From 5c2de5b354468caea57940e6e93f825561a74f41 Mon Sep 17 00:00:00 2001 From: Kyle Jepson Date: Mon, 24 Aug 2026 11:01:50 -0700 Subject: [PATCH 1/2] add f5-bigip-ctlr-0.0.38 pack --- packs/f5-bigip-ctlr-0.0.38/README.md | 161 ++ .../charts/f5-bigip-ctlr-0.0.38.tgz | Bin 0 -> 15816 bytes .../charts/f5-bigip-ctlr/.helmignore | 21 + .../charts/f5-bigip-ctlr/Chart.yaml | 5 + .../f5-bigip-ctlr/RBAC-UPGRADE-GUIDE.md | 177 ++ .../charts/f5-bigip-ctlr/README.md | 161 ++ ...5-bigip-ctlr-customresourcedefinitions.yml | 1589 +++++++++++++++++ .../charts/f5-bigip-ctlr/templates/NOTES.txt | 6 + .../f5-bigip-ctlr/templates/_helpers.tpl | 64 + .../templates/f5-bigip-ctlr-clusterrole.yaml | 119 ++ .../f5-bigip-ctlr-clusterrolebinding.yaml | 23 + .../templates/f5-bigip-ctlr-deploy.yaml | 181 ++ .../f5-bigip-ctlr-ingress-class.yaml | 12 + .../f5-bigip-ctlr-minimal-clusterscope.yaml | 60 + .../f5-bigip-ctlr-namespaced-rbac.yaml | 177 ++ .../templates/f5-bigip-ctlr-secrets.yaml | 19 + .../f5-bigip-ctlr-serviceaccount.yaml | 17 + .../templates/validate-rbac-namespaced.yaml | 10 + .../charts/f5-bigip-ctlr/values.yaml | 110 ++ packs/f5-bigip-ctlr-0.0.38/logo.png | Bin 0 -> 20435 bytes packs/f5-bigip-ctlr-0.0.38/pack.json | 17 + packs/f5-bigip-ctlr-0.0.38/values.yaml | 121 ++ 22 files changed, 3050 insertions(+) create mode 100644 packs/f5-bigip-ctlr-0.0.38/README.md create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr-0.0.38.tgz create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/.helmignore create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/Chart.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/RBAC-UPGRADE-GUIDE.md create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/README.md create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/crds/f5-bigip-ctlr-customresourcedefinitions.yml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/NOTES.txt create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/_helpers.tpl create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrole.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrolebinding.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-deploy.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-ingress-class.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-minimal-clusterscope.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-namespaced-rbac.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-secrets.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-serviceaccount.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/validate-rbac-namespaced.