Upgrade from 1.7.15 to 2.2.0 using Helm¶

If your deployment is on a specific version and you want to upgrade, check the Release Notes to learn about the new features and fixes before upgrading. To successfully upgrade SPK from 1.7.15 to 2.2.0, follow the instructions provided in the following sections in the specified sequence.

Upgrade the CRD Conversion pod and upgrade CRDs
Upgrade the Cert Manager
Upgrade the RabbitMQ
Upgrade the CWC
Upgrade the Toda-fluentd
Upgrade the dSSM
Upgrade the F5Ingress
Upgrade the Coremond

Prereqisites:

Download SPK manifest file, helm charts, docker images, and other utilities, SPK Artifacts Via F5 Artifact Registry.
Obtained JWT from MyF5.

Install CRD Conversion pod and apply CRDs template¶

Add privileges to the crd-conv-f5-crdconversion service account.

In this example, crd-conv-f5-crdconversion is composed of <helm name>-<helm chart>, where crd-conv represents the Helm name, and f5-crdconversion represents the Helm chart name. Update these values as per your deployment configuration.
```
oc adm policy add-scc-to-user privileged -n spk-utilities -z crd-conv-f5-crdconversion
```

Verify the crd-conv-values.yaml contents.

cat crd-conv-values.yaml

Sample Output:

crdconversion:
  image:
    repository: repo.f5.com/images
 
  rabbitmqNamespace: spk-utilities
 
  fluentbit_sidecar:
    image:
      repository: repo.f5.com/images
    fluentd:
      host: f5-toda-fluentd.spk-utilities.svc.cluster.local.
  

Install the CRD Conversion pod.

Note: Ensure that you add privileges to the <helm name> before installing the CRD Conversion pod. In the below example, crd-conv is the helm name.

In this example, the new version of f5-crdconversion helm chart is 0.16.15-0.0.12.

helm install crd-conv tar/f5-crdconversion-0.16.15-0.0.12.tgz -f crd-conv-values.yaml -n  spk-utilities           

Sample Output:

NAME: f5-crd-conversion
LAST DEPLOYED: Wed Dec 24 07:27:47 2025
NAMESPACE: spk-utilities
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
TEST SUITE: None

Run the cat crd.yaml to verify the crd.yaml contents.

conversion:
  namespace:  spk-utilities                

Create a template for common CRDs from the CRD bundle.

helm template f5-spk-crds-common-14.19.4-0.0.42.tgz -f crd.yaml > crd_commons-spk-utilities.yaml

Run the oc apply command to apply the common CRDs.

oc apply -f  crd_commons-spk-utilities.yaml

Sample Output:

customresourcedefinition.apiextensions.k8s.io/certificaterequests.cm.f5co.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/certificates.cm.f5co.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/challenges.acme.cm.f5co.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/clusterissuers.cm.f5co.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/issuers.cm.f5co.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/orders.acme.cm.f5co.k8s.f5net.com unchanged
customresourcedefinition.apiextensions.k8s.io/f5-spk-addresslists.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-dnscaches.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-global-optionses.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-spk-portlists.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-snatpools.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-staticroutes.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-vlans.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/gretunnels.k8s.f5net.com created

Create a template for SPK CRDs from the CRD bundle.

helm template f5-spk-crds-service-proxy-14.19.4-0.0.42.tgz -f crd.yaml > crd-values-serviceproxy.yaml

Run the oc apply command to apply the SPK CRDs.

oc apply -f crd-values-serviceproxy.yaml

Sample Output:

customresourcedefinition.apiextensions.k8s.io/f5-big-cne-addresslists.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-big-cne-irules.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-big-cne-portlists.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-big-context-globals.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-big-context-secures.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-big-ddos-globals.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-big-fw-policies.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-big-fw-rulelists.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-big-log-hslpubs.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-big-log-profiles.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-spk-egresses.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-egressdiameters.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-spk-egresshttp2s.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-spk-egresssips.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-spk-ingressdiameters.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-ingressegressudps.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-ingressgtps.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-ingresshttp2s.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-ingressngaps.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-ingresssips.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-ingresstcps.ingresstcp.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-ingressudps.ingressudp.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-pools.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-spk-servicetypelbippools.k8s.f5net.com configured
customresourcedefinition.apiextensions.k8s.io/f5-spk-statefulsets.k8s.f5net.com created
customresourcedefinition.apiextensions.k8s.io/f5-spk-traffic-distributions.k8s.f5net.com created

Upgrade the Cert Manager¶

Verify the cert-manager.yaml contents.

cat cert-manager.yaml

Sample Output:

image:
  repository: repo.f5.com/images
 
webhook:
  image:
    repository: repo.f5.com/images
 
cainjector:
  image:
    repository: repo.f5.com/images
 
startupapicheck:
  image:
    repository: repo.f5.com/images
 
init_container:
  image:
    name: init-certmgr
    repository: repo.f5.com/images
logging_sidecar:
  # Enable/Disable logging sidecar
  enabled: false
  name: logging-sidecar
  image:
    name: f5-fluentbit
    repository: repo.f5.com/images
 
  fluentbit:
    input:
      pipes:
        bufSize: 8096
    tls:
      enabled: true
  fluentd:
    host: f5-toda-fluentd.spk-utilities.svc.cluster.local.

