diff --git a/packs/f5-bigip-ctlr-0.0.38/README.md b/packs/f5-bigip-ctlr-0.0.38/README.md new file mode 100644 index 00000000..4c8f1c1a --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/README.md @@ -0,0 +1,161 @@ +# Helm Chart for the F5 Container Ingress Services + +This chart simplifies repeatable, versioned deployment of the [Container Ingress Services](https://clouddocs.f5.com/containers/latest/). + +### Prerequisites +- Refer to [CIS Prerequisites](https://clouddocs.f5.com/containers/latest/userguide/cis-helm.html#prerequisites) to install Container Ingress Services on Kubernetes or Openshift +- [Helm 3](https://helm.sh/docs/intro/) should be installed. + + +## Installing CIS Using Helm Charts + +This is the simplest way to install the CIS on OpenShift/Kubernetes cluster. Helm is a package manager for Kubernetes. Helm is Kubernetes version of yum or apt. Helm deploys something called charts, which you can think of as a packaged application. It is a collection of all your versioned, pre-configured application resources which can be deployed as one unit. This chart creates a Deployment for one Pod containing the [k8s-bigip-ctlr](https://clouddocs.f5.com/containers/latest/), it's supporting RBAC, Service Account and Custom Resources Definition installations. + +## Installing the Chart + +- (Optional) Add BIG-IP credentials as K8S secrets. + +For Kubernetes, use the following command: + +```kubectl create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=``` + +For OpenShift, use the following command: + +```oc create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=``` + +- Add the CIS chart repository in Helm using following command: + +```helm repo add f5-stable https://f5networks.github.io/charts/stable``` + +- Create values.yaml as shown in [examples](https://github.com/F5Networks/charts/tree/master/example_values/f5-bigip-ctlr): + +- Install the Helm chart if BIGIP credential secrets created manually using the following command: + +```helm install -f values.yaml f5-stable/f5-bigip-ctlr``` + +- Install the Helm chart with skip crds if BIGIP credential secrets created manually (without custom resource definitions installations) + +```helm install --skip-crds -f values.yaml f5-stable/f5-bigip-ctlr``` + +- If you want to create the BIGIP credential secret with helm charts use the following command: + +```helm install --set bigip_secret.create="true" --set bigip_secret.username=$BIGIP_USERNAME --set bigip_secret.password=$BIGIP_PASSWORD -f values.yaml f5-stable/f5-bigip-ctlr``` + +## Chart parameters: + +Parameter | Required | Description | Default +----------|-------------|-------------|-------- +bigip_login_secret | Optional | Secret that contains BIG-IP login credentials | f5-bigip-ctlr-login +args.bigip_url | Required | The management IP for your BIG-IP device | **Required**, no default +args.bigip_partition | Required | BIG-IP partition the CIS Controller will manage | f5-bigip-ctlr +args.namespaces | Optional | List of Kubernetes namespaces which CIS will monitor | empty +bigip_secret.create | Optional | Create kubernetes secret using username and password | false +bigip_secret.username | Optional | bigip username to create the kubernetes secret | empty +bigip_secret.password | Optional | bigip password to create the kubernetes secret | empty +rbac.create | Optional | Create ClusterRole and ClusterRoleBinding | true +rbac.namespaced | Optional | Enable namespaced RBAC: per-namespace Roles plus a minimal cluster-scope Role (nodes, namespaces, ingressclasses) | false +serviceAccount.name | Optional | name of the ServiceAccount for CIS controller | f5-bigip-ctlr-serviceaccount +serviceAccount.create | Optional | Create service account for the CIS controller | true +namespace | Optional | name of namespace CIS will use to create deployment and other resources | kube-system +image.user | Optional | CIS Controller image repository username | f5networks +image.repo | Optional | CIS Controller image repository name | k8s-bigip-ctlr +image.pullPolicy | Optional | CIS Controller image pull policy | Always +image.pullSecrets | Optional | List of secrets of container registry to pull image | empty +version | Optional | CIS Controller image tag | latest +nodeSelector | Optional | dictionary of Node selector labels | empty +tolerations | Optional | Array of labels | empty +limits_cpu | Optional | CPU limits for the pod | 100m +limits_memory | Optional | Memory limits for the pod | 512Mi +requests_cpu | Optional | CPU request for the pod | 100m +requests_memory | Optional | Memory request for the pod | 512Mi +affinity | Optional | Dictionary of affinity | empty +securityContext | Optional | Dictionary of deployment pod securityContext. Set to `none` to disable (useful on OpenShift). See [Disabling securityContext](#disabling-securitycontext) | If not set, defaults to runAsUser=1000, runAsGroup=1000, fsGroup=1000 +podSecurityContext | Optional | Dictionary of container-level securityContext for Pod Security Admission and Pod Security Standards | empty +ingressClass.ingressClassName | Optional | Name of ingress class | f5 +ingressClass.isDefaultIngressController | Optional | CIS will monitor all the ingresses resource if set true | false +ingressClass.create | Optional | Create ingress class | true + +Note: bigip_login_secret and bigip_secret are mutually exclusive, if both are defined in values.yaml file bigip_secret will be given priority. + + +See the CIS documentation for a full list of args supported for CIS [CIS Configuration Options](https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html) + +> **Note:** Helm value names cannot include the character `-` which is commonly used in the names of parameters passed to the controller. To accomodate Helm, the parameter names in `values.yaml` use `_` and then replace them with `-` when rendering. +> e.g. `args.bigip_url` is rendered as `bigip-url` as required by the CIS Controller. + + +If you have a specific use case for F5 products in the Kubernetes environment that would benefit from a curated chart, please [open an issue](https://github.com/F5Networks/charts/issues) describing your use case and providing example resources. + +## Disabling securityContext + +By default, the chart applies a pod-level `securityContext` with `runAsUser: 1000`, `runAsGroup: 1000`, and `fsGroup: 1000`. On OpenShift, the Security Context Constraints (SCC) automatically manage these values, so you may need to disable the chart's `securityContext` to avoid conflicts. + +To disable `securityContext`, use any of the following methods: + +**In values.yaml:** +```yaml +securityContext: none +``` + +**Via Helm CLI:** +```shell +helm install f5-stable/f5-bigip-ctlr --set securityContext=none -f values.yaml +``` + +**Via OpenShift Operator CR:** +```yaml +apiVersion: cis.f5.com/v1 +kind: F5BigIpCtlr +metadata: + name: f5bigipctlr-sample +spec: + securityContext: none + # ... other spec fields +``` + +Accepted disable values: `none`, `false`, `no`, `disable`, or an empty map `{}`. + +To customize specific fields: +```yaml +securityContext: + runAsUser: 2000 + runAsGroup: 3000 + fsGroup: 4000 +``` + +Any omitted fields will fall back to the default value of `1000`. + +## Upgrading CIS with Helm and CRDs + +For upgrades that use CIS Custom Resources (for example VirtualServer, TransportServer, Policy, TLSProfile, IngressLink), update CRDs before running `helm upgrade`. + +```shell + export CIS_VERSION= + # For example + # export CIS_VERSION=v2.12.0 + # or + # export CIS_VERSION=2.x-master + # + # the latter if using a CIS image with :latest label + + kubectl create -f https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/${CIS_VERSION}/docs/config_examples/customResourceDefinitions/customresourcedefinitions.yml + + # Then upgrade Helm release + helm upgrade f5-stable/f5-bigip-ctlr -f values.yaml +``` + +Notes: + +- The chart does not automatically manage CRD upgrades during `helm upgrade`. +- Helm hook-based CRD auto-upgrade is not currently provided or supported in this chart. +- If you are not using CIS CRDs, CRD update can be skipped. + +## Uninstalling Helm Chart +Run the following command to uninstall the chart. +```helm uninstall ``` + +Note: When rbac.namespaced=true the chart: +- Skips the default broad ClusterRole/Binding. +- Creates a minimal cluster-scope ClusterRole granting get/list/watch on nodes, namespaces, ingressclasses (and CRDs if ipam enabled). +- Creates a limited Role in the controller namespace (configmaps + secrets only). +- Creates Roles/RoleBindings in each args.namespaces granting required namespace-scoped permissions. diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr-0.0.38.tgz b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr-0.0.38.tgz new file mode 100644 index 00000000..a64f7328 Binary files /dev/null and b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr-0.0.38.tgz differ diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/.helmignore b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/.helmignore new file mode 100644 index 00000000..f0c13194 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/Chart.