BIG-IP Next for Kubernetes (Host) 2.2.1 release notes¶
About this release¶
Introduction¶
These release notes describe the differences between BIG-IP Next for Kubernetes (Host) 2.2.0 and 2.2.1.
Supported container-orchestration platforms¶
This release is officially supported on these container-orchestration platforms and versions:
| Platform | Version | Recommended Helm version |
|---|---|---|
| OpenShift | 4.14 | 3.15 |
| OpenShift | 4.16 | 3.17 |
| OpenShift | 4.18 | 3.19 |
Security updates¶
(No security updates)
New features¶
(No new features)
Enhancements¶
Schedule component pods¶
Allows you to configure pod scheduling fields for components so you can place them on the right nodes—for example, schedule TMM on DPUs and prevent F5 ingress, DSSM, and CWC from running on DPUs. For more information, see CNE Instance parameters
Model changes¶
(No model changes)
Fixed issues¶
2185785¶
CR Status set to Failed when there is a gRPC failure without recovery
Component: ingress
Symptoms:
When the Controller does not receive a response for gRPC request and all retries have been exhausted, the CR status is updated to Failed.
Conditions:
A network outage within the ControlPlane or between the ControlPlane and the DataPlane.
A ControlPlane component restarts while configuration attempts are underway. A DataPlane component restarts while attempts are underway.
Impact:
Dataplane may or may not be configured.
Fix Text Delete and reapply the affected CRs.
2200517-1¶
Hardware acceleration for IPv6 is not supported.
Component: FSM
Symptoms:
On the CX7 NIC, BIG-IP Next for Kubernetes hardware acceleration is not supported for IPv6 traffic. Only IPv4 traffic offloading is available, including IPv4 flow offloading, IPv4 NAT44 offloading, and ACL offloading.
Conditions:
BIG-IP Next for Kubernetes running on the CX7 NIC.
Impact:
IPv6 traffic is not optimized for acceleration.
Fix Text IPv6 offloading now is working.
Known issues¶
2183833-2¶
SIP egress CRD installation is not supported by FLO
Component: egress
Symptoms:
SIP egress CRD is not installed when installing BNK using FLO.
Conditions:
When CRD installation is done using only FLO.
Impact:
SIP egress CRD will be missing in the CRDs installed using FLO and SIP egress functionality will not be supported.
Workaround:
Install SIP egress CRD using helm.
2229789-1¶
DSSM upgrade failed when upgrading from BNK 2.2.0 to 2.2.1 using FLO
Component: dssm
Symptoms:
While upgrading from BNK 2.2.0 to 2.2.1 using FLO, the DSSM upgrade hook pod gets stuck in a container-creating state, preventing the DSSM pods from upgrading successfully.
Conditions:
This issue is observed when upgrading from BNK 2.2.0 to 2.2.1 using FLO.
Impact:
The DSSM DB pods are not upgraded to the latest version.
Workaround:
Before the upgrade, create a file named dssm-upgrade-cm.yaml containing the configuration for the ConfigMap in the lower version prior to performing the upgrade.
apiVersion: v1
kind: ConfigMap
metadata:
name: f5-dssm-logs-config
data:
.minlevel.yaml: |
Apply the dssm-upgrade-cm.yaml in the same namespace where the DSSM pods are deployed.
kubectl apply -f dssm-upgrade-cm.yaml -n <dssm pods installed name space>
2201525-2¶
OcNOS sending ASN 0
Component: fsm-networking
Symptoms:
BGP Neighborship fails due to OcNOS sending ASN 0 on peer open message.
Impact:
Neighborship fails to estabish.
Workaround:
To mitigate the issue:
Start the TMM first and then FRR.
Alternatively, run the command ‘no bgp XXXX’ to reconfigure the peer.
2227657¶
In DSSM, the timestamp for DP1 is changed when all the three DSSM containers are restarted
Component: CGNAT
Symptoms:
Restarting all three DSSM containers with pkill -15 causes new data to be lost; when the DSSM pods come back up, Redis loads the old data from the RDB file.
Conditions:
All the DSSM pods are restarted at the same time.
Impact:
The new data that are not saved in the RDB file maybe lost.
Workaround:
When deploying or upgrading the DSSM Helm chart, the administrator should set aof_enabled to true in the DSSM override file.
db:
aof_enabled: "true"
2227705¶
Using the NAT CR configuration, downgrade from version 2.2.1 or later to a version earlier than 2.2.1
Component: CGNAT
Symptoms:
In the future, upgrading to version 2.2.1 or later from a version earlier than 2.2.1 without deleting the NAT CRs will cause NAT IP duplication in DSSM; the same NAT IPs may be reserved by multiple TMM pods.
Conditions:
Occurs when user,
runs a 2.2.1 or later version with NAT CR configuration.
downgrade to version earlier to 2.2.1 without deleting NAT CR configuration.
upgrades to 2.2.1 or later version without deleting the NAT CR configuration.
Impact:
Service disruption.
Workaround:
Before downgrading to a version earlier than 2.2.1, delete the NAT CRs, then reapply them after the downgrade is complete.