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/values.yaml create mode 100644 packs/f5-bigip-ctlr-0.0.38/logo.png create mode 100644 packs/f5-bigip-ctlr-0.0.38/pack.json create mode 100644 packs/f5-bigip-ctlr-0.0.38/values.yaml diff --git a/packs/f5-bigip-ctlr-0.0.38/README.md b/packs/f5-bigip-ctlr-0.0.38/README.md new file mode 100644 index 00000000..4c8f1c1a --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/README.md @@ -0,0 +1,161 @@ +# Helm Chart for the F5 Container Ingress Services + +This chart simplifies repeatable, versioned deployment of the [Container Ingress Services](https://clouddocs.f5.com/containers/latest/). + +### Prerequisites +- Refer to [CIS Prerequisites](https://clouddocs.f5.com/containers/latest/userguide/cis-helm.html#prerequisites) to install Container Ingress Services on Kubernetes or Openshift +- [Helm 3](https://helm.sh/docs/intro/) should be installed. + + +## Installing CIS Using Helm Charts + +This is the simplest way to install the CIS on OpenShift/Kubernetes cluster. Helm is a package manager for Kubernetes. Helm is Kubernetes version of yum or apt. Helm deploys something called charts, which you can think of as a packaged application. It is a collection of all your versioned, pre-configured application resources which can be deployed as one unit. This chart creates a Deployment for one Pod containing the [k8s-bigip-ctlr](https://clouddocs.f5.com/containers/latest/), it's supporting RBAC, Service Account and Custom Resources Definition installations. + +## Installing the Chart + +- (Optional) Add BIG-IP credentials as K8S secrets. + +For Kubernetes, use the following command: + +```kubectl create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=``` + +For OpenShift, use the following command: + +```oc create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=``` + +- Add the CIS chart repository in Helm using following command: + +```helm repo add f5-stable https://f5networks.github.io/charts/stable``` + +- Create values.yaml as shown in [examples](https://github.com/F5Networks/charts/tree/master/example_values/f5-bigip-ctlr): + +- Install the Helm chart if BIGIP credential secrets created manually using the following command: + +```helm install -f values.yaml f5-stable/f5-bigip-ctlr``` + +- Install the Helm chart with skip crds if BIGIP credential secrets created manually (without custom resource definitions installations) + +```helm install --skip-crds -f values.yaml f5-stable/f5-bigip-ctlr``` + +- If you want to create the BIGIP credential secret with helm charts use the following command: + +```helm install --set bigip_secret.create="true" --set bigip_secret.username=$BIGIP_USERNAME --set bigip_secret.password=$BIGIP_PASSWORD -f values.yaml f5-stable/f5-bigip-ctlr``` + +## Chart parameters: + +Parameter | Required | Description | Default +----------|-------------|-------------|-------- +bigip_login_secret | Optional | Secret that contains BIG-IP login credentials | f5-bigip-ctlr-login +args.bigip_url | Required | The management IP for your BIG-IP device | **Required**, no default +args.bigip_partition | Required | BIG-IP partition the CIS Controller will manage | f5-bigip-ctlr +args.namespaces | Optional | List of Kubernetes namespaces which CIS will monitor | empty +bigip_secret.create | Optional | Create kubernetes secret using username and password | false +bigip_secret.username | Optional | bigip username to create the kubernetes secret | empty +bigip_secret.password | Optional | bigip password to create the kubernetes secret | empty +rbac.create | Optional | Create ClusterRole and ClusterRoleBinding | true +rbac.namespaced | Optional | Enable namespaced RBAC: per-namespace Roles plus a minimal cluster-scope Role (nodes, namespaces, ingressclasses) | false +serviceAccount.name | Optional | name of the ServiceAccount for CIS controller | f5-bigip-ctlr-serviceaccount +serviceAccount.create | Optional | Create service account for the CIS controller | true +namespace | Optional | name of namespace CIS will use to create deployment and other resources | kube-system +image.user | Optional | CIS Controller image repository username | f5networks +image.repo | Optional | CIS Controller image repository name | k8s-bigip-ctlr +image.pullPolicy | Optional | CIS Controller image pull policy | Always +image.pullSecrets | Optional | List of secrets of container registry to pull image | empty +version | Optional | CIS Controller image tag | latest +nodeSelector | Optional | dictionary of Node selector labels | empty +tolerations | Optional | Array of labels | empty +limits_cpu | Optional | CPU limits for the pod | 100m +limits_memory | Optional | Memory limits for the pod | 512Mi +requests_cpu | Optional | CPU request for the pod | 100m +requests_memory | Optional | Memory request for the pod | 512Mi +affinity | Optional | Dictionary of affinity | empty +securityContext | Optional | Dictionary of deployment pod securityContext. Set to `none` to disable (useful on OpenShift). See [Disabling securityContext](#disabling-securitycontext) | If not set, defaults to runAsUser=1000, runAsGroup=1000, fsGroup=1000 +podSecurityContext | Optional | Dictionary of container-level securityContext for Pod Security Admission and Pod Security Standards | empty +ingressClass.ingressClassName | Optional | Name of ingress class | f5 +ingressClass.isDefaultIngressController | Optional | CIS will monitor all the ingresses resource if set true | false +ingressClass.create | Optional | Create ingress class | true + +Note: bigip_login_secret and bigip_secret are mutually exclusive, if both are defined in values.yaml file bigip_secret will be given priority. + + +See the CIS documentation for a full list of args supported for CIS [CIS Configuration Options](https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html) + +> **Note:** Helm value names cannot include the character `-` which is commonly used in the names of parameters passed to the controller. To accomodate Helm, the parameter names in `values.yaml` use `_` and then replace them with `-` when rendering. +> e.g. `args.bigip_url` is rendered as `bigip-url` as required by the CIS Controller. + + +If you have a specific use case for F5 products in the Kubernetes environment that would benefit from a curated chart, please [open an issue](https://github.com/F5Networks/charts/issues) describing your use case and providing example resources. + +## Disabling securityContext + +By default, the