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/Chart.yaml new file mode 100644 index 00000000..d1611754 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +description: Deploy the F5 Networks BIG-IP Controller for Kubernetes and OpenShift (k8s-bigip-ctlr). +icon: https://helm.sh/img/helm.svg +name: f5-bigip-ctlr +version: 0.0.38 diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/RBAC-UPGRADE-GUIDE.md b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/RBAC-UPGRADE-GUIDE.md new file mode 100644 index 00000000..5b6ed6c7 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/RBAC-UPGRADE-GUIDE.md @@ -0,0 +1,177 @@ +# Upgrading from Cluster-wide RBAC to Namespaced RBAC + +## Overview + +When upgrading F5 BIG-IP Controller and switching from cluster-wide RBAC (`rbac.namespaced: false`) to namespaced RBAC (`rbac.namespaced: true`), you need to manually clean up the old cluster-wide RBAC resources to maintain the principle of least privilege. + +## Why Manual Cleanup is Required + +Helm does not automatically remove resources when their conditional statements change. When you switch to namespaced RBAC: + +- **Old resources persist**: The original ClusterRole and ClusterRoleBinding remain in the cluster +- **New resources are created**: Namespaced Roles/RoleBindings and minimal ClusterRole are created +- **Security concern**: The controller retains broader permissions than intended +- **Resource clutter**: Unused RBAC resources remain in the cluster + +## Pre-Upgrade Cleanup Steps + +### 1. Identify Resources to Clean Up + +Before upgrading, identify the current cluster-wide RBAC resources: + +```bash +# Replace with your actual Helm release name +RELEASE_NAME="" + +# List current ClusterRole +kubectl get clusterrole | grep $RELEASE_NAME + +# List current ClusterRoleBinding +kubectl get clusterrolebinding | grep $RELEASE_NAME +``` + +### 2. Backup Current RBAC Configuration (Optional) + +```bash +# Backup ClusterRole +kubectl get clusterrole $RELEASE_NAME -o yaml > clusterrole-backup.yaml + +# Backup ClusterRoleBinding +kubectl get clusterrolebinding $RELEASE_NAME -o yaml > clusterrolebinding-backup.yaml +``` + +### 3. Clean Up Old Resources + +**Important**: Perform this cleanup BEFORE upgrading to avoid permission conflicts. + +```bash +# Delete ClusterRoleBinding first to avoid permission issues +kubectl delete clusterrolebinding $RELEASE_NAME + +# Delete ClusterRole +kubectl delete clusterrole $RELEASE_NAME +``` + +### 4. Upgrade with Namespaced RBAC + +```bash +# Upgrade with namespaced RBAC enabled +helm upgrade $RELEASE_NAME f5networks/f5-bigip-ctlr \ + --set rbac.namespaced=true \ + --set args.namespaces='["namespace1","namespace2"]' \ + --set args.bigip_url= \ + [other-parameters] +``` + +## Post-Upgrade Verification + +### 1. Verify Old Resources are Gone + +```bash +# Should return no results +kubectl get clusterrole $RELEASE_NAME +kubectl get clusterrolebinding $RELEASE_NAME +``` + +### 2. Verify New Namespaced Resources + +```bash +# Check minimal cluster-scope resources +kubectl get clusterrole ${RELEASE_NAME}-clusterscope +kubectl get clusterrolebinding ${RELEASE_NAME}-clusterscope + +# Check namespaced roles (replace with your actual namespaces) +kubectl get role -n namespace1 | grep $RELEASE_NAME +kubectl get rolebinding -n namespace1 | grep $RELEASE_NAME + +# If IPAM is enabled, check IPAM namespace permissions +kubectl get role -n kube-system | grep ipam +kubectl get rolebinding -n kube-system | grep ipam +``` + +### 3. Verify Controller Functionality + +```bash +# Check controller pod status +kubectl get pods -n | grep $RELEASE_NAME + +# Check controller logs for permission errors +kubectl logs -n deployment/$RELEASE_NAME +``` + +## Troubleshooting + +### Permission Denied Errors + +If you see permission-related errors in the controller logs: + +1. **Check namespaces configuration**: Ensure `args.namespaces` includes all required namespaces +2. **Verify IPAM permissions**: If using IPAM, ensure IPAM namespace has proper Role/RoleBinding +3. **Check cluster-scope permissions**: Verify minimal cluster-scope resources were created + +### Rolling Back + +If you need to revert to cluster-wide RBAC: + +```bash +# Upgrade back to cluster-wide RBAC +helm upgrade $RELEASE_NAME f5networks/f5-bigip-ctlr \ + --set rbac.namespaced=false \ + [other-parameters] + +# Clean up namespaced resources if needed +kubectl delete role $RELEASE_NAME-namespace1 -n namespace1 +kubectl delete rolebinding $RELEASE_NAME-namespace1 -n namespace1 +# Repeat for other namespaces +``` + +## IPAM Considerations + +When using IPAM with namespaced RBAC: + +- IPAM CRs are created in the namespace specified by `--ipam-namespace` (defaults to `kube-system`) +- Ensure the `args.ipam_namespace` value in your Helm values matches your CIS configuration +- The chart automatically creates appropriate IPAM namespace permissions + +## Example Complete Upgrade Process + +```bash +# 1. Set variables +RELEASE_NAME="my-f5-controller" +NAMESPACES='["app1","app2","app3"]' +BIGIP_URL="https://192.168.1.100" + +# 2. Backup and clean up old resources +kubectl get clusterrole $RELEASE_NAME -o yaml > clusterrole-backup.yaml +kubectl get clusterrolebinding $RELEASE_NAME -o yaml > clusterrolebinding-backup.yaml +kubectl delete clusterrolebinding $RELEASE_NAME +kubectl delete clusterrole $RELEASE_NAME + +# 3. Upgrade to namespaced RBAC +helm upgrade $RELEASE_NAME f5networks/f5-bigip-ctlr \ + --set rbac.namespaced=true \ + --set args.namespaces=$NAMESPACES \ + --set args.bigip_url=$BIGIP_URL \ + --set args.ipam=true \ + --set args.ipam_namespace=kube-system + +# 4. Verify upgrade +kubectl get clusterrole ${RELEASE_NAME}-clusterscope +kubectl get role -A | grep $RELEASE_NAME +kubectl logs -n kube-system deployment/$RELEASE_NAME +``` + +## Security Benefits + +After successful migration to namespaced RBAC: + +- **Principle of least privilege**: Controller only has permissions for specified namespaces +- **Reduced attack surface**: No cluster-wide permissions for most resources +- **Better compliance**: Easier to audit and meet security requirements +- **Namespace isolation**: Clear boundary of controller permissions + +## Additional Resources + +- [F5 CIS RBAC Documentation](https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#cis-installation) +- [Kubernetes RBAC Best Practices](https://kubernetes.io/docs/concepts/security/rbac-good-practices/) +- [Helm Upgrade Documentation](https://helm.sh/docs/helm/helm_upgrade/) diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/README.md b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/README.md new file mode 100644 index 00000000..4c8f1c1a --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/README.md @@ -0,0 +1,161 @@ +# Helm Chart for the F5 Container Ingress Services + +This chart simplifies repeatable, versioned deployment of the [Container Ingress Services](https://clouddocs.f5.com/containers/latest/). + +### Prerequisites +- Refer to [CIS Prerequisites](https://clouddocs.f5.com/containers/latest/userguide/cis-helm.html#prerequisites) to install Container Ingress Services on Kubernetes or Openshift +- [Helm 3](https://helm.sh/docs/intro/) should be installed. + + +## Installing CIS Using Helm Charts + +This is the simplest way to install the CIS on OpenShift/Kubernetes cluster. Helm is a package manager for Kubernetes. Helm is Kubernetes version of yum or apt. Helm deploys something called charts, which you can think of as a packaged application. It is a collection of all your versioned, pre-configured application resources which can be deployed as one unit. This chart creates a Deployment for one Pod containing the [k8s-bigip-ctlr](https://clouddocs.f5.com/containers/latest/), it's supporting RBAC, Service Account and Custom Resources Definition installations. + +## Installing the Chart + +- (Optional) Add BIG-IP credentials as K8S secrets. + +For Kubernetes, use the following command: + +```kubectl create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=``` + +For OpenShift, use the following command: + +```oc create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=``` + +- Add the CIS chart repository in Helm using following command: + +```helm repo add f5-stable https://f5networks.github.io/charts/stable``` + +- Create values.yaml as shown in [examples](https://github.com/F5Networks/charts/tree/master/example_values/f5-bigip-ctlr): + +- Install the Helm chart if BIGIP credential secrets created manually using the following command: + +```helm install -f values.yaml f5-stable/f5-bigip-ctlr``` + +- Install the Helm chart with skip crds if BIGIP credential secrets created manually (without custom resource definitions installations) + +```helm install --skip-crds -f values.yaml f5-stable/f5-bigip-ctlr``` + +- If you want to create the BIGIP credential secret with helm charts use the following command: + +```helm install --set bigip_secret.create="true" --set bigip_secret.username=$BIGIP_USERNAME --set bigip_secret.password=$BIGIP_PASSWORD -f values.yaml f5-stable/f5-bigip-ctlr``` + +## Chart parameters: + +Parameter | Required | Description | Default +----------|-------------|-------------|-------- +bigip_login_secret | Optional | Secret that contains BIG-IP login credentials | f5-bigip-ctlr-login +args.bigip_url | Required | The management IP for your BIG-IP device | **Required**, no default +args.bigip_partition | Required | BIG-IP partition the CIS Controller will manage | f5-bigip-ctlr +args.namespaces | Optional | List of Kubernetes namespaces which CIS will monitor | empty +bigip_secret.create | Optional | Create kubernetes secret using username and password | false +bigip_secret.username | Optional | bigip username to create the kubernetes secret | empty +bigip_secret.password | Optional | bigip password to create the kubernetes secret | empty +rbac.create | Optional | Create ClusterRole and ClusterRoleBinding | true +rbac.namespaced | Optional | Enable namespaced RBAC: per-namespace Roles plus a minimal cluster-scope Role (nodes, namespaces, ingressclasses) | false +serviceAccount.name | Optional | name of the ServiceAccount for CIS controller | f5-bigip-ctlr-serviceaccount +serviceAccount.create | Optional | Create service account for the CIS controller | true +namespace | Optional | name of namespace CIS will use to create deployment and other resources | kube-system +image.user | Optional | CIS Controller image repository username | f5networks +image.repo | Optional | CIS Controller image repository name | k8s-bigip-ctlr +image.pullPolicy | Optional | CIS Controller image pull policy | Always +image.pullSecrets | Optional | List of secrets of container registry to pull image | empty +version | Optional | CIS Controller image tag | latest +nodeSelector | Optional | dictionary of Node selector labels | empty +tolerations | Optional | Array of labels | empty +limits_cpu | Optional | CPU limits for the pod | 100m +limits_memory | Optional | Memory limits for the pod | 512Mi +requests_cpu | Optional | CPU request for the pod | 100m +requests_memory | Optional | Memory request for the pod | 512Mi +affinity | Optional | Dictionary of affinity | empty +securityContext | Optional | Dictionary of deployment pod securityContext. Set to `none` to disable (useful on OpenShift). See [Disabling securityContext](#disabling-securitycontext) | If not set, defaults to runAsUser=1000, runAsGroup=1000, fsGroup=1000 +podSecurityContext | Optional | Dictionary of container-level securityContext for Pod Security Admission and Pod Security Standards | empty +ingressClass.ingressClassName | Optional | Name of ingress class | f5 +ingressClass.isDefaultIngressController | Optional | CIS will monitor all the ingresses resource if set true | false +ingressClass.create | Optional | Create ingress class | true + +Note: bigip_login_secret and bigip_secret are mutually exclusive, if both are defined in values.yaml file bigip_secret will be given priority. + + +See the CIS documentation for a full list of args supported for CIS [CIS Configuration Options](https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html) + +> **Note:** Helm value names cannot include the character `-` which is commonly used in the names of parameters passed to the controller. To accomodate Helm, the parameter names in `values.yaml` use `_` and then replace them with `-` when rendering. +> e.g. `args.bigip_url` is rendered as `bigip-url` as required by the CIS Controller. + + +If you have a specific use case for F5 products in the Kubernetes environment that would benefit from a curated chart, please [open an issue](https://github.com/F5Networks/charts/issues) describing your use case and providing example resources. + +## Disabling securityContext + +By default, the chart applies a pod-level `securityContext` with `runAsUser: 1000`, `runAsGroup: 1000`, and `fsGroup: 1000`. On OpenShift, the Security Context Constraints (SCC) automatically manage these values, so you may need to disable the chart's `securityContext` to avoid conflicts. + +To disable `securityContext`, use any of the following methods: + +**In values.yaml:** +```yaml +securityContext: none +``` + +**Via Helm CLI:** +```shell +helm install f5-stable/f5-bigip-ctlr --set securityContext=none -f values.yaml +``` + +**Via OpenShift Operator CR:** +```yaml +apiVersion: cis.f5.com/v1 +kind: F5BigIpCtlr +metadata: + name: f5bigipctlr-sample +spec: + securityContext: none + # ... other spec fields +``` + +Accepted disable values: `none`, `false`, `no`, `disable`, or an empty map `{}`. + +To customize specific fields: +```yaml +securityContext: + runAsUser: 2000 + runAsGroup: 3000 + fsGroup: 4000 +``` + +Any omitted fields will fall back to the default value of `1000`. + +## Upgrading CIS with Helm and CRDs + +For upgrades that use CIS Custom Resources (for example VirtualServer, TransportServer, Policy, TLSProfile, IngressLink), update CRDs before running `helm upgrade`. + +```shell + export CIS_VERSION= + # For example + # export CIS_VERSION=v2.12.0 + # or + # export CIS_VERSION=2.x-master + # + # the latter if using a CIS image with :latest label + + kubectl create -f https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/${CIS_VERSION}/docs/config_examples/customResourceDefinitions/customresourcedefinitions.yml + + # Then upgrade Helm release + helm upgrade f5-stable/f5-bigip-ctlr -f values.yaml +``` + +Notes: + +- The chart does not automatically manage CRD upgrades during `helm upgrade`. +- Helm hook-based CRD auto-upgrade is not currently provided or supported in this chart. +- If you are not using CIS CRDs, CRD update can be skipped. + +## Uninstalling Helm Chart +Run the following command to uninstall the chart. +```helm uninstall ``` + +Note: When rbac.namespaced=true the chart: +- Skips the default broad ClusterRole/Binding. +- Creates a minimal cluster-scope ClusterRole granting get/list/watch on nodes, namespaces, ingressclasses (and CRDs if ipam enabled). +- Creates a limited Role in the controller namespace (configmaps + secrets only). +- Creates Roles/RoleBindings in each args.namespaces granting required namespace-scoped permissions. diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/crds/f5-bigip-ctlr-customresourcedefinitions.yml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/crds/f5-bigip-ctlr-customresourcedefinitions.yml new file mode 100644 index 00000000..3115a5c8 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/crds/f5-bigip-ctlr-customresourcedefinitions.yml @@ -0,0 +1,1589 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: virtualservers.cis.f5.com +spec: + group: cis.f5.com + names: + kind: VirtualServer + plural: virtualservers + shortNames: + - vs + singular: virtualserver + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + partition: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.]+$' + host: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + hostAliases: + type: array + items: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + hostGroup: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]*[A-z0-9]*$' + hostGroupVirtualServerName: + type: string + pattern: '^[a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$' + httpTraffic: + type: string + enum: [allow, none, redirect] + ipamLabel: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + bigipRouteDomain: + type: integer + minimum: 0 + maximum: 65535 + default: 0 + snat: + type: string + pattern: '^$|^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)+$' + connectionMirroring: + type: string + enum: [ none, L4 ] + tlsProfileName: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + tlsProfileNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + persistenceProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + httpCompressionProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + hostPersistence: + type: object + properties: + method: + type: string + enum: [ sourceAddress, destinationAddress, cookieInsert, cookieRewrite, cookiePassive, cookieHash, universal, hash, carp, none ] + metaData: + type: object + properties: + name: + type: string + key: + type: string + netmask: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + timeout: + type: integer + minimum: 1 + maximum: 65535 + offset: + type: integer + minimum: 1 + maximum: 65535 + length: + type: integer + minimum: 1 + maximum: 65535 + expiry: + type: string + pattern: '^((?:(?:[0-9]+d))|(?:(?:[0-9]+d)?((?:[01]?[0-9]|2[0-3]):[0-5][0-9](?::[0-5][0-9])?)))$' + required: + - method + htmlProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profiles: + type: object + properties: + tcp: + type: object + properties: + client: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + server: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + http2: + type: object + properties: + client: + type: string + pattern: ^(\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*)?$ + server: + type: string + pattern: ^(\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*)?$ + profileProtocolInspection: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + dos: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAccess: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileApiProtection: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + policyPerRequestAccess: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + botDefense: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + policyName: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + policyNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + rewriteAppRoot: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)*([-A-z0-9_.:]+\/?)*$' + waf: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAnalyticsTcp: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileMultiplex: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAdapt: + type: object + properties: + request: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + response: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + allowVlans: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.]+\/?)*$' + type: array + allowSourceRange: + items: + type: string + type: array + httpMrfRoutingEnabled: + type: boolean + iRules: + type: array + items: + type: string + pattern: '^none$|^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + serviceAddress: + type: array + maxItems: 1 + items: + type: object + properties: + arpEnabled: + type: boolean + icmpEcho: + type: string + enum: [enable, disable, selective] + routeAdvertisement: + type: string + enum: [enable, disable, selective, always, any, all] + spanningEnabled: + type: boolean + trafficGroup: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + defaultPool: + type: object + properties: + name: + type: string + pattern: '^([a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$|\/[a-zA-Z]+([A-z0-9-._+]+\/)+([-A-z0-9_.:]+\/?)*$)' + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + loadBalancingMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + nodeMemberLabel: + type: string + pattern: '^[a-zA-Z0-9][-A-Za-z0-9_.\/]{0,61}[a-zA-Z0-9]=(\s?|""|[a-zA-Z0-9][-A-Za-z0-9_.]{0,61}[a-zA-Z0-9])$' + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [ tcp, udp, http, https ] + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip ] + send: + type: string + recv: + type: string + sslProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip, service ] + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + staticPoolMembers: + type: array + items: + type: object + properties: + address: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + port: + type: integer + minimum: 1 + maximum: 65535 + required: + - reference + pools: + type: array + items: + type: object + properties: + name: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + path: + type: string + pattern: '^\/([A-z0-9-_+]+\/)*([-A-z0-9_.:]+\/?)