2224785¶
During initialization the Fluentbit sidecar container can crash and restart
Component: toda_observer
Symptoms:
The crash is a classic race condition between the startup sequence and a signal handler. When Fluent Bit starts, it creates a global flb_config, whose cio field (the ChunkIO context) is initially NULL and only initialized later. If a signal triggers code (cio_stats_get) before storage initialization completes, it dereferences the NULL cio pointer, causing an illegal memory access and the OS terminates the process with a SIGSEGV or SIGABRT.
Conditions:
When SIGTERM is received during early startup.
Impact:
After restarting, the Fluent Bit container is fully functional.
Workaround:
A Fluentbit Open Source issue is created.
1617301-3¶
Bidirectional persistence traffic may fail in F5SPKIngressDiameter and F5SPKIngressHTTP2 deployments
Component: FSM
Symptoms:
Outbound requests on new connections for bidirectional persistence configurations may fail for deployments that are utilizing F5SPKIngressHTTP2 or F5SPKIngressDiameter custom resources. Ingress traffic, outbound responses, and outbound requests utilizing the existing connection are unaffected.
Conditions:
An outbound request is sent on a new connection from an endpoint that is a part of a service configured for F5SPKIngressHTTP2 or F5SPKIngressDiameter.
SPK is configured with more than one f5-tmm pod.
Impact:
Outbound requests may be dropped.
Workaround:
Utilize only one f5-tmm pod replica for SPK instances requiring bidirectional persistence with F5SPKIngressHTTP2 or F5PSKIngressDiameter
1889425-3¶
Egress traffic fails during an f5-tmm pod restart event
Component: FSM
Symptoms:
Egress traffic fails while one or more f5-tmm pods are restarting.
Conditions:
SPK is installed and configured to handle egress traffic from watched namespaces.
One or more f5-tmm pods crash or are restarted by Kubernetes.
Impact:
Egress traffic might fail from traffic routing to an f5-tmm pod that is restarting.
2035637-2¶
Traffic drops in egress traffic during upgrade from 2.0.2 to 2.1.0
Component: Egress
Symptoms:
During rolling upgrade of TMMs, some egress connections are dropped because the OVN routes to the old TMM are not removed as soon as old TMM is down.
Whenever readiness gates are ready on the new TMM, the old TMM immediately goes down. But as the OVN route to old TMM still exists for 7-8 seconds, some connections are sent to the old TMM through the invalid route are dropped.
Conditions:
Rolling upgrade from SPK 2.0.2 to SPK 2.1.0.
BFD is enabled on both ingress and egress.
Running both ingress and egress traffic.
Impact:
Some traffic is disrupted during the rolling upgrade.
1968153-3¶
Traffic stats missing drop counter for trunk usecases
Component: FSM
Symptoms:
Traffic stats are not present when packet are dropped when using a trunk interface.
Conditions:
The trunk does not have any interfaces to forward traffic.
Impact:
Missing diagnostics.
2138129-1¶
Fluent-bit ARM64 image hits unsupported page size issues on ARM64 AKS cluster
Component: Toda_fluentbit
Symptoms:
When configuring a Linux kernel with the page size for 64K page size: CONFIG_ARM64_64K_PAGES=y, Fluentbit fails to start with an error “Unsupported system page size”.
Conditions:
When configuring a Linux kernel with the page size for 64K page size: CONFIG_ARM64_64K_PAGES=y.
Impact:
Fluentbit fails to start with an error “Unsupported system page size”.
1823977-2¶
Logs for TMM container is unavailable through console output when fluentbit container is enabled in TMM pod
Component: FSM
Symptoms:
When the fluentbit container is enabled for the f5-tmm pod, the f5-tmm container logs will not be outputted to the console. However, the f5-tmm container logs can still be found in the f5-toda-fluentd pod (located under “/var/log/f5”).
Conditions:
Fluentbit container is enabled and running in the f5-tmm pod.
Impact:
F5-tmm container logs will not be outputted through console and can only be found in the f5-toda-fluentd pod.
Workaround:
The f5-tmm container logs can still be found in the f5-toda-fluentd pod (located under “/var/log/f5”).
1785181-2¶
Configuration data for a previously monitored namespace is not removed when the namespace is deleted from the watch list
Component: FSM
Symptoms:
When namespace is removed from watch namespace list by editing the controller deployment, configs for custom resources (CRs) in removed namespace are not cleared from TMM.
Conditions:
Controller initially monitors the namespace, then removes the namespace from watch namespace list.
Impact:
Config for custom resources (CRs) in removed namespace is cleared on TMM.
Workaround:
Delete CR’s from the namespace before removing the namespace from watch namespace list.
2196305-1¶
Helm upgrade displays conflict error with object .data.cluster_node_ip__apps
Component: FSM
Symptoms:
Helm upgrade displays the following error on upgrade
level=WARN msg=”upgrade failed” name=f5ingress error=”conflict occurred while applying object dav17-alpha/f5-tmm-dynamic-routing /v1, Kind=ConfigMap: Apply failed with 1 conflict: conflict with “f5ingress” using v1: .data.cluster_node_ip__apps”.
Conditions:
During helm upgrade.
Impact:
Just error message on the console, no impact to configuration or traffic forwarding.
Workaround:
Ignore the error message.