506481, 2506921, 2507045, 2507201, 2507357, 2507485, 2507589, 2507773 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | expat, libexpat1 |
| CVE-2026-32778 | 2506357, 2506485, 2506925, 2507049, 2507205, 2507361, 2507489, 2507593, 2507777 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | expat, libexpat1 |
| CVE-2026-33186 | 2475013, 2506097 | f5-zonerunner | google.golang.org/grpc |
| CVE-2026-33814 | 2459181, 2475025, 2506109 | f5-dssm-upgrader, f5-zonerunner | golang.org/x/net, stdlib |
| CVE-2026-33818 | 2474189, 2474233, 2474269, 2474313, 2474357, 2474389, 2474421, 2474457, 2474489, 2474521, 2474557, 2474593, 2474633, 2474737, 2474773, 2474809, 2474845, 2474909, 2474941, 2474981, 2475029, 2475089, 2475137, 2475181, 2475217, 2475257, 2475297, 2475333, 2475373, 2475405, 2475441, 2475477, 2475517, 2475569, 2475601, 2475605, 2475609, 2475613, 2475617, 2475621, 2475817, 2475849, 2475893, 2475929, 2475965, 2476001, 2476037, 2476069, 2476101, 2476137, 2476173, 2476205, 2476661, 2489353, 2505657, 2505829, 2506053, 2517205, 2517309, 2517341 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img | stdlib |
| CVE-2026-39113 | 2506361, 2506489, 2506729, 2506929, 2507053, 2507209, 2507365, 2507493, 2507597, 2507781, 2507917 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-gslb-debug-sidecar, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, rabbit, spk-csrc | libsqlite3-0 |
| CVE-2026-39821 | 2459149, 2474193, 2474237, 2474273, 2474317, 2474361, 2474393, 2474425, 2474461, 2474493, 2474525, 2474561, 2474597, 2474637, 2474741, 2474777, 2474813, 2474849, 2474913, 2474945, 2474985, 2475033, 2475093, 2475141, 2475185, 2475221, 2475261, 2475301, 2475337, 2475377, 2475409, 2475445, 2475481, 2475573, 2475625, 2475629, 2475633, 2475637, 2475641, 2475645, 2475821, 2475853, 2475897, 2475933, 2475969, 2476005, 2476041, 2476073, 2476105, 2476141, 2476177, 2476209, 2476665, 2489357, 2505661, 2505833, 2506057, 2506113, 2517209, 2517313, 2517345 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img | golang.org/x/net, stdlib |
| CVE-2026-39822 | 2459153, 2459157 | f5-blobd, f5-dssm-upgrader | stdlib |
| CVE-2026-39824 | 2474453, 2475085, 2475565, 2506157 | f5-dssm-store, f5-dssm-upgrader, f5-zonerunner | golang.org/x/sys |
| CVE-2026-4046 | 2476733 | baseos | libc-bin |
| CVE-2026-41080 | 2506365, 2506493, 2506933, 2507057, 2507213, 2507369, 2507497, 2507601, 2507785 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-42250 | 2507953 | baseos | libbz2-1.0 |
| CVE-2026-42502 | 2475077, 2475553, 2506145 | f5-dssm-upgrader, f5-zonerunner | golang.org/x/net |
| CVE-2026-42505 | 2475557, 2475889 | f5-blobd, f5-dssm-upgrader | stdlib |
| CVE-2026-42506 | 2475081, 2475561, 2506149 | f5-dssm-upgrader, f5-zonerunner | golang.org/x/net |
| CVE-2026-4360 | 2506369, 2506497, 2506737, 2506941, 2507061, 2507217, 2507373, 2507501, 2507605 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-gslb-debug-sidecar, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, spk-csrc | libpython3.12-minimal |
| CVE-2026-4437 | 2476737 | baseos | libc-bin |
| CVE-2026-4438 | 2476741 | baseos | libc-bin |
| CVE-2026-45186 | 2506373, 2506501, 2506945, 2507065, 2507221, 2507377, 2507505, 2507609, 2507789 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-46600 | 2474197, 2474241, 2474277, 2474321, 2474365, 2474397, 2474429, 2474465, 2474497, 2474529, 2474565, 2474605, 2474641, 2474749, 2474781, 2474817, 2474857, 2474917, 2474949, 2474989, 2475037, 2475097, 2475145, 2475189, 2475225, 2475265, 2475305, 2475341, 2475381, 2475413, 2475449, 2475485, 2475521, 2475577, 2475649, 2475653, 2475657, 2475661, 2475665, 2475669, 2475825, 2475857, 2475901, 2475937, 2475973, 2476009, 2476045, 2476077, 2476109, 2476145, 2476181, 2476213, 2476669, 2489361, 2505665, 2505837, 2506061, 2506117, 2517213, 2517317, 2517349 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img | golang.org/x/net, stdlib |
| CVE-2026-48959 | 2489457 | baseos | perl-base |
| CVE-2026-48962 | 2489461 | baseos | perl-base |
| CVE-2026-49478 | 2474685 | f5-lifecycle-operator-catalog | github.com/sigstore/fulcio |
| CVE-2026-50163 | 2474201 | f5-lifecycle-operator | oras.land/oras-go/v2 |
| CVE-2026-50219 | 2506377, 2506505, 2506949, 2507069, 2507225, 2507381, 2507509, 2507613, 2507793 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-53495 | 2506209 | f5-lifecycle-operator | github.com/containerd/containerd |
| CVE-2026-53612 | 2507073, 2507929, 2517405 | baseos, dnsx-img, f5-fluentd | bsdextrautils, bsdutils, libfdisk1 |
| CVE-2026-53613 | 2507077, 2507933, 2517409 | baseos, dnsx-img, f5-fluentd | bsdextrautils, bsdutils, libfdisk1 |
| CVE-2026-53614 | 2507081, 2507937, 2517413 | baseos, dnsx-img, f5-fluentd | bsdextrautils, bsdutils, libfdisk1 |
| CVE-2026-53615 | 2507085, 2507941, 2517417 | baseos, dnsx-img, f5-fluentd | bsdextrautils, bsdutils, libfdisk1 |
| CVE-2026-53910 | 2489417 | baseos | diffutils |
| CVE-2026-5435 | 2476745 | baseos | libc-bin |
| CVE-2026-54371 | 2489421 | baseos | libattr1 |
| CVE-2026-54411 | 2476709 | baseos | libpam-modules |
| CVE-2026-5450 | 2476749 | baseos | libc-bin |
| CVE-2026-54696 | 2517273 | f5-fluentd | json |
| CVE-2026-54874 | 2489433, 2517449 | baseos, f5-fluentd | libssl3t64 |
| CVE-2026-55654 | 2476637 | gslb-engine | openssh-client |
| CVE-2026-55655 | 2476621 | gslb-engine | openssh-client |
| CVE-2026-56131 | 2506381, 2506509, 2506953, 2507089, 2507513, 2507617, 2507797 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56132 | 2506385, 2506513, 2506957, 2507093, 2507517, 2507621, 2507801 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56403 | 2506389, 2506517, 2506961, 2507097, 2507237, 2507393, 2507521, 2507625, 2507805 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56404 | 2506393, 2506521, 2506965, 2507101, 2507241, 2507397, 2507525, 2507629, 2507809 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56405 | 2506397, 2506525, 2506969, 2507105, 2507245, 2507401, 2507529, 2507633, 2507813 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56406 | 2506401, 2506529, 2506973, 2507109, 2507533, 2507637, 2507817 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56407 | 2506405, 2506533, 2506977, 2507113, 2507537, 2507641, 2507821 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56408 | 2506409, 2506537, 2506981, 2507117, 2507257, 2507413, 2507541, 2507645, 2507825 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56409 | 2506417, 2506541, 2506985, 2507121, 2507545, 2507649, 2507829 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56410 | 2506421, 2506545, 2506989, 2507125, 2507549, 2507653, 2507833 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56411 | 2506425, 2506549, 2506993, 2507129, 2507553, 2507657, 2507837 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56412 | 2506429, 2506553, 2506997, 2507133, 2507273, 2507429, 2507557, 2507661, 2507841 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-56852 | 2475041, 2475149, 2475269, 2475525, 2475861, 2506121 | f5-blobd, f5-dssm-upgrader, f5-toda-observer, f5-zonerunner, f5ing-tmm-pod-manager | golang.org/x/text |