*$' + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + weight: + type: integer + minimum: 0 + maximum: 256 + alternateBackends: + type: array + items: + type: object + properties: + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + weight: + type: integer + minimum: 0 + maximum: 256 + staticPoolMembers: + type: array + items: + type: object + properties: + address: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + port: + type: integer + minimum: 1 + maximum: 65535 + required: + - service + loadBalancingMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + nodeMemberLabel: + type: string + pattern: '^[a-zA-Z0-9][-A-Za-z0-9_.\/]{0,61}[a-zA-Z0-9]=(\s?|""|[a-zA-Z0-9][-A-Za-z0-9_.]{0,61}[a-zA-Z0-9])$' + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + rewrite: + type: string + pattern: '^\/([A-z0-9-_+]+\/)*([-A-z0-9_.:]+\/?)*$' + hostRewrite: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + waf: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + monitor: + type: object + properties: + type: + type: string + enum: [http, https, tcp] + send: + type: string + recv: + type: string + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip] + sslProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [ http, https, tcp ] + send: + type: string + recv: + type: string + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip] + sslProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + minimumMonitors: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + multiClusterServices: + type: array + items: + type: object + properties: + clusterName: + type: string + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + namespace: + type: string + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + weight: + type: integer + minimum: 0 + maximum: 256 + required: + - clusterName + - service + - namespace + - servicePort + staticPoolMembers: + type: array + items: + type: object + properties: + address: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + port: + type: integer + minimum: 1 + maximum: 65535 + virtualServerAddress: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + additionalVirtualServerAddresses: + type: array + items: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + virtualServerName: + type: string + pattern: '^[a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$' + virtualServerHTTPPort: + type: integer + minimum: 1 + maximum: 65535 + virtualServerHTTPSPort: + type: integer + minimum: 1 + maximum: 65535 + x-kubernetes-validations: + - rule: "!has(self.partition) || self.partition != 'Common'" + message: "The partition cannot be 'Common' if specified." + - rule: "has(self.partition) == has(oldSelf.partition) && (!has(self.partition) || self.partition == oldSelf.partition)" + message: "partition cannot be modified. Delete the resource and recreate with new partition" + - rule: "!(has(self.serviceAddress) && !has(oldSelf.serviceAddress))" + message: "'serviceAddress' cannot be added when it is not already present." + - rule: "!(has(oldSelf.serviceAddress) && !has(self.serviceAddress))" + message: "'serviceAddress' cannot be deleted when it is present." + - rule: "has(self.ipamLabel) || has(self.virtualServerAddress)" + message: "either ipamLabel or virtualServerAddress needs to be specified." + status: + type: object + properties: + vsAddress: + type: string + default: None + status: + type: string + default: Pending + lastUpdated: + type: string + error: + type: string + additionalPrinterColumns: + - name: host + type: string + description: hostname + jsonPath: .spec.host + - name: tlsProfileName + type: string + description: TLS Profile attached + jsonPath: .spec.tlsProfileName + - name: httpTraffic + type: string + description: Http Traffic Termination + jsonPath: .spec.httpTraffic + - name: IPAddress + type: string + description: IP address of virtualServer + jsonPath: .spec.virtualServerAddress + - name: ipamLabel + type: string + description: ipamLabel for virtual server + jsonPath: .spec.ipamLabel + - name: IPAMVSAddress + type: string + description: IP address of virtualServer + jsonPath: .status.vsAddress + - name: STATUS + type: string + description: status of VirtualServer + jsonPath: .status.status + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: tlsprofiles.cis.f5.com +spec: + group: cis.f5.com + names: + kind: TLSProfile + plural: tlsprofiles + shortNames: + - tls + singular: tlsprofile + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + tlsCipher: + type: object + properties: + tlsVersion: + type: string + enum: ["1.0", "1.1", "1.2", "1.3"] + disableTLSVersions: + type: array + items: + type: string + enum: ["1.0", "1.1", "1.2", "1.3"] + ciphers: + type: string + cipherGroup: + type: string + hosts: + type: array + items: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + tls: + type: object + properties: + termination: + type: string + enum: [edge, reencrypt, passthrough] + clientSSL: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + clientSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + serverSSL: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + serverSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip, secret, hybrid] + clientSSLParams: + type: object + properties: + renegotiationEnabled: + type: boolean + default: true + profileReference: + type: string + enum: [ bigip, secret ] + dtlsEnabled: + type: boolean + default: true + singleUseDhEnabled: + type: boolean + default: false + serverSSLParams: + type: object + properties: + serverName: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + renegotiationEnabled: + type: boolean + default: true + profileReference: + type: string + enum: [ bigip, secret ] + dtlsEnabled: + type: boolean + default: true + singleUseDhEnabled: + type: boolean + default: false + required: + - termination + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: transportservers.cis.f5.com +spec: + group: cis.f5.com + names: + kind: TransportServer + plural: transportservers + shortNames: + - ts + singular: transportserver + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + partition: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.]+$' + virtualServerAddress: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + virtualServerPort: + type: integer + minimum: 1 + maximum: 65535 + virtualServerName: + type: string + pattern: '^[a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$' + host: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + hostGroup: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]*[A-z0-9]*$' + policyName: + type: string + pattern: '^([A-z0-9-_+])*([A-z0-9])$' + policyNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + mode: + type: string + enum: [standard, performance] + type: + type: string + enum: [tcp, udp, sctp] + default: tcp + tls: + type: object + properties: + clientSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + serverSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip, secret] + snat: + type: string + pattern: '^$|^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)+$' + connectionMirroring: + type: string + enum: [ none, L4 ] + profiles: + type: object + properties: + tcp: + type: object + properties: + client: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + server: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileProtocolInspection: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + persistenceProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + profileAnalyticsTcp: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + dos: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileL4: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + allowVlans: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.]+\/?)*$' + type: array + iRules: + type: array + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + ipamLabel: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + bigipRouteDomain: + type: integer + minimum: 0 + maximum: 65535 + default: 0 + serviceAddress: + type: array + maxItems: 1 + items: + type: object + properties: + arpEnabled: + type: boolean + icmpEcho: + type: string + enum: [enable, disable, selective] + routeAdvertisement: + type: string + enum: [enable, disable, selective, always, any, all] + spanningEnabled: + type: boolean + trafficGroup: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + pool: + type: object + properties: + name: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + weight: + type: integer + minimum: 0 + maximum: 100 + alternateBackends: + type: array + items: + type: object + properties: + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + weight: + type: integer + minimum: 0 + maximum: 100 + required: + - service + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + loadBalancingMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + nodeMemberLabel: + type: string + pattern: '^[a-zA-Z0-9][-A-Za-z0-9_.\/]{0,61}[a-zA-Z0-9]=(\s?|""|[a-zA-Z0-9][-A-Za-z0-9_.]