Release notes

Release notes for F5 Insight 1.2.2, the on-premises observability and operational strategy solution for F5 Application Delivery and Security Platform.

Version 1.2.2 | August 2026

Product F5 Insight
Version 1.2.2
Release date August 2026
Deployment model On-premises / self-hosted
Document revision 1.2.2

About this release

F5 Insight 1.2.2 introduces software updates and patching for F5OS-A, enhances fleet-wide software updates and patching for BIG-IP TMOS, strengthens security controls for external authentication, and adds flexible options for managing appliance storage and remote access.

System requirements

Host platform

Component Requirement
Operating system F5-supported image
Architecture x86_64 (AMD64)
CPU Minimum 12 vCPUs
Memory Minimum 16 GB RAM
Storage 650 GB overall single volume storage. 100 GB for OS; 50 GB for backup and restore; 500 GB minimum for default telemetry retention policy
Hypervisor images QCOW and OVA

Managed BIG-IP devices

Component Requirement
BIG-IP version 17.5.x
Modules Local Traffic Manager (LTM) required; DNS, Advanced Web Application Firewall (AWAF), Advanced Firewall Manager (AFM), Access Policy Manager (APM), Carrier-Grade NAT (CGNAT), and SSL Orchestrator (SSLO) supported
Management access iControl REST API enabled; HTTPS reachable from F5 Insight host
Telemetry iRule High-speed logging (HSL) enabled; syslog reachable from collector listener

Highlighted features

  1. Fleet management: software updates and patching

    Centralized software management for F5OS-A. Upload images, distribute, and install updates and patches (including F5 Hardened Releases) across your F5OS-A fleet from a single console.

    You can also install Engineering Hotfixes (EHFs) on BIG-IP TMOS instances.

  2. Configure the external FQDN using the UI or API

    You can now configure the external Fully Qualified Domain Name (FQDN) used for LDAP and SAML login redirects directly from the F5 Insight UI or through the REST API, in addition to the existing f5insight-set-fqdn CLI script. See Configure remote authentication with a preferred FQDN.

  3. Custom CA certificates for LDAP/LDAPS authentication

    Administrators can upload a custom Certificate Authority (CA) certificate or CA bundle to the trust store and select it when configuring an LDAP identity provider, so F5 Insight can validate LDAPS or LDAP with StartTLS server certificates. See External authentication and role-based access control.

  4. Expand the F5 Insight virtual disk

    F5 Insight now detects unallocated virtual disk space and can automatically expand the partition and storage volumes on first boot, or on demand after deployment using a packaged disk expansion script. See Expand the F5 Insight virtual disk.

Fixed issues

This section details the bugs and issues resolved in this release.

  1. SAML login redirect

    When using SAML-based authentication (for example, Okta or Ping), selecting the external IdP login option on the F5 Insight login page might route users through an intermediate service-provider login screen rather than directly to the IdP authentication page. F5 Insight no longer displays an intermediate page.

  2. Lite mode UI displayed during upgrade to Full mode

    During the upgrade process, the F5 Insight Lite onboarding UI might appear instead of the expected Full mode interface.

  3. Software installation job fails for Active or Standby BIG-IP devices in Standalone mode

    Adding BIG-IPs that are either ‘Standby’ or ‘Active’ into a Software Installation of type ‘Standalone’ will result in error “Failed to start software installation job”.

  4. Primary node upgrade might fail when upgrading DR pair from 1.2.0 to 1.2.1 after failover

    When upgrading an F5 Insight DR pair from 1.2.0-210 to 1.2.1-4, the standby node upgrade might succeed, but the primary node upgrade can fail during the Helm post-upgrade phase with a bootstrap secret error. After the failure, the primary node rolls back to version 1.2.0-210. This issue occurs after a DR failover has been performed. It is not expected when upgrading directly from 1.1.x releases to 1.2.1-4. This issue has been fixed in this release.

  5. Auto-generated temporary password disappears from VMware console during initial boot (BZ-2433349)

    During fresh F5 Insight v1.2.1 OVA deployments on VMware ESXi/vSphere, the temporary admin password appears briefly on the console during initial boot and then disappears.

  6. f5insight-device-cert unable to import ECDSA certificate

    The f5insight-device-cert utility fails to generate or import an ECDSA certificate. The utility now includes new options to support ECDSA certificate generation and import. See the updated documentation for details.