| CVE-2026-56853 | 2474205, 2474245, 2474281, 2474325, 2474369, 2474401, 2474433, 2474469, 2474501, 2474533, 2474569, 2474609, 2474645, 2474753, 2474785, 2474821, 2474861, 2474921, 2474953, 2474993, 2475045, 2475101, 2475153, 2475193, 2475229, 2475273, 2475309, 2475345, 2475385, 2475417, 2475453, 2475489, 2475529, 2475581, 2475673, 2475677, 2475681, 2475685, 2475689, 2475693, 2475829, 2475865, 2475905, 2475941, 2475977, 2476013, 2476049, 2476081, 2476113, 2476149, 2476185, 2476217, 2476673, 2489365, 2505669, 2505841, 2506065, 2517217, 2517321, 2517353 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img | stdlib |
| CVE-2026-56854 | 2505569, 2505593, 2505673, 2505753, 2505781, 2505897, 2505925, 2506017, 2506161, 2506197, 2506249, 2506261, 2506289, 2506313, 2506329, 2517221, 2517281 | cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-fluentd, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, ocnos-img, opentelemetry-collector-contrib, spk-cwc | golang.org/x/crypto |
| CVE-2026-56855 | 2505557, 2505581, 2505605, 2505729, 2505761, 2505793, 2505913, 2505937, 2505969, 2506029, 2506173, 2506213, 2506253, 2506277, 2506301, 2506321, 2506333, 2517257, 2517297 | cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-epp, f5-fluentd, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, ocnos-img, opentelemetry-collector-contrib, spk-cwc | golang.org/x/crypto |
| CVE-2026-56858 | 2474209, 2474249, 2474285, 2474329, 2474373, 2474405, 2474437, 2474473, 2474505, 2474537, 2474573, 2474613, 2474649, 2474757, 2474789, 2474825, 2474865, 2474925, 2474957, 2474997, 2475049, 2475105, 2475157, 2475197, 2475233, 2475277, 2475313, 2475349, 2475389, 2475421, 2475457, 2475493, 2475533, 2475585, 2475697, 2475701, 2475705, 2475709, 2475713, 2475717, 2475833, 2475869, 2475909, 2475945, 2475981, 2476017, 2476053, 2476085, 2476117, 2476153, 2476189, 2476221, 2476677, 2489369, 2505677, 2505845, 2506069, 2517225, 2517325, 2517357 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img | stdlib |
| CVE-2026-56859 | 2474213, 2474253, 2474289, 2474333, 2474377, 2474409, 2474441, 2474477, 2474509, 2474541, 2474577, 2474617, 2474653, 2474761, 2474793, 2474829, 2474869, 2474929, 2474961, 2475001, 2475053, 2475109, 2475161, 2475201, 2475237, 2475281, 2475317, 2475353, 2475393, 2475425, 2475461, 2475497, 2475537, 2475589, 2475721, 2475725, 2475729, 2475733, 2475737, 2475741, 2475837, 2475873, 2475913, 2475949, 2475985, 2476021, 2476057, 2476089, 2476121, 2476157, 2476193, 2476225, 2476681, 2489373, 2505681, 2505849, 2506073, 2517229, 2517329, 2517361 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img | stdlib |
| CVE-2026-56860 | 2474217, 2474257, 2474293, 2474337, 2474381, 2474413, 2474445, 2474481, 2474513, 2474545, 2474581, 2474621, 2474657, 2474765, 2474797, 2474833, 2474873, 2474933, 2474965, 2475005, 2475057, 2475113, 2475165, 2475205, 2475241, 2475285, 2475321, 2475357, 2475397, 2475429, 2475465, 2475501, 2475541, 2475593, 2475745, 2475749, 2475753, 2475757, 2475761, 2475765, 2475841, 2475877, 2475917, 2475953, 2475989, 2476025, 2476061, 2476093, 2476125, 2476161, 2476197, 2476229, 2476685, 2489377, 2505685, 2505853, 2506077, 2517233, 2517333, 2517365 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img | stdlib |
| CVE-2026-56862 | 2474221, 2474261, 2474297, 2474341, 2474385, 2474417, 2474449, 2474485, 2474517, 2474549, 2474585, 2474625, 2474661, 2474769, 2474801, 2474837, 2474877, 2474937, 2474969, 2475009, 2475061, 2475117, 2475169, 2475209, 2475245, 2475289, 2475325, 2475361, 2475401, 2475433, 2475469, 2475505, 2475545, 2475597, 2475769, 2475773, 2475777, 2475781, 2475789, 2475793, 2475845, 2475881, 2475921, 2475957, 2475993, 2476029, 2476065, 2476097, 2476129, 2476165, 2476201, 2476233, 2476689, 2489381, 2505689, 2505857, 2506081, 2517237, 2517337, 2517369 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img | stdlib |
| CVE-2026-56864 | 2475121 | opentelemetry-collector-contrib | golang.org/x/mod |
| CVE-2026-56865 | 2475125 | opentelemetry-collector-contrib | golang.org/x/mod |
| CVE-2026-5704 | 2476713 | baseos | tar |
| CVE-2026-57062 | 2507921, 2507957 | baseos, rabbit | dirmngr, gpgv |
| CVE-2026-57432 | 2489465 | baseos | perl-base |
| CVE-2026-57433 | 2489469 | baseos | perl-base |
| CVE-2026-58010 | 2507845 | ocnos-img | libglib2.0-0t64 |
| CVE-2026-58011 | 2507849 | ocnos-img | libglib2.0-0t64 |
| CVE-2026-58012 | 2507853 | ocnos-img | libglib2.0-0t64 |
| CVE-2026-58013 | 2507857 | ocnos-img | libglib2.0-0t64 |
| CVE-2026-58014 | 2507861 | ocnos-img | libglib2.0-0t64 |
| CVE-2026-58015 | 2507865 | ocnos-img | libglib2.0-0t64 |
| CVE-2026-58016 | 2507869 | ocnos-img | libglib2.0-0t64 |
| CVE-2026-5928 | 2476753 | baseos | libc-bin |
| CVE-2026-59843 | 2506805, 2507713 | f5-fluentbit, f5-gslb-debug-sidecar | libssh-4 |
| CVE-2026-59845 | 2506809, 2507717 | f5-fluentbit, f5-gslb-debug-sidecar | libssh-4 |
| CVE-2026-59846 | 2506813, 2507721 | f5-fluentbit, f5-gslb-debug-sidecar | libssh-4 |
| CVE-2026-59847 | 2506817, 2507725 | f5-fluentbit, f5-gslb-debug-sidecar | libssh-4 |
| CVE-2026-59848 | 2506821, 2507729 | f5-fluentbit, f5-gslb-debug-sidecar | libssh-4 |
| CVE-2026-59850 | 2506825, 2507733 | f5-fluentbit, f5-gslb-debug-sidecar | libssh-4 |
| CVE-2026-59890 | 2474897 | f5-bnk-cis | setuptools |
| CVE-2026-6238 | 2476757 | baseos | libc-bin |
| CVE-2026-63072 | 2489425, 2517421 | baseos, f5-fluentd | libssl3t64 |
| CVE-2026-63074 | 2489437, 2517453 | baseos, f5-fluentd | libssl3t64 |
| CVE-2026-63076 | 2489429, 2517425 | baseos, f5-fluentd | libssl3t64 |
| CVE-2026-6368 | 2506617, 2507137, 2507277, 2507433, 2507985, 2517429 | baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec | libc-bin |
| CVE-2026-6390 | 2476289, 2476597, 2506829 | f5-debug-sidecar, f5-gslb-debug-sidecar | nano |
| CVE-2026-6464 | 2476549 | f5-fluentbit | libpq5 |
| CVE-2026-6469 | 2476553 | f5-fluentbit | libpq5 |
| CVE-2026-6470 | 2476557 | f5-fluentbit | libpq5 |
| CVE-2026-6471 | 2476561 | f5-fluentbit | libpq5 |
| CVE-2026-66046 | 2506433, 2506557, 2507001, 2507141, 2507561, 2507665, 2507873 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-66484 | 2476569 | tmm-img | cpio |
| CVE-2026-66485 | 2476573 | tmm-img | cpio |
| CVE-2026-66486 | 2476577 | tmm-img | cpio |
| CVE-2026-6791 | 2506621, 2507145, 2507285, 2507441, 2507989, 2517433 | baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec | libc-bin |
| CVE-2026-7017 | 2489473 | baseos | perl-base |