{0,61}[a-zA-Z0-9])$' + monitor: + type: object + properties: + type: + type: string + enum: [tcp, udp, http, https] + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip] + send: + type: string + recv: + type: string + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [ tcp, udp, http, https ] + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip] + send: + type: string + recv: + type: string + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + multiClusterServices: + type: array + items: + type: object + properties: + clusterName: + type: string + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + namespace: + type: string + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + weight: + type: integer + minimum: 0 + maximum: 100 + required: + - clusterName + - service + - namespace + - servicePort + required: + - virtualServerPort + - pool + - mode + x-kubernetes-validations: + - rule: "!has(self.partition) || self.partition != 'Common'" + message: "The partition cannot be 'Common' if specified." + - rule: "has(self.partition) == has(oldSelf.partition) && (!has(self.partition) || self.partition == oldSelf.partition)" + message: "partition cannot be modified. Delete the resource and recreate with new partition" + - rule: "!(has(self.serviceAddress) && !has(oldSelf.serviceAddress))" + message: "'serviceAddress' cannot be added when it is not already present." + - rule: "!(has(oldSelf.serviceAddress) && !has(self.serviceAddress))" + message: "'serviceAddress' cannot be deleted when it is present." + - rule: "has(self.ipamLabel) || has(self.virtualServerAddress)" + message: "either ipamLabel or virtualServerAddress needs to be specified." + status: + type: object + properties: + vsAddress: + type: string + default: None + status: + type: string + default: Pending + lastUpdated: + type: string + error: + type: string + additionalPrinterColumns: + - name: virtualServerAddress + type: string + description: IP address of virtualServer + jsonPath: .spec.virtualServerAddress + - name: virtualServerPort + type: integer + description: Port of virtualServer + jsonPath: .spec.virtualServerPort + - name: pool + type: string + description: Name of service + jsonPath: .spec.pool.service + - name: poolPort + type: string + description: Port of service + jsonPath: .spec.pool.servicePort + - name: ipamLabel + type: string + description: ipamLabel for transport server + jsonPath: .spec.ipamLabel + - name: IPAMVSAddress + type: string + description: IP address of transport server + jsonPath: .status.vsAddress + - name: STATUS + type: string + description: status of TransportServer + jsonPath: .status.status + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + subresources: + status: { } +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: externaldnses.cis.f5.com +spec: + group: cis.f5.com + names: + kind: ExternalDNS + plural: externaldnses + shortNames: + - edns + singular: externaldns + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + domainName: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + dnsRecordType: + type: string + pattern: 'A' + loadBalanceMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + clientSubnetPreferred: + type: boolean + persistenceEnabled: + type: boolean + persistCidrIpv4: + type: integer + minimum: 0 + maximum: 32 + persistCidrIpv6: + type: integer + minimum: 0 + maximum: 128 + ttlPersistence: + type: integer + format: int64 + minimum: 0 + maximum: 4294967295 + pools: + type: array + items: + type: object + properties: + dataServerName: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + dnsRecordType: + type: string + pattern: 'A' + loadBalanceMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + lbModeFallback: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + order: + type: integer + ratio: + type: integer + monitor: + type: object + properties: + type: + type: string + enum: [http, https, tcp] + send: + type: string + recv: + type: string + interval: + type: integer + timeout: + type: integer + required: + - type + - interval + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [http, https, tcp] + send: + type: string + recv: + type: string + interval: + type: integer + timeout: + type: integer + required: + - type + - interval + required: + - dataServerName + required: + - domainName + additionalPrinterColumns: + - name: domainName + type: string + description: Domain name of virtual server resource + jsonPath: .spec.domainName + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + - name: CREATED ON + type: string + jsonPath: .metadata.creationTimestamp +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: ingresslinks.cis.f5.com +spec: + group: cis.f5.com + names: + kind: IngressLink + shortNames: + - il + singular: ingresslink + plural: ingresslinks + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + partition: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.]+$' + virtualServerAddress: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$' + virtualServerName: + type: string + pattern: '^[a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$' + host: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + ipamLabel: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + bigipRouteDomain: + type: integer + minimum: 0 + maximum: 65535 + default: 0 + iRules: + type: array + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + monitors: + type: array + items: + type: object + properties: + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip ] + tls: + type: object + properties: + clientSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + serverSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip, secret ] + multiClusterServices: + type: array + items: + type: object + properties: + clusterName: + type: string + namespace: + type: string + service: + type: string + weight: + type: integer + minimum: 0 + maximum: 256 + required: + - clusterName + - namespace + - service + selector: + properties: + matchLabels: + additionalProperties: + type: string + type: object + type: object + serviceAddress: + type: array + maxItems: 1 + items: + type: object + properties: + arpEnabled: + type: boolean + icmpEcho: + type: string + enum: [enable, disable, selective] + routeAdvertisement: + type: string + enum: [enable, disable, selective, always, any, all] + spanningEnabled: + type: boolean + trafficGroup: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + x-kubernetes-validations: + - rule: "!has(self.partition) || self.partition != 'Common'" + message: "The partition cannot be 'Common' if specified." + - rule: "has(self.partition) == has(oldSelf.partition) && (!has(self.partition) || self.partition == oldSelf.partition)" + message: "partition cannot be modified. Delete the resource and recreate with new partition" + - rule: "has(self.ipamLabel) || has(self.virtualServerAddress)" + message: "either ipamLabel or virtualServerAddress needs to be specified." + status: + type: object + properties: + vsAddress: + type: string + status: + type: string + default: pending + lastUpdated: + type: string + error: + type: string + additionalPrinterColumns: + - name: IPAMVSAddress + type: string + description: IP address of virtualServer + jsonPath: .status.vsAddress + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + subresources: + status: { } +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: policies.cis.f5.com +spec: + group: cis.f5.com + names: + kind: Policy + shortNames: + - plc + singular: policy + plural: policies + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + l7Policies: + type: object + properties: + profileApiProtection: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + waf: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAccess: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + policyPerRequestAccess: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAdapt: + type: object + properties: + request: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + response: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + l3Policies: + type: object + properties: + dos: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + botDefense: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + firewallPolicy: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([A-z0-9]+\/?)*$' + ipIntelligencePolicy: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + allowSourceRange: + items: + type: string + type: array + allowVlans: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)*([A-z0-9-_.\s]+\/?)*$' + type: array + ltmPolicies: + type: object + properties: + insecure: + type: string + pattern: '^\/[a-zA-Z]+([-A-z0-9_+:]+\/)+([A-z0-9]+\/?)*$' + secure: + type: string + pattern: '^\/[a-zA-Z]+([-A-z0-9_+:]+\/)+([A-z0-9]+\/?)*$' + priority: + type: string + enum: [low, high] + iRules: + type: object + properties: + insecure: + type: string + pattern: '^none$|^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + secure: + type: string + pattern: '^none$|^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + priority: + type: string + enum: [ low, high ] + iRuleList: + type: array + items: + type: string + pattern: '^none$|^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + defaultPool: + type: object + properties: + name: + type: string + pattern: '^([a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$|\/[a-zA-Z]+([A-z0-9-._+]+\/)+([-A-z0-9_.:]+\/?)*$)' + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + loadBalancingMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + nodeMemberLabel: + type: string + pattern: '^[a-zA-Z0-9][-A-Za-z0-9_.\/]{0,61}[a-zA-Z0-9]=(\s?|""|[a-zA-Z0-9][-A-Za-z0-9_.]{0,61}[a-zA-Z0-9])$' + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [ tcp, udp, http, https ] + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip ] + send: + type: string + recv: + type: string + sslProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip, service ] + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + staticPoolMembers: + type: array + items: + type: object + properties: + address: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + port: + type: integer + minimum: 1 + maximum: 65535 + required: + - reference + profiles: + type: object + properties: + tcp: + type: object + properties: + client: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + server: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + udp: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + http: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + httpProfiles: + type: object + properties: + insecure: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + secure: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + http2: + type: object + properties: + client: + type: string + pattern: ^(\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*)?