Upgrade the Cert Manager.

helm upgrade f5-certificate-manager tar/f5-cert-manager0.23.48-0.1.0.tgz -n spk-utilities   -f cert-manager.yaml

Sample Output:

Release "f5-certificate-manager" has been upgraded. Happy Helming!
NAME: f5-certificate-manager
LAST DEPLOYED: Wed Dec 24 08:20:18 2025
NAMESPACE: spk-utilities
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None
NOTES:

See the installed releases in spk-utilities namespace to check for newly upgraded Cert Manager.
```
helm list -n spk-utilities
```

Upgrade the RabbitMQ¶

Verify the rabbitmq-values.yaml contents.

cat rabbitmq-values.yaml

Sample Output:

image:
  repository: repo.f5.com/images
 
fluentbit_sidecar:
  image:
    repository: repo.f5.com/images

Upgrade the RabbitMQ.

helm upgrade rabbitmq tar/rabbitmq-0.8.9.tgz -n spk-utilities -f rabbitmq-values.yaml 

Sample Output:

Release "rabbitmq" has been upgraded. Happy Helming!
NAME: rabbitmq
LAST DEPLOYED: Wed Dec 24 08:37:33 2025
NAMESPACE: spk-utilities
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None
NOTES:
The RabbitMQ has been installed.

View the list of pods associated with spk-utilities namespace/project.
```
oc get pods -n spk-utilities
```

Upgrade the CWC¶

Verify the cwc_overrides.yaml contents.

cat cwc_overrides.yaml

Sample Output:

cwc:
  image:
    repository: devrepo.f5.com/images
orch:
  image:
    repository: devrepo.f5.com/images
 
fluentbit_sidecar:
  image:
      repository: devrepo.f5.com/images
rbac:
  multiNSDeployment: true

Upgrade the CWC.

**Note: Make sure to replace cpclConfig.jwt value in the command with a valid JWT token.

helm upgrade cwc tar/cwc-0.49.7-0.0.5.tgz -n spk-utilities -f cwc_overrides.yaml --set rabbitmqNamespace=spk-utilities --set cpclConfig.jwt="<JWT Token>"

Sample Output:

Release "cwc" has been upgraded. Happy Helming!
NAME: cwc
LAST DEPLOYED: Wed Dec 24 09:38:18 2025
NAMESPACE: spk-utilities
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None
NOTES:
The Cluster Wide Controller has been installed.
====================================================
Admin Token Feature: DISABLED
No authentication token is required for REST API calls.
====================================================

View the list of pods associated with spk-utilities namespace/project.
```
oc get pods -n spk-utilities
```
Check the license status after the CWC upgrade, see License status. If the license has expired, renew it before proceeding with the F5Ingress upgrade.

Upgrade the Toda-fluentd¶

Verify the toda.yaml contents.

cat toda.yaml

Sample Output:

image:
  repository: repo.f5.com/images
  pullPolicy: Always
 
dssm_logs:
  enabled: true
  stdout: true
 
f5ingress_logs:
  enabled: true
  stdout: true
 
dssm_sentinel_logs:
  enabled: true
  stdout: true
 
persistence:
  enabled: true
 
tls:
  enabled: true

Upgrade the Toda-fluentd.

helm upgrade f5-toda-fluentd tar/f5-toda-fluentd-2.3.2-0.0.6.tgz -f toda.yaml -n spk-utilities

Sample Output:

Release "f5-toda-fluentd" has been upgraded. Happy Helming!
NAME: f5-toda-fluentd
LAST DEPLOYED: Tue Jan  6 18:26:39 2026
NAMESPACE: f5-common
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
TEST SUITE: None
NOTES:
Log aggregator - FluentD is deployed, which get logs from fluentbit sidecars.
FluentD outputs:
    'stdout' is "false"
    'persistent volume' is "true"
Persistent volume claim created with:
    accessModes: "ReadWriteOnce"
    storage: "3Gi"

FluentD hostname: f5-toda-fluentd.f5-common.svc.cluster.local.
FluentD port: "54321"
Use this info to connect to it:
--set f5-toda-logging.fluentd.host="f5-toda-fluentd.f5-common.svc.cluster.local."
--set f5-toda-logging.fluentd.port=54321

FluentD service IP family:
    serviceIpFamily: .Values.serviceIpFamily

See the installed releases in spk-utilities namespace to check for newly installed Cert Manager.
```
helm list -n spk-utilities
```
View the list of pods associated with spk-utilities namespace/project.
```
oc get pods -n spk-utilities
```

Upgrade the dSSM¶

To successfully upgrade dSSM, follow the instructions in Upgrading dSSM.