| CVE-2026-72522 | 2506437, 2506561, 2507005, 2507149, 2507565, 2507669, 2507877 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-73071 | 2476293, 2506841 | f5-gslb-debug-sidecar | vim |
| CVE-2026-73072 | 2476297, 2506845 | f5-gslb-debug-sidecar | vim |
| CVE-2026-73073 | 2489389, 2506849 | f5-gslb-debug-sidecar | vim |
| CVE-2026-73074 | 2476301, 2506853 | f5-gslb-debug-sidecar | vim |
| CVE-2026-73076 | 2476305, 2506857 | f5-gslb-debug-sidecar | vim |
| CVE-2026-73077 | 2476309, 2506861 | f5-gslb-debug-sidecar | vim |
| CVE-2026-73078 | 2476313, 2506865 | f5-gslb-debug-sidecar | vim |
| CVE-2026-75803 | 2489441, 2517457 | baseos, f5-fluentd | libssl3t64 |
| CVE-2026-76641 | 2506441, 2506565, 2507009, 2507153, 2507569, 2507673, 2507881 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-76957 | 2506445, 2506569, 2507013, 2507157, 2507573, 2507677, 2507885 | dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc | libexpat1 |
| CVE-2026-77117 | 2506625, 2507161, 2507301, 2507457, 2507993, 2517437 | baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec | libc-bin |
| CVE-2026-78662 | 2505561, 2505585, 2505609, 2505733, 2505765, 2505797, 2505917, 2505941, 2505973, 2506033, 2506177, 2506217, 2506257, 2506281, 2506305, 2506325, 2506337, 2517261, 2517301 | cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-epp, f5-fluentd, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, ocnos-img, opentelemetry-collector-contrib, spk-cwc | golang.org/x/crypto |
| CVE-2026-79921 | 2505693, 2505757, 2505901, 2506265, 2506317, 2517285 | crd-conversion, f5-debug-sidecar, f5-downloader, f5-license-helper, opentelemetry-collector-contrib, spk-cwc | github.com/rabbitmq/amqp091-go |
| CVE-2026-80212 | 2517241 | f5-fluentd | resolv |
| CVE-2026-80213 | 2517265 | f5-fluentd | resolv |
| CVE-2026-80230 | 2506461, 2506585, 2506629, 2507889, 2507909 | crd-installer, f5-debug-sidecar, f5-ipsec, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-80489 | 2506633, 2507165, 2507305, 2507465, 2507997, 2517441 | baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec | libc-bin |
| CVE-2026-82209 | 2506465, 2506589, 2506637, 2507893, 2507913 | crd-installer, f5-debug-sidecar, f5-ipsec, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-84303 | 2505533, 2505545, 2505565, 2505589, 2505613, 2505653, 2505737, 2505741, 2505745, 2505749, 2505777, 2505801, 2505813, 2505825, 2505869, 2505881, 2505893, 2505921, 2505945, 2505957, 2505977, 2505989, 2506001, 2506013, 2506037, 2506049, 2506093, 2506153, 2506181, 2506193, 2506221, 2506233, 2506245, 2506285, 2506309, 2517269, 2517305 | cert-manager-controller, cert-manager-webhook, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-lifecycle-operator, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, ocnos-img, opentelemetry-collector-contrib, spk-csrc, spk-cwc | google.golang.org/grpc |
| CVE-2026-84304 | 2505525, 2505537, 2505549, 2505573, 2505597, 2505645, 2505697, 2505701, 2505705, 2505709, 2505769, 2505785, 2505805, 2505817, 2505861, 2505873, 2505885, 2505905, 2505929, 2505949, 2505961, 2505981, 2505993, 2506005, 2506021, 2506041, 2506085, 2506125, 2506165, 2506185, 2506201, 2506225, 2506237, 2506269, 2506293, 2517245, 2517289 | cert-manager-controller, cert-manager-webhook, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-lifecycle-operator, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, ocnos-img, opentelemetry-collector-contrib, spk-csrc, spk-cwc | google.golang.org/grpc |
| CVE-2026-84445 | 2505529, 2505541, 2505553, 2505577, 2505601, 2505649, 2505713, 2505717, 2505721, 2505725, 2505773, 2505789, 2505809, 2505821, 2505865, 2505877, 2505889, 2505909, 2505933, 2505953, 2505965, 2505985, 2505997, 2506009, 2506025, 2506045, 2506089, 2506129, 2506169, 2506189, 2506205, 2506229, 2506241, 2506273, 2506297, 2517249, 2517293 | cert-manager-controller, cert-manager-webhook, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-lifecycle-operator, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, ocnos-img, opentelemetry-collector-contrib, spk-csrc, spk-cwc | google.golang.org/grpc |
| CVE-2026-85091 | 2517465 | f5-bnk-cis | zlib1g |
| CVE-2026-8932 | 2489393, 2489397, 2489401, 2506905 | f5-access-apmd, f5-fluentbit, f5-gslb-debug-sidecar | curl, libcurl4t64 |
| CVE-2026-9538 | 2489477 | baseos | perl-base |
| CVE-2026-14662 | 2476465 | f5-fluentbit | libpq5 |
| CVE-2026-94127 | 2532613 |
New features¶
(No new features)
Limited availability and early access¶
Note
Early Access feature documentation is available on request. Contact your F5 account team if you want to learn more about Early Access features.
Added Early Access support for Session Initiation Protocol (SIP) DDoS protection vectors. These vectors detect and mitigate SIP attacks, such as malformed packets and method floods, in VoIP and other multimedia traffic. BNK identifies SIP traffic by inspecting UDP payloads for the SIP method signatures defined in RFC 3261.
To use SIP DDoS protection, configure a SIP profile with the SIP firewall turned on, then attach the profile to the secure context. BNK does not evaluate any SIP DDoS vector until you attach the profile.
Configure the vectors in the DDoS Global custom resource, the DDoS Virtual custom resource, or both. The following vectors are available:
Vector
Attack type
Scope
Malformed SIP packet
Error
Global
INVITE method flood
Flood
Global and virtual
ACK method flood
Flood
Global and virtual
OPTIONS method flood
Flood
Global and virtual
BYE method flood
Flood
Global and virtual
CANCEL method flood
Flood
Global and virtual
REGISTER method flood
Flood
Global and virtual
PUBLISH method flood
Flood
Global and virtual
NOTIFY method flood
Flood
Global and virtual
SUBSCRIBE method flood
Flood
Global and virtual
MESSAGE method flood
Flood
Global and virtual
PRACK method flood
Flood
Global and virtual
Other method flood
Flood
Global and virtual
URI length limit
Flood
Global and virtual
Each flood vector supports per-source-IP and per-destination-IP detection and rate limiting.
Early Access (EA) support for Route Health Injection (RHI) has been added for LTM CNF. RHI controls whether a virtual server’s VIP route is advertised or withdrawn through BGP based on the health of its pool members.
RHI policies can be configured on an F5VirtualServer or an F5SecureContext. The following policies are supported:
Always — The route is always advertised, regardless of pool-member health.
Any — The route is advertised when at least one pool member is healthy. It is withdrawn when no pool members are healthy.
Capacity — The route is advertised when the percentage of healthy pool members is greater than or equal to the configured threshold. The threshold must be between 1 and 100 percent.
All — The route is advertised only when all pool members are healthy. It is withdrawn when any pool member becomes unhealthy.