chart applies a pod-level `securityContext` with `runAsUser: 1000`, `runAsGroup: 1000`, and `fsGroup: 1000`. On OpenShift, the Security Context Constraints (SCC) automatically manage these values, so you may need to disable the chart's `securityContext` to avoid conflicts. + +To disable `securityContext`, use any of the following methods: + +**In values.yaml:** +```yaml +securityContext: none +``` + +**Via Helm CLI:** +```shell +helm install f5-stable/f5-bigip-ctlr --set securityContext=none -f values.yaml +``` + +**Via OpenShift Operator CR:** +```yaml +apiVersion: cis.f5.com/v1 +kind: F5BigIpCtlr +metadata: + name: f5bigipctlr-sample +spec: + securityContext: none + # ... other spec fields +``` + +Accepted disable values: `none`, `false`, `no`, `disable`, or an empty map `{}`. + +To customize specific fields: +```yaml +securityContext: + runAsUser: 2000 + runAsGroup: 3000 + fsGroup: 4000 +``` + +Any omitted fields will fall back to the default value of `1000`. + +## Upgrading CIS with Helm and CRDs + +For upgrades that use CIS Custom Resources (for example VirtualServer, TransportServer, Policy, TLSProfile, IngressLink), update CRDs before running `helm upgrade`. + +```shell + export CIS_VERSION= + # For example + # export CIS_VERSION=v2.12.0 + # or + # export CIS_VERSION=2.x-master + # + # the latter if using a CIS image with :latest label + + kubectl create -f https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/${CIS_VERSION}/docs/config_examples/customResourceDefinitions/customresourcedefinitions.yml + + # Then upgrade Helm release + helm upgrade f5-stable/f5-bigip-ctlr -f values.yaml +``` + +Notes: + +- The chart does not automatically manage CRD upgrades during `helm upgrade`. +- Helm hook-based CRD auto-upgrade is not currently provided or supported in this chart. +- If you are not using CIS CRDs, CRD update can be skipped. + +## Uninstalling Helm Chart +Run the following command to uninstall the chart. +```helm uninstall ``` + +Note: When rbac.namespaced=true the chart: +- Skips the default broad ClusterRole/Binding. +- Creates a minimal cluster-scope ClusterRole granting get/list/watch on nodes, namespaces, ingressclasses (and CRDs if ipam enabled). +- Creates a limited Role in the controller namespace (configmaps + secrets only). +- Creates Roles/RoleBindings in each args.namespaces granting required namespace-scoped permissions. diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr-0.0.38.tgz b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr-0.0.38.tgz new file mode 100644 index 0000000000000000000000000000000000000000..eee3053c344d358e1bc4da9f73c6402706f75933 GIT binary patch literal 15816 zcmV;(JvYK1iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYcTiiI(IJ$rPQ)rvKzW~$jrXeIV{oBku1ejT#&4mLbd(N9= zL2awM^Mm8wdms`0ix!V?_Y4)b?A<8fbhTvjgxrjLwhg|;NL!n2m0G}f8`!;xw_$8s|47@q` z!