TLSProfile¶

TLSProfile is used to specify the TLS termination for a single/list of services in a VirtualServer Custom Resource. TLS termination relies on SNI. Any non-SNI traffic received on port 443 may result in connection issues. TLSProfile can be created either with certificates stored as k8s secrets or can be referenced by profiles existing in BIG-IP.

 apiVersion: cis.f5.com/v1
 kind: TLSProfile
 metadata:
   name: reencrypt-tls
   labels:
     f5cr: "true"
 spec:
   tls:
     termination: reencrypt
     clientSSL: /Common/clientssl
     serverSSL: /Common/serverssl
     reference: bigip             # --> reference profiles created in BIG-IP by User
   hosts:
   - coffee.example.com

Important

CIS will only process custom resources with f5cr label set as true. See lines 5-6 above.

Open API Schema Validation

TLSProfile Components¶

Parameter	Type	Required	Default	Description
termination	String	Required	N/A	Termination on BIG-IP Virtual Server. Allowed options are `edge`, `reencrypt`, and `passthrough`.
clientSSL	String	Required	N/A	ClientSSL Profile on the BIG-IP. For example `/Common/clientssl`.
serverSSL	String	Optional	N/A	ServerSSL Profile on the BIG-IP. For example `/Common/serverssl`.
reference	String	Required	N/A	Describes the location of profile: BIG-IP, or k8s Secrets. CIS currently supports BIG-IP and secret references. Available options are `bigip` and `secret`.

Note

To provide feedback on Container Ingress Services or this documentation, you can file a GitHub Issue.

Previous Next