For Any, Capacity, and All, a pool with no eligible members does not satisfy the policy, so its route is not advertised.
Set routeAdvertisement to true and specify the desired policy in routeAdvertisementPolicy. For example, to always advertise the route:
spec: routeAdvertisement: true routeAdvertisementPolicy: mode: "Always"
To advertise the route when at least 10 percent of eligible pool members are healthy:
spec: routeAdvertisement: true routeAdvertisementPolicy: mode: "Capacity" thresholdPercent: 10
thresholdPercentis used only with Capacity and must be between 1 and 100.When an RHI policy is omitted, the existing routeAdvertisement setting is used. This setting defaults to true, so the route is advertised by default. When routeAdvertisement is set to false, the route is not advertised, and an RHI policy must not be configured. In 2.4.1, the same RHI configuration is applied to all TMMs. Per-TMM configuration is not supported. RHI is supported for statically configured pool members; dynamically discovered pool members are not included.
For Helm installations, RHI must be enabled:
controller: rhi: enabled: true
For FLO installations, no additional setting is required. RHI is enabled automatically when FLO identifies the product type as CNF.
Helm-chart and custom-resource schema changes¶
(No schema changes)
Fixed issues¶
> Click to view a list of fixed issues:
2549993-3¶
bdt_cli connection list does not filter by IP address
Component: dsc-bdt_cli
Symptoms: When bdt_cli connection list is run with –cs_client_addr, –cs_server_addr, –ss_server_addr, or –ss_client_addr, the command returns the full connection table instead of only matching flows.
Conditions: SPK/CNF/BNK deployments that use bdt_cli to match specific flow(s) by specifying address(es) for –cs_client_addr, –cs_server_addr, –ss_server_addr, or –ss_client_addr
Impact: The specified address does not take effect, and no flow filtering occurs. Instead, all flows are returned.
Fix Text: bdt_cli now respects the address parameters for –cs_client_addr, –cs_server_addr, –ss_server_addr, or –ss_client_addr and returns desired matching flows.
2503041¶
Configview output display improper format for some config fields
Component: dsc-cfgview
Symptoms: When executing configview show all in the TMM debug container, the key_cert_pairs fields in declTmm.profile_clientssl and declTmm.profile_serverssl and the port_list field in declTmm.self_ip show Go runtime memory addresses (e.g., &{{} [] [] 0xc000182770}) instead of the expected certificate names, key names, or port numbers. All other fields in these objects show correctly.
Conditions:
This issue affects any BIG-IP Next CNF, SPK, or BNK deployment that uses the debug sidecar container.
The issue affects all versions from CNF 1.4.0 onward.
Running configview show all or querying declTmm.profile_clientssl, declTmm.profile_serverssl, or declTmm.self_ip triggers the issue whenever those objects have key_cert_pairs or port_list entries configured.
Impact:
You cannot use configview to verify that TMM applied TLS certificate/key pairs and self-IP port-list configuration correctly.
This issue creates only a diagnostic observability gap; it does not impact traffic, cause configuration-application failures, or expose security risks.
TMM applies the configuration correctly; only the display fails to render correctly.
Fix Text: Fixed formatting of some config fields in the configview output.
2513953-1¶
Configview shows empty output for some f5-tmm configuration object types starting in CNF 2.3.0.
Component: dsc-cfgview
Symptoms: Previously some config objects in the configview output, were shown in raw, hard to read form. In BNK and CNF 2.3.0 version, the started displaying as empty, incorrectly implying that the configuration is missing, when it is actually present and active on the device.
Conditions: When objects that carry a blob of bytes in its protobuf objects like datagroup or security_inspection_profile are configured on a BNK cluster.
Impact: This is a display-only defect in the troubleshooting tool. It does not affect traffic handling or the actual running configuration. Affected object types print with no content at all, giving the false impression that the configuration is missing, when it is actually present and active on the device.
Fix Text: Fixed printing of Protobuf.Any type config that a carry blob of bytes in one of its fields.
2493309-4¶
Redis sentinel failover and DB restart duplicate some entries
Component: dssm
Symptoms: Duplicate entries with empty values present in the same aux list.
Conditions: After a Redis Sentinel failover, DNS46 sub-record entries can reference the same key multiple times in the aux-list—and transiently leave it with an empty value, because add_script unconditionally appends to KEYS[2] on every retry. If replication splits the paired SET/RPUSH between the old and new primary keys, the next entry resets the value and appends the key again, which grows the aux-list without bound across failovers.
Impact: Duplicate entries with empty values present in the same aux list.
Fix Text: We make the aux-list append idempotent by calling LREM KEYS[2] 0 KEYS[1] immediately before LINSERT (eviction path) and RPUSH (non-eviction path) in add_script’s sub-record branch. Because the Lua script runs atomically on the primary key, the LREM+append sequence ensures the key appears exactly once in the list and self-heals any residual duplicates from prior failovers.
2432005-1¶
Deploying TMM with resources that span multiple NUMA Nodes
Component: fsm
Symptoms: TMM does not come up successfully when its assigned VFs and CPUs are on different NUMA nodes. However, TMM comes up if hugepages don’t have local NUMA affinity.
Conditions: VFs and CPUs used by TMM are on one NUMA node while the hugepages are on a different NUMA node.
Impact: Seeing as there were only checks for the global pages, those could contain hugepages that are located on the opposite node to the VFs and CPUS. Thus, causing a potential hit on performance. This does not result in any functional issues.
Workaround: Manually ensure that the assigned hugepages to TMM are from the local NUMA node.
Fix Text: Introduction of the environment variable TMM_ENFORCE_SINGLE_NUMA_NODE
By default this is false and allows VFs, CPUs, and hugepages to reside on separate NUMA nodes. When set to True, TMM startup process will enforce that VFs, CPUs, and Hugepages all reside on the same NUMA node.
2501773-2¶
NAT46/DNS64 translation entries expire during active use, causing intermittent connection failures
Component: ingress
Symptoms: When you enable DNS64/NAT46 on a virtual server, clients intermittently fail to connect to synthesized IPv4 addresses with a TCP reset (“No route to host”), even while they continuously resolve the domain and actively use the connection. These failures recur in multi-second windows tied to the configured DNS64/NAT46 TTL; outside these windows, connections succeed normally. During the failure window, DNS responses still show the mapping as valid with a non-zero remaining TTL, even as new connections to the translated address reset.
Conditions:
DNS64/NAT46 is enabled on the virtual server (dnsNat46Enabled: true).
A client resolves an AAAA-only hostname through the NAT46 resolver and receives a synthesized A record.
The client keeps using that synthesized address continuously (repeated DNS lookups and/or ongoing data connections) for longer than the configured maxDNS46TTL.
Impact: Client applications that maintain long-lived or frequent connections to a DNS64/NAT46-synthesized address periodically encounter intermittent “No route to host” failures, even while continuously using the mapping.
Fix Text: Perform a “touch” on DNS queries to update the DSSM entry timestamp and refresh the NAT46 record. This synchronizes expiration so the DNS entry and NAT record expire together, preventing the DNS entry from outliving the NAT record.
2483173-3¶
f5ingress debug endpoint conflicts with f5-tmm-pod-manager metrics server on port 8080
Component: ingress
Symptoms: Enabling f5ingressDebug alongside the f5-tmm-pod-manager sidecar in the same f5ingress pod prevents the f5-tmm-pod-manager container from starting its metrics server. It logs “error”=”failed to start metrics server: failed to create listener: listen tcp :8080: bind: address already in use,” and the f5ingress pod remains in CrashLoopBackOff.
Conditions: In the f5ingress Helm chart values.yaml
controller.f5ingressDebug is set to true
controller.debug.port is left at its default value of 8080
controller.tmm_pod_manager.enabled is true
Both containers run in the same pod and therefore share a network namespace; the f5-tmm-pod-manager sidecar’s metrics server bind address is not currently exposed as a configurable Helm value and defaults to 8080.
Impact: The f5ingress pod enters CrashLoopBackOff because f5-tmm-pod-manager repeatedly fails to start due to the port conflict.