$ + server: + type: string + pattern: ^(\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*)?$ + persistenceProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + profileAnalyticsTcp: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileL4: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileWebSocket: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileMultiplex: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + rewriteProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([A-z0-9]+\/?)*$' + logProfiles: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)*([-A-z0-9._\s]+\/?)*$' + type: array + requestLogProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + httpMrfRoutingEnabled: + type: boolean + sslProfiles: + type: object + properties: + clientProfiles: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + type: array + serverProfiles: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + type: array + analyticsProfiles: + type: object + properties: + http: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + htmlProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + ftpProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + httpCompressionProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileProtocolInspection: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + autoLastHop: + type: string + enum: [ default, auto, disable ] + snat: + type: string + pattern: '^$|^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)+$' + poolSettings: + type: object + properties: + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + slowRampTime: + type: integer + minimum: 0 + maximum: 900 + multiPoolPersistence: + type: object + properties: + method: + type: string + enum: [ uieSourceAddress, hashSourceAddress ] + timeOut: + type: integer + minimum: 1 + default: 180 diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/NOTES.txt b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/NOTES.txt new file mode 100644 index 00000000..302512a9 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/NOTES.txt @@ -0,0 +1,6 @@ +Container Ingress Services controller: {{ .Release.Name }} + +Controller Documentation: +- Kubernetes: https://clouddocs.f5.com/containers/latest/userguide/kubernetes/ +- OpenShift: https://clouddocs.f5.com/containers/latest/userguide/openshift/ + diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/_helpers.tpl b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/_helpers.tpl new file mode 100644 index 00000000..7ce05d2e --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/_helpers.tpl @@ -0,0 +1,64 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "f5-bigip-ctlr.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "deployment.apiVersion" -}} +{{- if semverCompare ">=1.9-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "apps/v1" -}} +{{- else -}} +{{- print "extensions/v1beta1" -}} +{{- end -}} +{{- end -}} + +{{/* +Check for user given namespace or give kube-system +*/}} +{{- define "f5-bigip-ctlr.namespace" -}} +{{- if hasKey .Values "namespace" -}} +{{- .Values.namespace -}} +{{- else -}} +{{- print "kube-system" -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "f5-bigip-ctlr.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "f5-bigip-ctlr.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + + {{/* +Create the name of the service account to use +*/}} +{{- define "f5-bigip-ctlr.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "f5-bigip-ctlr.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrole.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrole.yaml new file mode 100644 index 00000000..16a753f4 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrole.yaml @@ -0,0 +1,119 @@ +{{- if and .Values.rbac.create (not .Values.rbac.namespaced) -}} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "f5-bigip-ctlr.fullname" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: + - '' + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - nodes + - services + - endpoints + - namespaces + - ingresses + - pods + - ingressclasses + - policies + - routes + verbs: + - get + - list + - watch + - apiGroups: + - '' + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - events + - ingresses/status + - services/status + - routes/status + verbs: + - get + - list + - watch + - update + - create + - patch + - apiGroups: + - cis.f5.com + resources: + - virtualservers + - virtualservers/status + - tlsprofiles + - transportservers + - transportservers/status + - ingresslinks + - ingresslinks/status + - externaldnses + - policies + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - '' + - extensions + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - config.openshift.io/v1 + resources: + - network + verbs: + - list + - apiGroups: + - crd.projectcalico.org + resources: + - blockaffinities + verbs: + - get + - watch + - list +{{- if .Values.args.ipam }} + - apiGroups: + - fic.f5.com + resources: + - ipams + - ipams/status + verbs: + - get + - list + - watch + - update + - create + - patch + - delete + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - update + - create + - patch +{{- end }} +{{- end }} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrolebinding.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrolebinding.yaml new file mode 100644 index 00000000..3836caff --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrolebinding.yaml @@ -0,0 +1,23 @@ +{{- if and .Values.rbac.create (not .Values.rbac.namespaced) -}} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "f5-bigip-ctlr.fullname" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "f5-bigip-ctlr.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "f5-bigip-ctlr.serviceAccountName" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} +{{- end -}} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-deploy.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-deploy.yaml new file mode 100644 index 00000000..a7b778a6 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-deploy.yaml @@ -0,0 +1,181 @@ +{{- if or (not .Values.args.bigip_url) (not .Values.args.bigip_partition) }} +{{/* +Generate errors for missing required values. +*/}} +# {{required "BIG-IP url not specified - add to Values or pass with `--set` " .Values.args.bigip_url }} +# {{required "BIG-IP partition not specified - add to Values or pass with `--set` " .Values.args.bigip_partition }} +{{- else -}} +apiVersion: {{ template "deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "f5-bigip-ctlr.fullname" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "-" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: 1 + selector: + matchLabels: + app: {{ template "f5-bigip-ctlr.name" . }} + template: + metadata: + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + release: {{ .Release.Name }} + spec: +{{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | indent 8 }} +{{- end }} + serviceAccountName: {{ template "f5-bigip-ctlr.serviceAccountName" . }} +{{- if .Values.image.pullSecrets }} + imagePullSecrets: + {{- range $pullSecret := .Values.image.pullSecrets }} + - name: {{ $pullSecret }} + {{- end }} +{{- end }} + {{- $oscpOperator := .Files.Glob "oscp-operator.txt" }} + {{- $scType := kindOf .Values.securityContext }} + {{- $scDisabled := false }} + {{- $scIsMap := false }} + {{- if eq $scType "string" }} + {{- $scVal := lower (trim .Values.securityContext) }} + {{- if or (eq $scVal "") (eq $scVal "none") (eq $scVal "false") (eq $scVal "no") (eq $scVal "disable") (eq $scVal "{}") }} + {{- $scDisabled = true }} + {{- end }} + {{- else if eq $scType "bool" }} + {{- if not .Values.securityContext }} + {{- $scDisabled = true }} + {{- end }} + {{- else if eq $scType "map" }} + {{- if eq (len .Values.securityContext) 0 }} + {{- $scDisabled = true }} + {{- else }} + {{- $scIsMap = true }} + {{- end }} + {{- else if eq $scType "slice" }} + {{- $scDisabled = true }} + {{- end }} + {{- if $scDisabled }} + {{- /* securityContext disabled - do not add securityContext to the deployment */ -}} + {{- else if $scIsMap }} + securityContext: + {{- $sc := .Values.securityContext }} + {{- if (index $sc "runAsUser") }} + runAsUser: {{ index $sc "runAsUser" }} + {{- else if (not $oscpOperator) }} + runAsUser: 1000 + {{- end }} + {{- if (index $sc "runAsGroup") }} + runAsGroup: {{ index $sc "runAsGroup" }} + {{- else if (not $oscpOperator) }} + runAsGroup: 1000 + {{- end }} + {{- if (index $sc "fsGroup") }} + fsGroup: {{ index $sc "fsGroup" }} + {{- else if (not $oscpOperator) }} + fsGroup: 1000 + {{- end }} + {{- else }} + securityContext: + {{- if (not $oscpOperator) }} + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + {{- end }} + {{- end }} + containers: + - name: {{ template "f5-bigip-ctlr.name" . }} + image: "{{ .Values.image.user }}/{{ .Values.image.repo }}:{{ .Values.version }}" + {{- if .Values.podSecurityContext }} + securityContext: +{{ toYaml .Values.podSecurityContext | indent 12 }} + {{- end }} + livenessProbe: + failureThreshold: 3 + httpGet: + path: /health + port: 8080 + scheme: HTTP + initialDelaySeconds: 15 + periodSeconds: 120 + successThreshold: 1 + timeoutSeconds: 15 + readinessProbe: + failureThreshold: 3 + httpGet: + path: /health + port: 8080 + scheme: HTTP + initialDelaySeconds: 30 + periodSeconds: 120 + successThreshold: 1 + timeoutSeconds: 15 + volumeMounts: + - name: bigip-creds + mountPath: "/tmp/creds" + readOnly: true + {{- if .Values.podSecurityContext }} + {{- if .Values.podSecurityContext.readOnlyRootFilesystem }} + - name: tmp + mountPath: /tmp + {{- end }} + {{- end }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /app/bin/k8s-bigip-ctlr + args: +{{- if .Values.ingressClass.ingressClassName }} + - --ingress-class={{ .Values.ingressClass.ingressClassName | default "f5" }} +{{- end }} + - --credentials-directory + - /tmp/creds + {{- $ns := .Values.args.namespaces }} + {{- range $key, $value := .Values.args }} + {{- if eq $key "namespaces" }} + {{- range $ns}} + - --namespace={{ . }} + {{- end }} + {{- else }} + - --{{ $key | replace "_" "-"}}={{ $value }} + {{- end }} + {{- end }} + resources: + limits: + cpu: {{ .Values.limits_cpu | default "100m" }} + memory: {{ .Values.limits_memory | default "512Mi" }} + requests: + cpu: {{ .Values.requests_cpu | default "100m" }} + memory: {{ .Values.requests_memory | default "512Mi" }} +{{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} +{{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 6}} +{{- end }} + volumes: + - name: bigip-creds + secret: + {{- if .Values.bigip_secret.create }} + secretName: f5-bigip-ctlr-login + {{- else }} + secretName: {{ .Values.bigip_login_secret }} + {{- end }} + {{- if .Values.podSecurityContext }} + {{- if .Values.podSecurityContext.readOnlyRootFilesystem }} + - name: tmp + emptyDir: {} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-ingress-class.