#+3!yCmS0cpjo)OepwAG(t2$95Da`7kmg&a6H9h4pz^9W(JL|^(^cN=u^%^HthGO z$n$$_+Q5#zbh+vsimY(4bQ{SZ%f{a-*YLTu3tpke*L+8k`= z*Z-?m+spNTAI}Q-olpQ>7mGCyJ%EETp*|G900{sN7>AyRgNft==RX_d0zwZ#h5$oo zXss9=AYI&!M*jM-0(Pgk97>PXP2+9L#Lpw#3C+ zNmW4s~CxPw}Ua0SRp6hx`h7m~n6^I*S50 z(iD%GgeD;#ygU4Gbh7jQWT?g@3MUkb&Vn%|eij`;G+;FyAwB$SVi3)7D-;tWyw;WN zU6Ba*5#u1H0pNHDigx8vB%W*bT8@_STTcX_h>?hju8+`|P?Vyr#_1R-Z0(PSe;n=X z?c0BRJlNas`L5j6UBn^wkSj-?Mvho4a!3kYvlyZm*g-pvL!v-Z-U>Jlk%Pw=F)^@w zil|&XvYePwQ4p{xi98pKkftlQj0jJrir&P`i_YhPa3bhh_2^&>0>UN9iZRjDikYTf zr~qLGCMZBuw5V6I06dO7Pk!gf55+>&ea$a6jeu@n@P{d8CaudZQzU^JqLPO%5c|JY zQgA5whs~}SN4{m@U_udNyB=h$WHp+f-)pSIYqp2RF!K0;{+_g_Yl>AcOs4x*Jj#*F z(heboKH`Y7-jw^Eg!%r%$^H-s*$qq~11=tqu@iax3S4471xl#UV|-?x{a_QD*|Oc zB@D?mdWqRILx2~E;_=lf4mhG0&{G2+5Et1Y@x0u7k4#QIbb<8G@QP1Ka5{nvxtOXR ztbkAd@7taC@~>nQJ7sQg8uRfLF!o>&AkTR7kB@KmkKXT}>>taYuA-1rO+u$QRK?`> zCFfS-nefUX_}m#2(&>WE2-42i?B`Ptj*!te_4|||4>_Dr-5Wx@Qy=*wL{Irus4){P z$-6)aDiWst6a@heCZ{+!)%;Ywj~F_Yt;oR(;=vQI)lR4DaWy(L0$p0{XurOp&`Mm*=rFMQ$W^&x1)olGpp+kQ2$}r)w!# z$C_GB5cOI5$p${;&UF7jjO#?!hr|QfBQ+1z2!_o@MSU-FP)IF+Vg4cGyRT=YR z1y&=5#*rsP`cySnJJj*+t`ITc1Th0S(N8WVIT&#w6aq)cAZuN@vF6+11PFPLj8$hk z0SS;`98xq8e*}_`Xf!)rAe4>(D9Ou*A^3h{t$_V+&<{PNXFESkLRLfZ^sayl41uAq z3W&B{g4=6RtsLO@o0MJ(081tcXix`Z#rUC;Jk+|pN=2=%v3*FPf_NUe6g%7s@UV|L zJ9WZHPPCuC@{v#I)evkCHs4`uMJ_DFa%Gd3`O?RTgOIq#C6s+gq#UiLb;s4ZjojEW zpN=^UTu5C(21QWq$TWEwQhb3uG>L^;RT4q>L*QK<5yF4R9#YIt6?kY(_|N%d?LV>5 z%lbm5JMQssd;x7V*?+fQ=Iy`Rn=b}S`_FwmyRpa*wC(_om1e_?jc^FQe+RuIB+WfN zp?H9s8_P1(nmyt~g55#2$J+}v23ht3Z9mr1ZfrhP>;H6$yijO)Je=DU+_3)TVNZ7b zzZ|^SSg!y3c)ow{uY(Kh52aW)#vT%S+G}47i!((-u-?D9u|z3r|63?T2A(s;IP%QU z(&cPzUIU#BWl0lU2iR#DAwGkiI&hR6rT0n6UZUiO3q+|1Y8y(Qwg&`ba4|9xIPw+rpyY~m?ar-fxkm7)Y4h%!qzZe+(@fgY%Lf<$F zq$bqA7>p2ygJS=SW3f9$&bjQb;Dlg;FHm6EsEB%%(L-BIqpX}6jwxjSKv(e$f=)>( zb9Pnhb=@^EYSqu!Fdx&^IP$zJ@b3tEc#M%NC_(nSXZ;f?ijw8IpesSY42+NiBZdGY zJ~GcTC8dus@?0j(Qc_k&uGGt?n1R)iIw0M9f2^%oQXN?9SqEc4)sCrv=&nt3}jf|8uZpz~kM{x8{g!ZmmA=lx{^I3cwa@j*3jPgWu7AbXox^p^S&#-W#7P`7e9gp>460c<2_+0S)rs zix*pito*k*c(Jk6|L*0{D^IYhn8fJ_I`NuY4G7PENDuzjB!!>jz#W`Mq-kmI)59-bJ%673nF_1PD}5S)gNdI1P+eqpakWK5{bNgv2d;c08CX<6#FIFC^0H=LMo81IY>E$=@Dk>5ogu zo$133o;u?5VQ3841u{n~8Ja%hkVnOl&c9cKV7{GoEYzfr|5TMvp_GlVTRjEd&<`Y3B&H(A~Yb$cNt|AQRvKo2{lN9d%g zjgd#3bA1@vVivLkFR{qUxY996o)8P(T7lviI}P+LAh7JO`&yCemy0|kKbCd?hBzf3 zlY5o1D0xsHe~=1<^w_xTp2YIHA-X>W$$c@;%<}(8`IXJ01~kb3gY8#2`|sxFs~0bp z^8bB2iU0Z>#dXD1I9jl}lO zhL)}29cSz}Z9taUtmdMY1b-0CT_KBAhv`5p}neskQbr1LYj2t!HYg-B2?aAh#iD&hWHuiRCEDUwUhK1c7I1JurOT24-xMmAISLlM>~ccwAeaI1}cCAGB+? zY*)IG_Wtn52z10pJ9hl;@o&5X3ILdMauv!$Yr$AQn1_y8&)H(dJ>|XZiptWlxunbi zdk4eH0(cD2zY`ofj8hy;I%cT^&?o2#Fdn%?6s&TJ{VGh?iuLu5uG$iiI-Rx5PwAhX zeWhHr^Tl#6Vh8T*+wV7>91_Jbdo7)Oi>Q`NvfM9oLp37AD;X%PeDYh&;T_=Q!>}AB z^lz~0p`d!gHg1hsj;IQhH)ofahsB;>MvyhQRWyLdnR>ae{q@2v0yi#d1DD8&6*5@K zT?0Nvh6@*1?RB!Upw*DNK2Kx1Z%CTm!Pd`%!jvmZD4l9$7NWL%TXTBi|@ESvc;v^ zKy|mD<;qc<6Pl^#vfM)MQkU95N61ha0YUmB-rV#HA1De5xVae`A7U4(o10Fa zy~IUIF1{F86vnrAH5S&xS>bI zOGz&siV_C|@%WP~!KB{DA9_wu*xvz@nX{oR)C zBCkzMYoT1H?uFy+PKB}~;ES0@fuLMwyO>JF|H|xPLLONyBw(fllaGLrn*goNoujKR zcqYwq`N|ba%sIL;JiS?`0&u``y-KRc5o;kv=4D<1L}-u#0mA@uDh)6b;c_q`B@$^=wIlY684Zo8Y*W-(u#oFqN2|!-%%t456fYu{qULL&- zO1XQcyE08A*odNm?