Workaround: Change controller.debug.port to a non-conflicting value (e.g., 6060) in your Helm values, or disable controller.f5ingressDebug if pprof-based debugging is not required.
Fix Text: The unnecessary tmm-pod-manager metrics server has been disabled to fix this issue.
2560921-3¶
F5ingress Helm install fails with release names over 36 characters
Component: toda_spk
Symptoms: If you use a release name longer than 36 characters (e.g., spk-automation-spk-operator-app-destination), the chart generates volume names that exceed Kubernetes’ 63-character limit, causing the installation to fail.
Conditions: Install the ingress chart with a release name longer than 36 characters (e.g., spk-automation-spk-operator-app-destination).
Impact: When you use a release name longer than 36 characters, the f5ingress Helm chart generates a volume name that exceeds Kubernetes’ 63-character limit, causing the installation to fail. Helm reports: “spec.template.spec.volumes[44].name: Invalid value: “spk-automation-spk-operator-app-destination-f5-tmm-fluentbit-config”: must be no more than 63 characters.” The observer ConfigMap encounters the same issue.
Workaround: Shorten the ingress Helm chart release name to ensure the generated volume names (-fluentbit-config, -observer-config, -logs-config) stay within the 63-character Kubernetes limit.
Fix Text: Build a config map/object name that fits within Kubernetes’ 63-character limit without collisions: truncate only the base (tmm.name), always preserve the descriptive suffix, and append a short deterministic hash of the full name for uniqueness when truncation is required.
Known issues¶
> Click to view a list of known issues:
2290393-3¶
Ingress FW rules fail for hairpin traffic across zones
Component: AFM
Symptoms: Ingress firewall rules fail for hairpin traffic when the app pod and TMM pod are in different zones.
Conditions: Applies only to hairpinned traffic.
Impact: In the IBM setup, when app pod A in Zone 1 sends traffic to TMM B in Zone 2, the local TMM A SNATs the packet’s source IP. This IP change prevents the ingress firewall rule on the remote TMM B from matching and filtering the packet.
Workaround: Apply the same firewall rule on TMM A egress instead of on TMM B ingress.
2484001-2¶
cert-manager fails to auto-recover and create a certificate after you fix ClusterIssuer and delete the TLS secret
Component: Cert-Mgr
Symptoms: After you correct an invalid ClusterIssuer and delete the TLS secret, cert-manager does not immediately create a new certificate and does not generate a new Order, which appears to prevent auto-recovery.
Conditions: An invalid ACME directory URL causes the certificate authority (CA) to reject the order and places cert-manager into exponential backoff (1–32 hours). The operator fixes the issuer, deletes the TLS secret and stale resources, and checks during the active backoff window.
Impact: This issue causes no permanent impact — cert-manager issues the certificate automatically once the backoff period elapses. If you delete the TLS secret during the backoff period, you may experience a temporary gap in certificate availability.
Workaround: cert-manager does not retry until the in-memory backoff period elapses, even after you fix the issuer and delete the TLS secret and stale CertificateRequest, Order, and Challenge resources. Once the backoff period elapses, cert-manager automatically recreates the CertificateRequest → Order → Challenge chain and issues the certificate.
To force immediate re-issuance (optional), use one of the following methods:
Run
cmctl renew(if cmctl is installed):cmctl renew <cert-name> -n <namespace>
Patch the Certificate status to set
Issuing=Truewith reasonRenewalRequested:kubectl patch certificate <cert-name> -n <namespace> \ --subresource=status \ --type='merge' \ -p '{ "status": { "conditions": [ { "type": "Issuing", "status": "True", "reason": "RenewalRequested", "message": "Manually triggered issuance of Certificate", "lastTransitionTime": "'$(date -u +'%Y-%m-%dT%H:%M:%SZ')'" } ] } }'
Rollout-restart the cert-manager pods to clear the in-memory backoff timers.
Delete and recreate the issuer and certificate with a valid configuration.
2457281-3¶
DNS behavior change: Aggressively scrubbing authoritative and additional sections to prevent cache poisoning
Component: dns-cache
Symptoms: After you upgrade the unbound version to 1.25.1 in this release, network diagnostics such as dig or nslookup on downstream clients may show that the AUTHORITY and ADDITIONAL sections of certain DNS responses are empty or significantly reduced compared to previous software versions.
Conditions: This behavior activates automatically when the upstream DNS server runs Unbound version 1.24.1 or later.
Impact:
Security impact: Greatly improved. The network now fully protects against a major security vulnerability (CVE-2025-11411). The underlying Unbound engine prevents attackers from hijacking your internet traffic through malicious data injection.
Operational impact: None for normal web browsing, application connectivity, or email traffic. This change does not affect legitimate DNS queries. The only noticeable difference is that the resolver strips extraneous diagnostic data before it reaches your local network devices.
2436037-2¶
The TMM configview API does not display certain GSLB custom resources
Component: dns-gslb engine
Symptoms: The TMM configview API does not display GSLB custom resources (F5BigGslbSyncAgent, F5BigGslbLocalInstance, F5BigGslbInstance, and F5BigGslbProberPool) and returns the error: “Object not found or not supported” The configview API displays other GSLB objects such as Server, Pool, and Wideip as expected.
Conditions: When querying TMM configview for GSLB configuration, the F5BigGslbSyncAgent, F5BigGslbLocalInstance, F5BigGslbInstance, and F5BigGslbProberPool custom resources are not displayed. Returns “Object not found or not supported” error. But, other GSLB objects such as gslb_server, gslb_vs, and gslb_tmm_wideip are visible in configview as expected.
Impact: No functional impact. GSLB configuration is correctly applied and operational. The CR status shows “CR config sent to all grpc endpoints.” The only impact is that these four CR types cannot be inspected via the TMM configview API and must be inspected using alternative methods (kubectl describe, tmctl stats).
Workaround: Use kubectl describe to inspect these CRs and verify their delivery status. For runtime state, use tmctl stats on the gslb-engine pod:
F5BigGslbLocalInstance: kubectl describe f5-big-gslb-local-instances.k8s.f5.com
F5BigGslbInstance: kubectl describe f5-big-gslb-instances.k8s.f5.com
F5BigGslbProberPool: kubectl describe f5-big-gslb-prober-pools.k8s.f5.com
F5BigGslbSyncAgent: kubectl describe f5-big-gslb-sync-agents.k8s.f5.com
2471977-2¶
Deleting applied GSLB Instance custom resources required when upgrading the F5 CNF CRD bundle from BNK 2.2.4/2.2.3 to 2.4.0
Component: dns-gslb general
Symptoms: When you upgrade the F5 CNF CRD bundle (f5-cnf-crds Helm chart) from BIG-IP Next for Kubernetes 2.2.4 (or earlier 2.2/2.3 releases) to 2.4.0, the upgrade fails with the following error:
helm upgrade f5-cnf-crds f5-cnf-crds-<version>.tgz -n default
Error: UPGRADE FAILED: cannot patch "f5-big-gslb-instances.k8s.f5.com"
with kind CustomResourceDefinition: CustomResourceDefinition.apiextensions.k8s.io
"f5-big-gslb-instances.k8s.f5.com" is invalid: status.storedVersions[0]:
Invalid value: "v1alpha1": must appear in spec.versions
Conditions: Occurs when:
You previously provisioned the cluster with the F5 CNF CRD bundle from a 2.2.x/2.3.x release, where the GslbInstance CRD exposed only the
v1alpha1API version.The 2.4.0 CRD bundle removes
v1alpha1from the GslbInstance CRD and exposes onlyv1, because GSLB moves from Early Access to Generally Available (GA) in 2.4.0 and the CRD schema standardizes onv1.The existing CRD’s
status.storedVersionsstill referencesv1alpha1, which Kubernetes requires to remain inspec.versionsbefore you can remove it.This occurs even if you have not created any GslbInstance custom resources on the cluster, because Kubernetes sets
status.storedVersionswhen it establishes the CRD and does not clear it automatically.
Impact: The f5-cnf-crds Helm chart upgrade fails and blocks the overall platform upgrade from 2.2.4/2.3.x to 2.4.0.