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-ingress-class.yaml new file mode 100644 index 00000000..2105a219 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-ingress-class.yaml @@ -0,0 +1,12 @@ +{{- if .Values.ingressClass.create -}} + +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + name: {{ .Values.ingressClass.ingressClassName | default "f5" }} + annotations: + ingressclass.kubernetes.io/is-default-class: "{{ .Values.ingressClass.isDefaultIngressController | default false }}" +spec: + controller: f5.com/cntr-ingress-svcs + +{{- end -}} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-minimal-clusterscope.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-minimal-clusterscope.yaml new file mode 100644 index 00000000..28e32d1d --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-minimal-clusterscope.yaml @@ -0,0 +1,60 @@ +{{- /* +Minimal cluster-scoped RBAC when rbac.namespaced=true. +Provides only the cluster-scoped resources required by the controller. +*/ -}} +{{- if and .Values.rbac.create .Values.rbac.namespaced }} +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "f5-bigip-ctlr.fullname" . }}-clusterscope + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: [''] + resources: ["nodes"] + verbs: ["get", "list", "watch"] + - apiGroups: [ "crd.projectcalico.org" ] + resources: [ "blockaffinities" ] + verbs: [ "get", "watch", "list" ] +{{- if .Values.args.namespace_label }} + - apiGroups: [''] + resources: ["namespaces"] + verbs: ["get", "list", "watch"] +{{- end }} + - apiGroups: ["networking.k8s.io"] + resources: ["ingressclasses"] + verbs: ["get", "list", "watch"] +{{- if .Values.args.ipam }} + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "watch", "create", "update", "patch"] +{{- end }} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "f5-bigip-ctlr.fullname" . }}-clusterscope + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "f5-bigip-ctlr.fullname" . }}-clusterscope +subjects: + - kind: ServiceAccount + name: {{ template "f5-bigip-ctlr.serviceAccountName" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} +{{- end }} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-namespaced-rbac.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-namespaced-rbac.yaml new file mode 100644 index 00000000..5ca2642f --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-namespaced-rbac.yaml @@ -0,0 +1,177 @@ +{{- /* +Namespaced RBAC template for F5 BIG-IP Controller + +This template creates namespace-scoped Roles and RoleBindings when rbac.namespaced=true. +It provides minimal permissions per namespace instead of cluster-wide access. + +Creates three types of RBAC: +1. Controller namespace: ConfigMap-only permissions (if not in watched namespaces) +2. Watched namespaces: Full CIS resource permissions for each namespace in args.namespaces +3. IPAM namespace: IPAM resource permissions in the namespace specified by args.ipam_namespace + +A minimal ClusterRole is created separately (see f5-bigip-ctlr-minimal-clusterscope.yaml). +*/ -}} +{{- if and .Values.rbac.create .Values.rbac.namespaced }} +{{- $saName := include "f5-bigip-ctlr.serviceAccountName" . -}} +{{- $controllerNs := include "f5-bigip-ctlr.namespace" . -}} +{{- $namespaces := .Values.args.namespaces | default list -}} + +{{- if not (has $controllerNs $namespaces) }} +--- +# Controller namespace limited RBAC (configmaps only) +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "configmap-%s-%s" (include "f5-bigip-ctlr.fullname" $) $controllerNs | trunc 63 | trimSuffix "-" }} + namespace: {{ $controllerNs }} + labels: + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" $ }} + app: {{ template "f5-bigip-ctlr.name" $ }} + chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} +rules: + - apiGroups: [''] + resources: ["configmaps"] + verbs: ["get", "list", "watch", "create", "update", "patch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "configmap-%s-%s" (include "f5-bigip-ctlr.fullname" $) $controllerNs | trunc 63 | trimSuffix "-" }} + namespace: {{ $controllerNs }} + labels: + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" $ }} + app: {{ template "f5-bigip-ctlr.name" $ }} + chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} +subjects: + - kind: ServiceAccount + name: {{ $saName }} + namespace: {{ $controllerNs }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ printf "configmap-%s-%s" (include "f5-bigip-ctlr.fullname" $) $controllerNs | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- range $i, $ns := $namespaces }} +--- +# Namespaced RBAC for managed namespace {{ $ns }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "%s-%s" (include "f5-bigip-ctlr.fullname" $) $ns | trunc 63 | trimSuffix "-" }} + namespace: {{ $ns }} + labels: + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" $ }} + app: {{ template "f5-bigip-ctlr.name" $ }} + chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} +rules: + - apiGroups: [''] + resources: ["services", "endpoints", "pods", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: ["", "apps", "extensions", "networking.k8s.io", "route.openshift.io"] + resources: ["ingresses", "routes"] + verbs: ["get", "list", "watch"] + - apiGroups: [''] + resources: ["configmaps", "events"] + verbs: ["get", "list", "watch", "create", "update", "patch"] + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses/status"] + verbs: ["get", "update", "patch"] + - apiGroups: ["route.openshift.io"] + resources: ["routes/status"] + verbs: ["get", "update", "patch"] + - apiGroups: [''] + resources: ["services/status"] + verbs: ["get", "list", "watch", "update", "create", "patch"] + - apiGroups: ["cis.f5.com"] + resources: ["virtualservers", "tlsprofiles", "transportservers", "externaldnses", "ingresslinks", "virtualservers/status", "transportservers/status", "ingresslinks/status", "policies"] + verbs: ["get", "list", "watch", "update", "patch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "%s-%s" (include "f5-bigip-ctlr.fullname" $) $ns | trunc 63 | trimSuffix "-" }} + namespace: {{ $ns }} + labels: + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" $ }} + app: {{ template "f5-bigip-ctlr.name" $ }} + chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} +subjects: + - kind: ServiceAccount + name: {{ $saName }} + namespace: {{ $controllerNs }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ printf "%s-%s" (include "f5-bigip-ctlr.fullname" $) $ns | trunc 63 | trimSuffix "-" }} +{{ end }} +{{ end }} + +{{- /* +IPAM namespace RBAC - when IPAM is enabled and using namespaced RBAC, +create additional Role/RoleBinding for the IPAM namespace. +This is always created when IPAM is enabled, regardless of whether the +IPAM namespace is already included in the watched namespaces list. +*/ -}} +{{- if and .Values.rbac.create .Values.rbac.namespaced .Values.args.ipam }} +{{- $ipamNamespace := .Values.args.ipam_namespace | default "kube-system" -}} +{{- $controllerNs := include "f5-bigip-ctlr.namespace" . -}} +{{- $saName := include "f5-bigip-ctlr.serviceAccountName" . -}} +--- +# IPAM namespace RBAC for namespace {{ $ipamNamespace }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "ipam-%s" (include "f5-bigip-ctlr.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ $ipamNamespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: ["fic.f5.com"] + resources: ["ipams", "ipams/status"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "ipam-%s" (include "f5-bigip-ctlr.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ $ipamNamespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +subjects: + - kind: ServiceAccount + name: {{ $saName }} + namespace: {{ $controllerNs }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ printf "ipam-%s" (include "f5-bigip-ctlr.fullname" .) | trunc 63 | trimSuffix "-" }} +{{- end }} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-secrets.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-secrets.yaml new file mode 100644 index 00000000..18141583 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-secrets.yaml @@ -0,0 +1,19 @@ +{{- if .Values.bigip_secret.create -}} +apiVersion: v1 +kind: Secret +metadata: + name: f5-bigip-ctlr-login + namespace: {{ template "f5-bigip-ctlr.namespace" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +type: Opaque +data: + username: {{ .Values.bigip_secret.username | b64enc | quote }} + password: {{ .Values.bigip_secret.password | b64enc | quote }} +{{- end -}} \ No newline at end of file diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-serviceaccount.