Upgrade the F5Ingress¶

With the implementation of readinessGates (config and routing gates), we have ensured TMM is available to process the network traffic with minimal traffic loss. For more information, see TMM Rolling Update.

Important: Based on the maxUnavailable, maxSurge, and TMM replicas configuration, ensure that you have:

Enough resources available.

Additional SelfIPs and translationIPs (SNAT and CGNAT).

Verify the overrides_2.2.0_values.yaml contents.

Note: The following parameters are configured to ensure that, during the upgrade, the TMM pod is immediately available to receive network traffic with a very less traffic loss:

tmm.bfdToOVN.enabled is set to True

tmm.dynamicRouting.bfd is configured.

cat overrides_2.2.0_values.yaml

Sample Output:

# This file contains overrides for ocp f5ingress chart in cnab
f5-tmm:
  enabled: true
  f5-toda-logging:
    enabled: true
    fluentd:
      host: f5-toda-fluentd.spk-utilities.svc.cluster.local.
      port: 54321
    fluentbit:
      logLevel: debug
      tls:
        enabled: true
    sidecar:
      image:
        repository: repo.f5.com/images
    tmstats:
      enabled: true
      config:
        image:
          repository: repo.f5.com/images
  debug:
    enabled: true
    rabbitmqNamespace: spk-utilities
    image:
      repository: repo.f5.com/images
  blobd:
    enabled: true
    image:
      repository: repo.f5.com/images
  tmm:
    image:
      repository: repo.f5.com/images
    tlsStore:
      enabled: true

    logLevel: INFO

    k8sprobes:
      enabled: true

    grpc:
      enabled: true

    nodeSelector:
      tmmnode: enabled
    bfdToOVN:
      enabled: true

    replicaCount: 3

    strategy:
      type: RollingUpdate
      rollingUpdate:
        maxSurge: 1
        maxUnavailable: 0

    sessiondb:
      useExternalStorage: "true"

    dynamicRouting:
      enabled: true
      tmmRouting:
        config:
          bgp:
            asn: 64522
            bgpSecret: bgp-secret
            gracefulRestartTime: 120
            neighbors:
            - ip : 10.17.1.244
              asn: 64521
              acceptsIPv4: true
              fallover: true
            - ip : fc17:1::241
              asn: 64521
              acceptsIPv6: true
              fallover: true
          bfd:
          interface: external
          interval: 100
          minrx: 100
          multiplier: 3
        image:
          repository: repo.f5.com/images
      tmrouted:
        image:
          repository: repo.f5.com/images

    cniNetworks: "spk-ingress/spk-ingress-internal-sriov,spk-ingress/spk-ingress-external1-sriov"


    customEnvVars:
    - name: SESSIONDB_EXTERNAL_SERVICE
      value: "f5-dssm-sentinel.spk-utilities"
    - name: SESSIONDB_DISCOVERY_SENTINEL
      value: "true"
    - name: OPENSHIFT_VFIO_RESOURCE_1
      value: "sriovEns25f1Mlx5NetdevPolicy"
    - name: OPENSHIFT_VFIO_RESOURCE_2
      value: "sriovEns25f0Mlx5NetdevPolicy"
    - name: SSL_SERVERSIDE_STORE
      value: "/tls/tmm/mds/clt"
    - name: SSL_TRUSTED_CA_STORE
      value: "/tls/tmm/mds/clt"
    - name: TMM_DEFAULT_MTU
      value: "9000"
    - name: CONFIG_VIEWER_ENABLE
      value: "TRUE"

    icni2:
      enabled: true
    ovn_meg:
      enabled: false
    network:
      vfio:
        enabled: false
      attachment:
        definitionName: spk-ingress/internal-sriov

## AFM Pod Values
f5-afm:
  enabled: true
  afm:
    enabled: true
    pccd:
      enabled: true
      debug: true
      image:
        repository: repo.f5.com/images
        pullPolicy: IfNotPresent
      securityContext:
        allowPrivilegeEscalation: false
        runAsUser: 10000
    fluentbit_sidecar:
      enabled: true
      image:
        repository: repo.f5.com/images
        pullPolicy: IfNotPresent
      fluentd:
        host: f5-toda-fluentd.spk-utilities.svc.cluster.local.
        port: 54321

global:
  tmmDefaultMTU: 9000
  controller:
    crdupdater:
      enabled: true
      grpc:
        port: 8752
  afm:
    enabled: true
    pccd:
      enabled: true