Workaround: Before you upgrade the CRD bundle to 2.4.0:
Back up and delete any existing GslbInstance (
v1alpha1) custom resources from the cluster.Delete the existing CRD:
kubectl delete crd f5-big-gslb-instances.k8s.f5.com
Run the Helm upgrade of the CRD bundle (
f5-cnf-crds) to 2.4.0.Re-create any required
GslbInstanceresources using thev1API version after the upgrade completes.
2285413-6¶
GSLB inter-instance traffic on non-Sync Agent member is routed through the Kubernetes pod network instead of the TMM internal VLAN
Component: dns-gslb sync group
Symptoms: On the non-Sync Agent member of a GSLB Sync Group deployed on OpenShift, incoming GSLB traffic from the Sync Agent is received by TMM but is forwarded to the GSLB Engine via the Kubernetes pod network interface (eth0) instead of the TMM internal VLAN (shim interface). This causes GSLB inter-engine communication to use an incorrect network path, with ingress traffic not following the same data plane path as egress traffic.
Conditions: A GSLB Sync Group with two or more CNF deployments is configured on OpenShift. The non-Sync Agent member receives GSLB traffic from the Sync Agent. The f5ingress controller does not add the required static route on TMM to direct GSLB traffic through the internal VLAN interface.
Impact: GSLB traffic between Sync Group members on the non-Sync Agent side flows through the Kubernetes pod network instead of the TMM data plane. This results in asymmetric routing where egress GSLB traffic uses the correct internal VLAN path but ingress GSLB traffic bypasses it. This may cause GSLB health monitoring (e.g., HTTPS monitors) and probe traffic to fail or behave unexpectedly.
Workaround: There is no known workaround at this time.
2046925-4¶
TCP throughput degradation during UDP DDoS attack with DPU hardware acceleration
Component: DoS
Symptoms: Lower TCP throughput degradation could be observed during ongoing UDP DDoS attack on DPU platforms even when Global DDoS mitigation is configured.
Conditions: Occurs when,
Global DDoS config has TCP and UDP vectors configured.
DDoS hardware DPU acceleration is enabled.
TCP and UDP traffic is being processed simultaneously.
Impact: Up to 30% degradation in throughput.
2339825-3¶
GSLB Sync Group members on OpenShift clusters can lose connectivity to the Kubernetes API, preventing configuration synchronization.
Component: dns-gslb sync group
Symptoms: One GSLB Sync Group member cannot synchronize its GSLB configuration (wide IPs, pools, servers) with the rest of the group. Its logs repeatedly report errors while creating or updating GSLB custom resources, and its GSLB server objects remain in a NotReady state.
Conditions: This occurs when a GSLB Sync Group member is deployed on an OpenShift cluster using the OVN-Kubernetes network plugin (CNI). Sync group members deployed on non-OpenShift Kubernetes clusters are not affected.
Impact: The affected sync group member cannot create or update its own GSLB configuration objects and cannot exchange configuration with other members. The rest of the sync group considers this member as permanently out of sync. Until the issue is resolved, the affected member delivers degraded or unavailable GSLB service.
Workaround: At install time, configure the CSRC component’s Helm values (config.excludeCidr) with the affected cluster’s pod, service, and node CIDR ranges to restore normal Kubernetes API connectivity for that cluster’s GSLB pods.
2330917-2¶
Egress catchall virtual servers may not restore after you delete and recreate a dependent VRF
Component: egress
Symptoms: When an Egress custom resource depends on a flow-forward VLAN in a VRF and you delete and recreate that VRF, the Egress resource may transition back to Ready=True without fully recreating all Egress-related configuration.
Specifically, the system may restore only the primary IPv4 and IPv6 Egress virtual servers while failing to recreate the catchall IPv4 and IPv6 virtual servers.
Conditions: This issue occurs when all four of the following conditions are met:
You configure an Egress custom resource with a flow-forward VLAN in a specific VRF (for example, VRF A).
You enable the flow-forwarding feature on that Egress custom resource.
You delete VRF A and then recreate it.
The Egress custom resource recovers to
Ready=Trueafter the VRF is restored.
Impact: The Egress custom resource may report a healthy (Ready=True) status while TMM does not program its catchall virtual servers.
This creates a mismatch between the custom resource status and the actual dataplane configuration, which can affect inter-TMM flow-forwarding traffic.
Workaround: After recreating the dependent VRF, reapply the affected Egress CR(s). Reapplying the Egress CR forces reconciliation and restores the missing catchall virtual servers.
2330929-12¶
ACL hardware stat intermittently out of sync
Component: Firewall (ACL)
Symptoms: The hw_counter field in the fw_rule_stat tmctl table may intermittently fail to increment.
Conditions: This occurs intermittently for gateway attached firewall policies.
Impact: ACL hw_counter stat may report values lower than actual traffic counts.
Workaround: Remove and reapply the configurations to reset the stats.
2503177-2¶
CNF NAT44 connection per second performance degrades with small packet size
Component: fsm
Symptoms: Connection per second performance degradation is seen with small packet size such 128 bytes.
Conditions: Connection is initiated with small packet.
Impact: With large amount of small packet connection, the connection per second performance degrades.
2389241-6¶
Failed dynamic route restoration after overlapping static route removal
Component: fsm-dynamic-routing
Symptoms: When you delete a static route that exactly overlaps a dynamic route, BNK may not restore the dynamic route it replaced.
Conditions: Occurs when you configure a static route with the same destination and prefix as an existing dynamic route. For example, for existing dynamic route 192.0.2.0/24 (an example network), BNK also creates a static route for 192.0.2.0/24. You then delete the static route.
Impact: Traffic that matches the dynamic route may not route as expected until BNK reconciles the routing information.
Workaround: To avoid this issue, do not create static routes that exactly overlap dynamic routes. To recover the dynamic route, clear the BGP session that the dynamic route was learned from. For example, if the route was learned from neighbor 198.51.100.1 (an example address), run the following command in the ZebOS or OcNOS shell:
clear bgp 198.51.100.1
2332481-2¶
VXLan reinstall may require retry when recreating during a pending delete
Component: fsm-dynamic-routing
Symptoms: When you delete a VXLan and quickly follow with a create, the system may reject the create because the delete is still pending. If you retry the create a few seconds later, it succeeds. This can cause a silent failure in automation that does not handle error checking, which can lead to unexpected BGP running configuration for objects that use that VXLan.
Conditions: When you delete and reapply VXLAN custom resources, TMM pods end up in an inconsistent configuration state. Each TMM has different VRF configurations, VNI/VXLAN interfaces have incorrect or missing VRF assignments, and BGP VRF address families are missing.
Impact: All tenant traffic (EVPN/VXLAN) breaks after you reinstall the VXLAN custom resource. Affected pods lose VRF isolation. BGP does not advertise or receive VRF routes. The cluster does not self-heal.
Workaround: In automation, use kubectl delete with –wait=true and check error handling. If manual, wait to retry.
2547629-3¶
During upgrade traffic drops if BGP routing is used
Component: fsm-dynamic-routing
Symptoms: Ingress and egress traffic are dropped while TMM pods are replaced during an upgrade. Routes to the pods being replaced can remain advertised until the upgrade completes.
Conditions:
BGP is used to route traffic to the TMM pods.
An upgrade replaces the TMM pods.
Impact: Connections fail or time out until the upgrade completes.
Workaround: Configure BGP so that a replacement TMM pod advertises its routes without delay, and upstream routers stop using a removed TMM pod quickly. Apply both steps. Step 1 shortens the interruption when a replacement pod starts, and step 2 shortens the interruption when a pod is removed; each step alone leaves the other interruption in place.
On the TMM, add the following for each upstream neighbor:
neighbor <upstream-IP> advertisement-interval 0neighbor <upstream-IP> as-origination-interval 1Configure how upstream routers detect a removed TMM pod, using one of the following methods:
BFD (recommended): On the TMM, add
neighbor <upstream-IP> fall-over bfdfor each upstream neighbor. On each upstream router, enable BFD for the BGP session to each TMM pod. Upstream routers then stop using a removed pod in less than a second.BGP timers: On the TMM, add
neighbor <upstream-IP> timers 10 30for each upstream neighbor. Upstream routers then stop using a removed pod within 30 seconds. Shorter timers, such astimers 3 9, reduce the interruption further but can cause BGP sessions to flap when keepalives are delayed, for example when a TMM pod is under heavy load. Confirm that your upstream routers accept the configured hold time.
