F5BigContextGlobal

The F5BigContextGlobal Custom Resource (CR) installs with the SPK Controller to configure the default behavior for the installed F5BigFwPolicy CRs. The F5BigContextGlobal CR provides options that enable modifications to the default F5BigFwPolicy CR packet handling behavior.

CR Parameters

The tables below describe the F5BigContextGlobal CR parameters.

Parameter	Description
logProfile	Specifies the F5BigLogProfile CR using the metadata.name parameter.
firewall.enforcedPolicy	References and applies a F5BigFwPolicy globally. This applies prior to F5BigFwPolicy CRs that may be referenced by F5BigContextSecure CRs.
firewall.defaultAction	The default action to apply to traffic that does not match any firewall rule must always be set to accept (default). This is because SPK does not support attaching a firewall policy at the Virtual Server level, so the default action is applied to all traffic as the final firewall rule.
firewall.defaultActionLog	Whether an HSL message should be generated when applying the defaultAction.

CR Example

apiVersion: k8s.f5net.com/v1
kind: F5BigContextGlobal
metadata:
  name: global-context
spec:
  firewall:
    defaultAction: "accept"
    defaultActionLog: false

CR updates

The F5BigContextGlobal CR behaves differently than the other SPKs CRs: When you install the SPK Controller to a namespace, a copy of the F5BigContextGlobal is applied to namespace with the default values. Because only a single CR of this type can exist in the namespace, you must use the same name, global-context, when modifying the F5BigContextGlobal CR.

Firewall Default Action

Thefirewall.defaultActions must be always set to accept for SPK.

Requirements

Ensure you have:

• Installed the SPK Controller.

• A Linux based workstation.

Installation

Use the steps below to modify the default values of the F5BigContextGlobal CR.

1. View the currently installed F5BigContextGlobal CR.

   In this example, the F5BigContextGlobal CR is installed in the spk-ingress* namespace.

   oc get f5-big-context-global -n spk-ingress
   

   In this example, the F5BigContextGlobal CR named global-context is installed.

   NAME             STATUS    MESSAGE                            
   global-context   SUCCESS   CR config sent to all grpc endpoints
   

2. View the configuration of the currently installed F5BigContextGlobal CR.

   oc get f5-big-context-global -n spk-ingress -o yaml | grep firewall: -A2
   

   In this example, the F5BigContextGlobal CR is set to the default values.

    firewall:
      defaultAction: accept
      defaultActionLog: false
   

Feedback

Provide feedback to improve this document by emailing spkdocs@f5.com.