  7. Minimum disk validation during first boot

    Fixed an issue where F5 Insight didn’t validate the minimum primary-disk requirement during first boot or provisioning, which could cause setup failures on under-resourced systems. F5 Insight now displays a warning message on the licensing screen and SSH terminal when the disk requirement isn’t met.

  8. Stranded container image cleanup after upgrades

    Fixed an issue in the upgrade pipeline where stranded container images weren’t cleaned up after upgrades. A new cleanup-old-images.sh script is now included to purge these images and free up disk space. Affects versions 1.1.0 and 1.2.0.

  9. BIG-IP authentication token handling

    Improved how F5 Insight manages BIG-IP iControl REST authentication tokens:

    • F5 Insight now clears cached tokens immediately after receiving a 401 or 403 response from BIG-IP, so the next API call performs a fresh login instead of reusing an invalid token.
    • When a token expires during a data collection cycle, F5 Insight retries the failed request once after re-authentication. A single token expiry no longer causes a missed scrape cycle.
    • The automatic token refresh schedule now uses the actual token TTL returned by BIG-IP (default: 1200 seconds) instead of the collection interval.

  10. AI Chat returned incorrect object counts on devices with many objects

    The F5 Insight AI assistant now returns accurate counts when queried about the number of virtual servers, pools, WAF incidents, or connection policies on a device. Previously, on devices with a large number of objects (approximately 200 or more), the assistant could report an incorrect count due to the AI model misreading the tool response. The backend now pre-computes exact per-device counts and returns them as an explicit field in the API response, eliminating any ambiguity for the AI model.

  11. LLM settings rejected IPv6 addresses in the UI

    Previously, the LLM Settings form on the Enterprise AI Configuration page rejected IPv6 addresses in RFC 3986 bracket notation (for example, https://[fddb::1]/openai/v1), even though the backend API accepted them. The form displayed the error Base URL must be a valid URL. The frontend URL validation now supports RFC 3986 IPv6 literal notation, so you can configure local LLM providers with IPv6 endpoint addresses through the UI without validation errors.

  12. OTel collector restarted repeatedly due to concurrent data access (ID: 2456505)

    Previously, the OpenTelemetry collector could crash and restart repeatedly when concurrent requests accessed metrics and token data simultaneously, causing an internal panic condition. This disrupted metrics collection and syslog listener operation for managed BIG-IP devices. The collector now handles concurrent data access safely, restoring stable metrics collection. Affects versions 1.1.1 and 1.2.1.

  13. Software distribution reported incorrect disk space error for devices using a custom CA

    Previously, when you ran a software distribution job on a BIG-IP device onboarded with a custom (private) Certificate Authority (CA), the disk analysis incorrectly reported “1 instance is missing required disk space for software installation,” even when the device had sufficient free disk space. The error occurred because the provisioning service didn’t use the device-specific CA certificate for TLS connections during disk analysis, which caused a silent connection failure that appeared as a misleading disk space error. The provisioning service now uses the per-device CA certificate for disk analysis and inventory operations, so devices onboarded with a custom CA complete disk space checks correctly.

  14. BIG-IP upgrade jobs remained in DRAFT state for devices onboarded using an FQDN

    Previously, when BIG-IP HA pair devices were onboarded using a fully qualified domain name (for example, https://bigip1.f5labs.com) instead of an IP address, upgrade jobs for those devices remained stuck in DRAFT state and never transitioned to READY. This occurred because F5 Insight couldn’t resolve the HA peer relationship for FQDN-onboarded devices, which caused HA pair validation to fail. F5 Insight now resolves HA peer identity using the device’s management IP address regardless of how the device was onboarded, so upgrade jobs for FQDN-onboarded HA pairs transition to READY correctly.

  15. Metrics collection could exceed the BIG-IP concurrent connection limit (BZ-2301829)

    Previously, F5 Insight calculated the maximum number of concurrent collection jobs for a device using only its configured rate limit, which could cause F5 Insight to exceed the BIG-IP default limit of 10 concurrent connections. F5 Insight now factors in both the rate limit and the request limit when calculating maximum concurrent jobs, and adds a Max Concurrent Connections field (1-20; default: 5) to the add/edit device UI so you can tune the per-device connection limit. When you upgrade from a version earlier than 1.2.2, existing devices are automatically set to the default value of 5. F5 recommends not exceeding the BIG-IP default limit of 10, and reserving 1-2 connections for ad hoc API calls that F5 Insight features (for example, AI Chat) make outside of scheduled collection. See K9588 for how to raise the connection limit on BIG-IP.