Traffic can still be interrupted for a few seconds each time a TMM pod is replaced, until the replacement pod establishes its BGP sessions.
1889425-6¶
Egress traffic fails during an f5-tmm pod restart event
Component: fsm-networking
Symptoms: Egress traffic fails while one or more f5-tmm pods are restarting.
Conditions: Occurs when,
SPK is installed and configured to handle egress traffic from watched namespaces.
One or more f5-tmm pods crash or are restarted by Kubernetes.
Impact: Egress traffic might fail from traffic routing to an f5-tmm pod that is restarting.
2471117-2¶
Partial and temporary ingress traffic loss during node reboot
Component: ingress
Symptoms: Healthy TMM pods drop traffic destined for an application pod on a rebooted node until the controller notifies them that the application pod is down. If the controller’s own node reboots, the disruption window is longer because the controller must recover first before it can notify TMM pods about the affected application pod.
Conditions: You reboot a Kubernetes node that hosts one or more application pods. However, healthy TMM pods continue to route traffic to the now-unavailable application pod because the controller has not yet detected and communicated the pod’s failure.
Impact: Healthy TMM pods drop traffic to the affected application pod from the moment the node reboots until the controller detects the pod failure and sends an exception to TMM, which triggers the removal of the unavailable pool member.
If the controller’s node reboots, the outage duration increases because the controller must fully restart before it can reconcile the application pod’s state and update TMM.
Traffic restores automatically when the affected pod becomes available again. The controller detects the pod’s recovery, updates TMM with the revised pool member configuration, and load balancing to the pod resumes.
Workaround: To minimize traffic disruption caused by TMM forwarding requests to unavailable application pods, configure health monitors on the Pool custom resource that your HTTPRoute backendRefs reference.
When you enable health monitors (such as HTTP, TCP, or ICMP) on a Pool, TMM actively probes pool members and can independently mark an application pod as down without waiting for the controller to detect and relay the pod failure. This significantly reduces the time that TMM routes traffic to an unavailable pod.
Select the appropriate monitor type and configure the relevant parameters (including interval, timeout, and send/receive strings) based on your application protocol to ensure prompt failure detection.
2455985-2¶
Renaming of metric scraping CRDs
Component: ingress
Symptoms: As part of complying with F5 Standardization, the following CRDs are renamed from the metrics.f5.net domain to the metrics.f5.com domain:
scrapetemplates.metrics.f5.net → scrapetemplates.metrics.f5.com
scrapeclasses.metrics.f5.net → scrapeclasses.metrics.f5.com
scrapes.metrics.f5.net → scrapes.metrics.f5.com
Conditions: As part of a helm limitation, the helm upgrade does not recreate the renamed CRDs by default.
Impact: f5ingress upgrade fails.
Workaround: This manual procedure is only needed for upgrades to 2.4, per the name change.
Apply new CRDs directly from the Observer chart
helm show crds .../f5-toda-observer-< UPGRADE VERSION>.tgz | kubectl apply -f -Remove stale old-group objects
kubectl delete scrapetemplate.metrics.f5.net --all --all-namespaces || truekubectl delete scrapeclass.metrics.f5.net --all || trueUpgrade observer
helm upgrade observer .../f5-toda-observer-<VERSION>.tgz ...Upgrade ingress
helm upgrade f5ingress ... /<UPGRADE-F5INGRESS-VERSION>.tgzRemove the old CRD definitions (optional)
kubectl delete crd scrapetemplates.metrics.f5.netkubectl delete crd scrapeclasses.metrics.f5.netkubectl delete crd scrapes.metrics.f5.net
2503545-2¶
Toggling SelfIP count in one VLAN may result in missing config for other VLANs
Component: ingress
Symptoms: Missing VLAN config on some TMMs.
Conditions: Reducing the number of SelfIPs on a VLAN, then increasing it back to the original count. For example: two SelfIPs -> one SelfIP -> two SelfIPs
Impact: VLAN config from unmodified VLANs may be missing from some TMMs.
Workaround: Delete and re-apply the VLAN CRs that have missing config.
2331381-2¶
Custom resource status may remain stuck at False after a TMM pod restart or crash
Component: ingress
Symptoms: After a TMM pod restart or crash, one or more SPK custom resource statuses may remain stuck at False with the message “Waiting for one or more dependent CRs to be applied,” even though TMM successfully applied the configurations.
Conditions: A TMM pod crashes or restarts in an SPK deployment that has configured dependent custom resources.
Impact: No traffic impact. The custom resource status incorrectly reports False with “Waiting for one or more dependent CRs to be applied” even though TMM successfully applied the configuration.
Workaround: Delete and reapply the affected stuck custom resources to trigger reconciliation and restore the correct status.
2459457-2¶
BNK fails to route egress traffic when deployed with OcNOS, VXLAN, and VRF on an OpenShift cluster
Component: ingress
Symptoms: BNK fails to route egress traffic when deployed with OcNOS, VXLAN, and VRF on an OpenShift cluster. The OVN network does not populate the required routes for the specified app pod.
Conditions: This occurs when BNK is deployed with OcNOS, VRF, and VXLAN enabled on an OpenShift cluster.
Impact: Egress traffic failed when BNK deployed with OcNOS, VXLAN, and VRF on an OpenShift cluster.
2502537-2¶
BNK fails to provision VXLAN CRs on TMM when deployed with OcNOS and VXLAN on an OpenShift cluster
Component: ingress
Symptoms: The system intermittently fails to provision VXLAN CRs on TMMs. The logs confirm that the communication to the Kubernetes API server times out.
Conditions: This occurs when BNK is deployed with OcNOS, VRF, and VXLAN enabled on a six-node OpenShift cluster with separate control and worker plane nodes.
Impact: Ingress and Egress traffic will fail when BNK is deployed with OcNOS and VXLAN on a six-node OpenShift cluster.
Workaround: No Workaround
2488649-2¶
Stale GatewaySetting configurations persist across TMM, VPC route table, and IPAM after EgressGateway CR update
Component: ingress
Symptoms: When you update the EgressGateway custom resource to reference a new GatewaySettings custom resource, the system does not properly clean up the old settings across TMM, the VPC route table, and IPAM.
As a result, stale configurations from the previous GatewaySetting persist and may conflict with the new configuration, which can disrupt traffic.
Conditions: Occurs when:
The required resources (Infra, GatewaySettings, EgressGateway) are applied.
All the resource statuses show
True.The
parametersRefsection of theEgressGatewayresource reference a newGatewaySettingsresource.
Impact: Stale configurations may conflict with the new configurations and disrupt traffic.
Workaround: Option 1: Delete and recreate the EgressGateway custom resource with the updated GatewaySettings custom resource reference to ensure the system runs the correct cleanup processes.
Option 2: Update the GatewaySettings custom resource directly if no other Gateway or EgressGateway references it.
2284409-4¶
No automatic reassignment of freed IPs to failed gateways
Component: IPAM
Symptoms: When the IP pool is exhausted, new Gateway resources fail to obtain an IP address. When a Gateway is deleted and its IPs are freed, the IPs are not automatically reassigned to Gateways that previously failed due to IP exhaustion.
Conditions: Occurs when
The IP pool is fully exhausted.
Multiple Gateway resources fail due to lack of available IPs.
An existing Gateway (with a successfully allocated IP) is deleted, freeing an IP.
Impact:
Gateways that failed due to IP exhaustion remain failed.
IP allocation isn’t automatically retried for affected Gateways.
Manual intervention is required to recover.
Workaround: To allocate an IP to a Gateway that failed due to IP exhaustion:
Delete the affected Gateway resource.
Recreate the Gateway resource. This triggers a new IP allocation attempt, allowing the system to assign any available (freed) IP.
