F5SPKEgressSIP¶
Overview¶
The Kubernetes resource, F5SPKEgressSIP, allows SIP applications to communicate with external networks. When a pod inside the cluster sends a SIP request to an external server through SPK, the server may respond using a different IP address and port. SPK intelligently routes this response back to the correct pod by matching the Call-ID in the header message.
Key points¶
Enables outbound SIP traffic from Kubernetes pods to external services.
Handles responses even when the external server changes its IP/port.
Uses call-id tracking to ensure responses reach the right pod.
Prerequisites¶
Install SPK
Deploy required egress and SIP CRDs
Create CRs (AdminPolicyBasedExternalRoute, F5SPKVlan, and F5SPKEgressSIP)
Usecase¶
External SIP servers may send 200 OK responses from a different IP/port than the original request path. SPK drops these responses due to source mismatch and cannot correlate them to the originating pod, resulting in a failed call setup. This new feature allows SIP based applications to route traffic via SPK.
installation¶
Using the Helm installation procedure, install the SPK CRD bundle (f5-spk-crds-service-proxy) from the latest tarball, manually, to include the SIP Egress CRD.
Note: However, while using FLO to install, you must set these parameters to the respective values:
spec.product.type to BNK
spec.product.gatewayAPI to false
CR Parameters¶
The table below describes the CR parameters. Each heading below represents the top-level parameter element.
spec¶
| Parameter | Type | Description | Default value | Example |
|---|---|---|---|---|
services.name |
string | The name of the service for the SIP Egress configuration. | - | myService |
services.namespace |
string | The namespace of the service for the SIP Egress configuration. | - | myApp |
persistTimeout |
integer | The time in seconds to persist the SIP session based on the Call-ID header field. | 3600 | 180 |
ipfamilies |
string | The IP version capabilities of the application. | IPv4 | "IPv4", "IPv6", "IPv4andIPv6" |
idleTimeout |
integer | The time till which the client connection remains active with no activity(seconds). | 300 | 60 |
spec.ingress¶
| Parameter | Type | Description | Default value | Example |
|---|---|---|---|---|
destinationPort |
integer | The destination port number of the SIP application where the ingress virtual server will be listening. | 5070 | 2123 |
sourceSubnet |
string | The IPv4 subnet of the application on the ingress side matching based on source IPs. | 0.0.0.0/0 | 10.20.0.0/16 |
v6SourceSubnet |
string | The IPv6 subnet of the application on the ingress side matching based on source IPs. | 0:0::/0 | 2001:db8:1:3::/64 |
destinationAddresses.ipv4Addresses |
enum | The IPv4 addresses of the application on the ingress side matching traffic based on destination IPs. | 10.1.1.1 | |
destinationAddresses.ipv6Addresses |
enum | The IPv6 addresses of the application on the ingress side matching traffic based on destination IPs. | 2001:db8:85a3::8a2e:370:7334 | |
vlans.vlanList |
[]string | Specify list of vlans on the ingress side to pass traffic. | [] | vlan_external |
vlans.disableListedVlans |
boolean | Indicates whether to allow all ingress VLANs except the listed ones (true) or only the VLANs explicitly listed (false). | true | false |
vlans.category |
sting | The category of vlans on the ingress side desired by the application. | "" | clientside |
spec.egress¶
| Parameter | Type | Description | Default Value | Example |
|---|---|---|---|---|
destinationPort |
integer | The egress destination port number of the SIP application where the egress virtual server will listen for traffic. | 5060 | 5060 |
destinationSubnet |
string | The IPv4 subnet of the application on the egress side matching traffic based on destination IPs. | 0.0.0.0/0 | 10.10.0.0/16 |
v6DestinationSubnet |
string | The IPv6 subnet of the application on the egress side matching traffic based on destination IPs. | 0:0::/0 | 2001:db8:1:9::/64 |
vlans.category |
string | The category of vlans on the egress side desired by the application. | "" | clientside |
vlans.disableListedVlans |
boolean | Indiates whether to use all vlans on the egress side except the listed ones (true) or only the ones in the list (false). | true | false |
vlans.vlanList |
[]string | Specify list of vlans on the egress side to pass traffic. | [] | ["vlan_internal"] |
Sample CR¶
A sample Kubernetes custom resource that configures SIP egress/ingress for a specific service using SPK.
apiVersion: k8s.f5net.com/v1
kind: F5SPKEgressSIP
metadata:
name: sip-egress
namespace: ingress
spec:
egress:
destinationPort: 5060
destinationSubnet: 0.0.0.0/0
ingress:
destinationPort: 5070
destinationAddresses:
ipv4Addresses:
- 10.9.77.221
- 10.9.77.222
ipfamilies: IPv4
services:
- name: sip-app-sip-test-app
namespace: testapp
This F5SPKEgressSIP resource (k8s.f5net.com/v1) named sip-egress in the ingress namespace configures SIP egress/ingress via SPK. It sets an ingress virtual server on port 5070 using IPv4 addresses 10.9.77.221 and 10.9.77.222, and an egress virtual server on port 5060 to any IPv4 destination (0.0.0.0/0). The configuration is IPv4-only and applies to the service sip-app-sip-test-app in the testapp namespace.
Sample CR for ipv6 traffic¶
Add your codapiVersion: k8s.f5net.com/v1
kind: F5SPKEgressSIP
metadata:
name: sip-egress
namespace: ingress
spec:
egress:
destinationPort: 5060
v6destinationSubnet: ::/0
ingress:
destinationPort: 5070
v6SourceSubnet: ::/0
destinationAddresses:
ipv6Addresses:
- 2021::77:221
- 2021::77:222
ipfamilies: IPv4andIPv6
services:
- name: sip-app-sip-test-app
namespace: testappe here