f5-stats_collector:
  enabled: true
  image:
    repository: repo.f5.com/images

controller:
  cwcNamespace: spk-utilities
  watchNamespace: "dav17-appns-1,dav17-appns-2"
  enableCustomResources: false
  image:
    repository: repo.f5.com/images
  vlan_grpc:
    enabled: true
  fluentbit_sidecar:
    enabled: true
    fluentd:
      host: f5-toda-fluentd.spk-utilities.svc.cluster.local
    image:
        repository: repo.f5.com/images
    fluentbit:
      tls:
        enabled: true

  tmm_pod_manager:
    enabled: true
    image:
      repository: repo.f5.com/images

  f5_lic_helper:
    enabled: true
    name: f5-lic-helper
    rabbitmqNamespace: spk-utilities
    image:
        repository: repo.f5.com/images

debug:
  image:
    repository: repo.f5.com/images

afm:
  name: f5-afm
  enabled: false

(Optional) If you have f5-afm pod enabled in values.yaml, add privileges to the f5-afm service account.
```
oc adm policy add-scc-to-user privileged -n spk-ingress -z f5-afm
```

Upgrade the F5Ingress using the new f5ingress helm chart version mentioned in the SPK v2.2.0 tarball.

Note: Before upgrading F5Ingress, ensure that readinessGates.enabled is set to true in values.yaml.

helm upgrade f5ingress tar/f5ingress-<version>.tgz -f <values>.yaml -n namespace

In this example, the Pods will be upgraded using the f5ingress-v13.7.1-0.2.38 Helm chart.

helm upgrade f5ingress tar/f5ingress-v13.7.1-0.2.38.tgz -f overrides_2.2.0_values.yaml -n spk-ingress

Sample Output:

Release "f5ingress" has been upgraded. Happy Helming!
NAME: f5ingress
LAST DEPLOYED: Tue Jan  6 18:26:39 2026
NAMESPACE: spk-ingress
STATUS: deployed
REVISION: 2
TEST SUITE: None
NOTES:
The F5Ingress Controller has been installed.
TMM debug sidecar is deployed. To access: kubectl exec -it deployment/f5-tmm -c debug -n spk-ingress -- bash

Note: Need to use extra vlan IP and extra snat IP for the traffic to work seamlessly after upgrade. with maxSurge 1 and maxUnavailable 0.

View the list of pods associated with spk-ingress namespace/project.
```
oc get pods -n spk-ingress -o wide
```
See the installed releases in spk-ingress namespace.

In this example, the below command shows the installed releases in spk-ingress Project.
```
helm list -n spk-ingress
```
During F5Ingress update process, run the below command to check the status of readinessGates (ConfigurationDone and RoutingDone gates).

In this example, the f5-tmm-7fb766f798-6bgbk is TMM pod.
```
oc describe pod f5-tmm-7fb766f798-6bgbk
```
Sample Output:
```
Readiness Gates:
  Type                Status
  ConfigurationDone   True
  RoutingDone         True
```
If you want to use the Multiple External Gateway (MEG) with SPK v2.2.0, apply the AdminPolicyBasedExternalRoute CR. For more information, see AdminPolicyBasedExternalRoute.

Note: During the upgrade of f5ingress from 1.7.15 to 2.2, it is recommended to first upgrade to version 2.2 with ICNI2.0 enabled before transitioning to MEG. After upgrading to 2.2 with ICNI2.0, you can again upgrade to MEG with the values file modified with the configuration as shown below:

Sample Output:
```
f5-tmm:
  tmm:
    icni2:
      enabled: false
    ovn_meg:
      enabled: true
```

Upgrade the Coremond¶

Verify the coremond-values.yaml contents.

cat coremond-values.yaml

Sample Output:

image:
  repository: devrepo.f5.com/images

persistence:
  storageClass: managed-nfs-storage

resources:
  limits:
    cpu: "1"
    memory: 200
  requests:
    cpu: "0.5"
    memory: 50

fluentbit_sidecar:
  image:
    repository: devrepo.f5.com/images  
  resources:
    limits:
      cpu: "0.5"
      memory: "512Mi"
    requests:
      cpu: "0.2"
      memory: "256Mi"

Upgrade the Coremond.

helm upgrade f5-coremond tar/coremond-0.7.56-0.0.5.tgz -n spk-utilities -f coremond-values.yaml 

Sample Output:

Release "f5-coremond" has been upgraded. Happy Helming!
NAME: f5-coremond
LAST DEPLOYED: Tue Jan  6 18:26:39 2026`
NAMESPACE: f5-certificate-orchestrator
STATUS: pending-upgrade
REVISION: 2
TEST SUITE: None
HOOKS:
MANIFEST:

View the list of pods associated with spk-utilities namespace/project.
```
oc get pods -n spk-utilities
```