  16. Scraping cycle failed entirely when a single device was unreachable

    Previously, an unhealthy or unreachable BIG-IP device could disrupt metrics collection for a scraping cycle. F5 Insight now checks device health before each scraping cycle and skips only the unhealthy device for that cycle, so collection continues normally for all other devices.

Known issues

This release includes the following known issues.

  1. SAML single logout (SLO)

    SAML Single Logout (SLO) is a known limitation in this release. Logging out of F5 Insight might terminate your F5 Insight session, while the Identity Provider (IdP) session can stay active, allowing re-login without re-authentication.

    Workaround: To make sure you fully log out, either:

    • Use a private/incognito browser window for SAML sessions, or
    • Explicitly log out from the IdP after logging out of F5 Insight.

  2. IdP group sync

    When user group or profile attributes are changed in an external IdP (SAML/OIDC, for example, Okta or Ping), those updates might not be synchronized to the existing user record in F5 Insight on subsequent logins. As a result, previously assigned groups in F5 Insight can persist (for example, admin group remains after change to operator group in IdP).

    Workaround: Re-create the Saml IdP provider configuration in F5 Insight after IdP group changes are made.

  3. Manual browser refresh required after upgrading from 1.1.x to 1.2.2

    After upgrading from F5 Insight version 1.1.x to 1.2.2, the user interface might not automatically refresh to reflect the updated interface. This occurs because the auto-reload fix delivered in 1.2.2 only applies to upgrades starting from version 1.2.0 onwards due to significant codebase restructuring between 1.1.x and 1.2.0.

    Workaround: After upgrading from 1.1.x to 1.2.2, perform a manual browser refresh to load the updated 1.2.2 user interface.

  4. LDAP + StartTLS is not functional with a custom CA certificate

    Runtime LDAP login fails when the identity provider is configured for LDAP with StartTLS and a custom CA certificate. Backend certificate validation accepts the custom CA, but the current identity management component does not apply it during a StartTLS login attempt.

    Workaround: Use LDAPS instead of LDAP + StartTLS for custom CA deployments. If your environment requires StartTLS, apply the workaround script described in Workaround: apply a custom CA for StartTLS.

  5. External authentication with Active Directory can only assign a user to a Viewer Role

    This is a known limitation in this release. F5 Insight’s LDAP group search currently requires groups to exist under ou=groups,<baseDN>. Directories that don’t use this layout, including Active Directory, resolve no groups, and affected users default to the Viewer role. This issue is scheduled for a fix in future release of F5 Insight.

  6. Concurrent ISO image uploads fail when upload duration exceeds one hour

    When you upload multiple ISO images to F5 Insight at the same time, uploads that take longer than one hour are terminated. Upload jobs that are still in the queue continue normally.

    Workaround: Upload ISO images one at a time, or reduce the number of concurrent uploads. This issue is scheduled for a fix in F5 Insight 1.3.

  7. Disk space check might report inaccurate results for F5OS appliances upgraded from version 1.5.2 or earlier

    The disk space check in F5 Insight might report inaccurate results for F5OS appliances that were upgraded from version 1.5.2 or earlier, which can cause upgrade failures.

    Workaround: Make sure available disk space is greater than 60% before you start an upgrade on devices previously upgraded from F5OS 1.5.2 or earlier releases.

  8. Large-scale concurrent distribution and installation jobs fail on BIG-IP version 21.1.0

    Running large-scale concurrent distribution and installation jobs on BIG-IP version 21.1.0 can cause timeout and resource contention issues, resulting in:

    • Intermittent distribution failures across parallel batches.
    • Installation failures when the new boot volume doesn’t become active within the expected timeframe.

    These issues are specific to BIG-IP version 21.1.0 devices.

    Workaround: Reduce the number of concurrent distribution and installation jobs, or run them in smaller batches. This issue is scheduled for a fix in F5 Insight 1.3.

  9. Disk expansion tool doesn’t automatically expand NVMe drives

    The disk expansion tool can’t detect unallocated space and skips automatic expansion.