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-serviceaccount.yaml new file mode 100644 index 00000000..5729a8bc --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-serviceaccount.yaml @@ -0,0 +1,17 @@ +{{- if .Values.rbac.create -}} +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "f5-bigip-ctlr.serviceAccountName" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- end -}} +{{- end -}} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/validate-rbac-namespaced.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/validate-rbac-namespaced.yaml new file mode 100644 index 00000000..ec5f4562 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/validate-rbac-namespaced.yaml @@ -0,0 +1,10 @@ +{{- /* +Abort if rbac.namespaced=true and args.namespaces is not a non-empty list. +This template produces no manifest output on success. +*/ -}} +{{- if .Values.rbac.namespaced }} + {{- $ns := .Values.args.namespaces | default nil }} + {{- if or (not $ns) (not (kindIs "slice" $ns)) (eq (len $ns) 0) }} + {{- fail "rbac.namespaced=true requires args.namespaces to be a non-empty list, e.g.\nargs:\n namespaces: [\"foo\", \"bar\"]" }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/values.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/values.yaml new file mode 100644 index 00000000..fadc1d65 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/values.yaml @@ -0,0 +1,110 @@ +# For additional information on installing the k8-bigip-ctlr please see: +# Kubernetes: https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#cis-installation +# OpenShift: https://clouddocs.f5.com/containers/latest/userguide/openshift/#cis-installation +# +# access / permissions / RBAC +# To create a secret using kubectl see +# https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#installing-cis-manually +bigip_login_secret: f5-bigip-ctlr-login + +bigip_secret: + create: false + username: + password: + +rbac: + create: true + # When set to true, create namespaced Roles/RoleBindings (one per namespace in args.namespaces) + # granting only ConfigMap and Secret access instead of a cluster-wide ClusterRole. + # Ensure args.namespaces is defined as a non-empty list when enabling this. + # + # IMPORTANT: When upgrading from cluster-wide RBAC (namespaced: false) to namespaced RBAC (namespaced: true), + # you must manually clean up the old ClusterRole and ClusterRoleBinding resources before upgrading. + # See RBAC-UPGRADE-GUIDE.md for detailed instructions. + namespaced: false +serviceAccount: + # Specifies whether a service account should be created + create: true + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: f5-bigip-ctlr-serviceaccount +# This namespace is where the Controller lives; +namespace: kube-system + +ingressClass: + create: true + ingressClassName: f5 + isDefaultIngressController: true +args: + # See https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html + # NOTE: helm has difficulty with values using `-`; `_` are used for naming + # and are replaced with `-` during rendering. + # REQUIRED Params + bigip_url: ~ + bigip_partition: f5-bigip-ctlr + # OPTIONAL PARAMS -- uncomment and provide values for those you wish to use. + # verify_interval: + # node-poll_interval: + # log_level: + # python_basedir: ~ + # VXLAN + # openshift_sdn_name: + # flannel_name: + # KUBERNETES + # default_ingress_ip: + # kubeconfig: + # namespaces: ["foo", "bar"] + # namespace_label: + # node_label_selector: + # pool_member_type: + # resolve_ingress_names: + # running_in_cluster: + # use_node_internal: + # use_secrets: + # insecure: true + # custom-resource-mode: true + # log-as3-response: true + # gtm-bigip-password + # gtm-bigip-url + # gtm-bigip-username + # ipam : true + # ipam_namespace: kube-system + +image: + # Use the tag to target a specific version of the Controller + user: f5networks + repo: k8s-bigip-ctlr + pullPolicy: Always +version: 2.20.4 +# affinity: +# nodeAffinity: +# requiredDuringSchedulingIgnoredDuringExecution: +# nodeSelectorTerms: +# - matchExpressions: +# - key: kubernetes.io/arch +# operator: Exists +# Pod-level securityContext for the CIS controller deployment. +# If not set, defaults to runAsUser=1000, runAsGroup=1000, fsGroup=1000. +# securityContext: +# runAsUser: 1000 +# runAsGroup: 3000 +# fsGroup: 2000 +# +# To disable securityContext entirely (useful on OpenShift where SCC manages +# security settings automatically), set securityContext to one of: +# "none", "false", "no", "disable", or an empty map {} +# Examples: +# securityContext: none # via values.yaml or --set securityContext=none +# securityContext: {} # via values.yaml +# securityContext: none +# If you want to specify resources, uncomment the following +# limits_cpu: 100m +# limits_memory: 512Mi +# requests_cpu: 100m +# requests_memory: 512Mi +# Set podSecurityContext for Pod Security Admission and Pod Security Standards +# podSecurityContext: +# runAsUser: 1000 +# runAsGroup: 1000 +# privileged: true +# readOnlyRootFilesystem: true \ No newline at end of file diff --git a/packs/f5-bigip-ctlr-0.0.38/logo.png b/packs/f5-bigip-ctlr-0.0.38/logo.png new file mode 100644 index 00000000..72af0bcc Binary files /dev/null and b/packs/f5-bigip-ctlr-0.0.38/logo.png differ diff --git a/packs/f5-bigip-ctlr-0.0.38/pack.json b/packs/f5-bigip-ctlr-0.0.38/pack.json new file mode 100644 index 00000000..a0523370 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/pack.json @@ -0,0 +1,17 @@ +{ + "addonType": "load balancer", + "annotations": { + "source": "community", + "contributor" : "spectrocloud" + }, + "cloudTypes": [ + "all" + ], + "displayName": "f5-bigip-ctlr", + "charts": [ + "charts/f5-bigip-ctlr-0.0.38.tgz" + ], + "layer":"addon", + "name": "f5-bigip-ctlr", + "version": "0.0.38" + } diff --git a/packs/f5-bigip-ctlr-0.0.38/values.yaml b/packs/f5-bigip-ctlr-0.0.38/values.yaml new file mode 100644 index 00000000..274441db --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/values.yaml @@ -0,0 +1,121 @@ +pack: + spectrocloud.com/display-name: f5-bigip-ctlr + releaseNameOverride: + f5-bigip-ctlr: f5-bigip-ctlr + namespace: kube-system + content: + images: + - image: docker.io/f5networks/k8s-bigip-ctlr:2.20.4 + +charts: + f5-bigip-ctlr: + # For additional information on installing the k8-bigip-ctlr please see: + # Kubernetes: https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#cis-installation + # OpenShift: https://clouddocs.f5.com/containers/latest/userguide/openshift/#cis-installation + # + # access / permissions / RBAC + # To create a secret using kubectl see + # https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#installing-cis-manually + bigip_login_secret: f5-bigip-ctlr-login + + bigip_secret: + create: true + username: "{{ .spectro.vars.bigip_username }}" + password: "{{ .spectro.vars.bigip_password }}" + + rbac: + create: true + # When set to true, create namespaced Roles/RoleBindings (one per namespace in args.namespaces) + # granting only ConfigMap and Secret access instead of a cluster-wide ClusterRole. + # Ensure args.namespaces is defined as a non-empty list when enabling this. + # + # IMPORTANT: When upgrading from cluster-wide RBAC (namespaced: false) to namespaced RBAC (namespaced: true), + # you must manually clean up the old ClusterRole and ClusterRoleBinding resources before upgrading. + # See RBAC-UPGRADE-GUIDE.md for detailed instructions. + namespaced: false + serviceAccount: + # Specifies whether a service account should be created + create: true + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: f5-bigip-ctlr-serviceaccount + # This namespace is where the Controller lives; + namespace: kube-system + + ingressClass: + create: true + ingressClassName: f5 + isDefaultIngressController: true + args: + # See https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html + # NOTE: helm has difficulty with values using `-`; `_` are used for naming + # and are replaced with `-` during rendering. + # REQUIRED Params + bigip_url: "{{ .spectro.vars.bigip_url }}" + bigip_partition: "{{ .spectro.vars.bigip_partition }}" + # OPTIONAL PARAMS -- uncomment and provide values for those you wish to use. + # verify_interval: + # node-poll_interval: + # log_level: + # python_basedir: ~ + # VXLAN + # openshift_sdn_name: + # flannel_name: + # KUBERNETES + # default_ingress_ip: + # kubeconfig: + # namespaces: ["foo", "bar"] + # namespace_label: + # node_label_selector: + # pool_member_type: + # resolve_ingress_names: + # running_in_cluster: + # use_node_internal: + # use_secrets: + # insecure: true + # custom-resource-mode: true + # log-as3-response: true + # gtm-bigip-password + # gtm-bigip-url + # gtm-bigip-username + # ipam : true + # ipam_namespace: kube-system + + image: + # Use the tag to target a specific version of the Controller + user: f5networks + repo: k8s-bigip-ctlr + pullPolicy: Always + version: 2.20.4 + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: kubernetes.io/arch + # operator: Exists + # Pod-level securityContext for the CIS controller deployment. + # If not set, defaults to runAsUser=1000, runAsGroup=1000, fsGroup=1000. + # securityContext: + # runAsUser: 1000 + # runAsGroup: 3000 + # fsGroup: 2000 + # + # To disable securityContext entirely (useful on OpenShift where SCC manages + # security settings automatically), set securityContext to one of: + # "none", "false", "no", "disable", or an empty map {} + # Examples: + # securityContext: none # via values.yaml or --set securityContext=none + # securityContext: {} # via values.yaml + # securityContext: none + # If you want to specify resources, uncomment the following + # limits_cpu: 100m + # limits_memory: 512Mi + # requests_cpu: 100m + # requests_memory: 512Mi + # Set podSecurityContext for Pod Security Admission and Pod Security Standards + # podSecurityContext: + # runAsUser: 1000 + # runAsGroup: 1000 + # privileged: true + # readOnlyRootFilesystem: true