2460133-2¶
ESP packets seen on the f5-ipsec pod while sending traffic.
Component: IPSec
Symptoms: Intermittent ESP leaks from TMM that are forwarded to IPsec pod when the tunnel count exceeds 1,000.
Conditions: When traffic is triggered with 1,000 tunnels, intermittent ESP leaks are observed at the IPsec pod.
Impact: ESP leaks are observed at the IPsec pod for specific client traffic, which is leading to data loss
Workaround: There is no known workaround at this time.
2569605-1¶
License Registration failing due to TEEM’s certs expiry
Component: licensing
Symptoms: License Activation failure - Device Registration failure.
License CR Output – (trimmed)
operationMode: connected
status:
conditions:
- lastTransitionTime: "202X-1X-1XT09:48:11Z"
message: 'Device registration failed: JWT verification failed. Error: token
is unverifiable: error while executing keyfunc: x509: certificate has expired
or is not yet valid: current time 202X-0X-1XT09:48:10Z is after 202X-10-11T00:24:51Z'
Conditions: Activating License using License CR without providing the TEEM’s JWKS configmap reference in the CR.
Impact: License Activation failure, hence the cluster can be used for traffic.
Workaround: Activation was successful by providing the JWKS reference in License CR.
Fix Text: Download the latest JWKS from the public URL https://product.apis.f5.com/ee/v1/keys/jwks and store in a file (.json ) say for example, cwc-jwks.cm.json.
For GA Builds 2.3.x , 2.4.x if the registration error is observed while license activation. Please perform the below steps:-
Delete the license CR
Clean up the license secrets data.
Restart the CWC
Create the config map using the above downloaded file as input.
example:
kubectl create configmap cwc-jwks-cm \
--from-file=key=cwc-jwks.cm.json \
-n <cwc-namespace> \
--dry-run=client -o yaml | kubectl apply -f -
Refer the configmap name and key in the license CR example:
apiVersion: k8s.f5net.com/v1
kind: License
metadata:
name: cnf-license
spec:
jwt: "<JWT_TOKEN>
operationMode: "connected"
jwksConfigMapRef:
name: cwc-jwks-cm
key: key
License CR has to be updated. Along with JWT and Operation Mode need to provide the JWKS config map reference and key of the config map. JWKS Config map and License CR both should be in namespace where CWC is running.
Also post activation, telemetry report should be send to TEEM’s server regularly every month in case of disconnected mode. In case of connected mode it is being send automatically.
2288025-2¶
Delayed DSSM availability after database failover in Sentinel deployment
Component: PE
Symptoms: In a Sentinel-based DSSM deployment, when the primary database goes down, failover to the new primary database takes approximately seven seconds with the default down-after-milliseconds parameter value of 5 seconds. During this interval, DSSM cannot process requests from the application and resumes serving requests only after the failover completes.
Key impacts during this seven-second interval include inconsistencies in RADIUS accounting:
Subscriber creation / accounting start: The system does not create subscribers. As a result, subscriber policies cannot apply until the next accounting update.
Subscriber deletion / accounting stop: The system fails to delete subscribers, which leaves stale entries in the system.
Re-Authentication Request (RAR): During RAR, the system cannot update new policies to DSSM. As a result, some subscribers may lose their applied policies during this brief downtime.
Conditions: DB failover
Impact: DSSM does not serve application requests during this interval.
2483861-2¶
cert-manager reports certificate as Ready=True while holding issuance retries in backoff after an issuer misconfiguration
Component: TLS/SSL
Symptoms: A certificate shows Ready=True even though recent issuance attempts failed and the certificate is nearing expiry. After you fix an invalid ClusterIssuer, no new Order appears immediately, and deleting stale CertificateRequest, Order, and Challenge resources does not force a retry.
Conditions: An invalid ACME directory URL in the ClusterIssuer causes the certificate authority (CA) to reject the order and places cert-manager into exponential backoff (1–32 hours). The existing TLS secret remains valid, so the certificate shows Ready=True. The operator checks during the backoff window.
Impact: No traffic impact — the existing TLS secret continues to serve traffic. The only impact is operational: the absence of new Orders during backoff can mislead operators into thinking recovery has failed.
Workaround: After you fix the ClusterIssuer, wait for the backoff period to elapse. cert-manager auto-recovers by recreating the CertificateRequest → Order → Challenge chain and renewing the secret. Deleting child resources does not speed up this process because cert-manager enforces backoff at the account level. To force immediate re-issuance (optional), use one of the following methods:
Run
cmctl renew(if cmctl is installed):cmctl renew <cert-name> -n <namespace>
Patch the Certificate status to set
Issuing=Truewith reasonRenewalRequested:kubectl patch certificate <cert-name> -n <namespace> \ --subresource=status \ --type='merge' \ -p '{ "status": { "conditions": [ { "type": "Issuing", "status": "True", "reason": "RenewalRequested", "message": "Manually triggered issuance of Certificate", "lastTransitionTime": "'$(date -u +'%Y-%m-%dT%H:%M:%SZ')'" } ] } }'
Rollout-restart the cert-manager pods to clear the in-memory backoff timers. Delete and recreate the issuer and certificate with a valid configuration. Reference: https://cert-manager.io/v1.11-docs/faq/#what-happens-if-issuance-fails-will-it-be-retried
2482985-2¶
TODA operator cannot persist status updates after forced pod termination
Component: toda_observer
Symptoms: After an abrupt or forced termination of the TODA Observer Operator or Observer worker pods (for example, using kubectl delete pod --force --grace-period=0 or an ungraceful crash), the system fails to transition newly created or updated ScrapeTemplate custom resources (CRs) to a Running state (Ready=True). Instead, these CRs remain stuck in a Pending or Error state (Ready: 0/N, Ready=False).
The Operator and Observer logs display RPC timeout errors such as:
rpc error: code = Unknown desc = query timed out in expression evaluation
The system takes approximately 10–15 minutes to resolve the CR status and recover automatically.
The Operator and Observer logs report RPC timeout errors such as:
rpc error: code = Unknown desc = query timed out in expression evaluation
The CR status may remain unresolved for approximately 10–15 minutes before eventually recovering on its own.
Conditions: The system abruptly or forcibly terminates the TODA Observer Operator or Observer worker pods without performing a graceful shutdown, severing sockets without sending TCP FIN/RST packets. The user applies or modifies new ScrapeClass or ScrapeTemplate CRs shortly after the restart, within the connection cache or retransmission window. This issue occurs on Kubernetes environments (such as bare-metal or ARM64 with Calico and VXLAN networking) where abruptly destroyed network interfaces leave stale half-open TCP connections in the kernel’s ESTABLISHED state.
Impact: Metrics scraping configuration and data collection for newly created ScrapeTemplate resources are delayed or fail to initialize for 10–15 minutes. Normal data path metrics collection resumes automatically once the stale socket window expires.
Workaround: Graceful deletion: Avoid using –force –grace-period=0 when deleting Observer pods, allowing the operating system to send proper TCP FIN/RST packets and cleanly drain sockets. Wait for socket expiration: If forced pod termination has occurred, wait approximately 10–15 minutes before creating new ScrapeTemplate CRs to allow the Linux kernel TCP retransmission budget (tcp_retries2) to reap stale sockets. Kernel / CNI Tuning: Reducing the node’s net.ipv4.tcp_retries2 setting or switching Calico to eBPF mode helps mitigate hung sockets across ungraceful interface tear-downs.
2456521-2¶
Qkview displays misleading “Running” status after CWC pod restart
Component: toda_qkview
Symptoms: When a qkview capture is in progress and the CWC pod restarts, the status continues to show “Running” indefinitely with a 0B size. The qkview is not actually running — the pod restart terminated the capture. The API reads stale on-disk state after the restart and returns the misleading status.
Attempting to cancel the qkview fails with: “cancel requested for non-running qkview,” which confirms the status is incorrect.
Conditions: Occurs when:
You start a qkview capture while CWC is running.
The CWC pod restarts during the capture.
Impact: Users see a misleading “Running” status for orphaned qkviews.
Workaround: Delete the stale qkview entry.