>qmNjJ7N!oc?w)_;|F33J* z3_Fdp1Bz_b48;?lsAh&#P6 z3$>^g$v>@s#$7+{&i^ty-OR^;P4|Ddx3}{C-!BJC|Bril>f|5e-bLozZmFa zssp2b`9alfWh4M#5D*@-cK|@fTQ`3)!E6mc(QHl!&9q$^JjuW!w&r${a~bn?bbJ9h z;OSCf7Y?%?*I9qr({BCyIKV#iVm~nEkZ^{JAWio_1}|RZ*8kSv)yw7jzmG>*Vy$;- zf|DS2a)xz$IvEo$=lk_qsGdFRP{qY!DsrE^*p>y5MxRR#-s2l^$@=M8+J4*Mi&o)= zCYXb5+Y7&l(tNcH+}vbV#PXE<{=Le|?xcXv&!2y_vicnO+>!T3I_iV+CI+876T~}R z(D5*n|4Z*-Stbh*bV|L&JD}JO=;VCG<3e$pAZ}DO7Pk(*mb!@N0+J;_@k)fJO1IF9&BIgpFL!s0lUvYo~F zzb?7YQ{X-e^=ZAul&Ai!GAv%XhwFSkuJd}iK32hZ`N*f8{GUo&wj}S_EC3Duzb^-y zdHH{H_(rV)f}&-HX|8OUI!^kJk?gGkmc|&0I$VT zpx-roN{Nfmuu`>Zar)GfqL&mstF{zx zH>G+|VODRc4Cb}Kdn8mtMY9Z#4cv`gNSL@3I8K^65`7LbzqWP8htzBBMd_YKQTPYaP|d*Xcu&f(Rgai zqzY>lL+6(GHEqQLYZ>Eb5u5T{HsK^pPz5F}nrk<>nV3YkZmgEr>VX%=G;J*%-O5g; z@r=qkmknAZ02zUb_X623?+I~Aj7_OZDS(QmnL z{K)&plM?P0Op4#Xrw(!%iLSqHWerA3WV4m|O@6{m<-0?!w92R~T|rjH>soQ@!!%E% z=$e`FFUg^kZLp{8gqQ&+Qw$}hq%sV;fT9Vcu7{Yk(ZxyQ_!Q;)ApueZ-K*G$6-rCHpx`6-k?DUa%ZgkR+cct=V2z@1i7?JMg7jL_uqvF`zu?VuH>K~k{pOh4` zP-N63mNHpv=aylbYZB`yK3!RX}+6gc1-{5vA?mA53-d?kRmL@5B{ zBE>^5nIGzD%m2-6=d*4DP5giGvgrS{y|v{3_wnTTzi9}WDKSsQ29c3`X9`@n@UW}P zjpV*Jk|&!K=}+`j@&60xVHa{F{e2Dp-`l7FP4|Ca4GQ_6HeW9NfA8hdrvy7ALb>4d zWiGkWRG#;9#7qTf0|5zamB(FK*|UDZAti1k$_E7aFu-HPI3N)ZBMwLqht|p4=4<>w zTg5m@jqCyT(ppBK<7WZWQH@u{UUk5d*mvTK3U4T5_{oABNhmG>W(=_hI;A6}Z#lBU zaB%`gs4!YxfO?bOmq5m%`4WJP$MEMboiQO_I$iLkGlKL>=W8eJN+BS^E$2VG{(Dp8 z`FIi#y2y0wjract+qwL|Td!U$<-dD*R=^?T9MM3MsG53pHaCi}ClB^Q=$yj|Vm)gG z$i>Z~P`U*GHbtHXCLS57P{cTxbcNgiIle$LdYADY2ClUN0yL2}O0XJIG{)bMt0HRu zb*%?J1l|=OfvhP|lAit^4p7hP?H!*Ub3&2yjP`vJfKR)}z{QkVy$R-h`L9CX>W%(G z`|{uT#dOja|HMDpMbJ+Hji7TLg+QfyTJN#T&|2?};JLNl<9=wZ|F5+IK0%5}#K6Jc zKC|L`pjHpN2=-MuO8)053O3pGfAnT&*Zz3;$I;H-zWv9?gT4Kp@6O#u!~LJFg8gss zV*BON{&z3W3iudKC{!o-l=$(@4|Rz~-320fpHItLSpgp|grtuyE$g3xT|^0(vg<-p zgkYCgF$2|-Q)p@REVro+Rp5=YHGxFVDWR;i*n`j3y5NdLAV4Zjvk!v^dfpXqJOl-v z(n)}LZV3WuxB^)b%P5$#d`NNN;Lwu^aD}GB#j6YKp$Y2A@%ZQT3cQnTfnCv36bc#X zNQXVJtiL1A2QEQcZi+bZA;*qHjUu01AftK7f%z0+3LFw7P8WaHN&`ziBmI zs&K!mz4nSk6hMayQk7I`<|((1_TTRB9PgjL-+8zHx|6Nnv8)yF7BimUW8P&xk4DJh z9+;p6Pb%i{8cZk(!7~$b9iW)dKovxtgRC6z+1Z&I^vxc4qqg>4-G&@5b+a#`S`7IR zs8 zvPm9e%6KUx%vgk2GA7DFqj6ZQ($;FARFTh%9*9@8Ts4I~FzsEYTz;F}os;qjD2a);s( z4M0EyUyD4>+AX}9R!)XRXavR9WzKNAGEx+Gr^q=^cBxFHqm&C*4Y6t1}K{=Dn*NG8rQPo-j2jimWrz5+Nb3ZgT?ou=j z56ZYP974Yiy{alElhia}h_Am#fur^b%&&?xVaOgKae+?2YGM%*mx<>8mKIH|s=ro_ zQ~|t4ChE4h!6;Rtt)w|wq`IjzZ$iIxRe%#pqLGK#ln^d9B{?dGX>)rhz{myrs#WV? zti(@bPM0mM0LYD#fW;zHwj)E!8uY;WdX9XV&i||TXt5vd2P~opoaOl3S?uP@0Q9^x z#+Y$uep57{Csb0GK~n+NpHYCFxYc~{KAS(CIf@C->+oFVAP+EGy`;!WoSh0NoAV@n_$4s`B z3NR?62D(!5d|hXjG4SUMC#URYNqe-{I}{|)*=$KEC4KaLWz zJ*31zEVCOAdf*swZ~-Y6TL{Z3F8-B0-nLVQ)3L<+!7vnp5e&mk_1{+K z>vQYP!5;^Qryq~rzV1vp581HaAN;b}8@&9vH|PyEHlzZSDi%U(P0R|!RInGOFWikv zFso4AT70(T1{zOW(HL>RV(_zc&Z~vqXUU}J%ZNo%+C+Bsyf#*w7=Rav1flymzf7nE zo}GGOEZ+D{5vOstPs}NAP=LmmGt1f;b425#xpCwHA5XNpTxnf8tg(-Y-OrGvWI!Fc zqvitOq%6+hvC2Z@Mxs5)x!Ar~M90vPVBhClGREDa*sHXXjV4ybv5Qojz=QbB~E-}w4WyJ>B}>G-j5iflL))0pL(D4R~*c2 z>FnYuti}HD`5#FE)#w|T^ck2C;@V*hp)XsJ z`%26lD*7cDM2}4sZ1F?>bE=n8f9)xrvOL}=cmA`#v-fTxXFldrfBv(%v7OKVJlNWJ zwT%CMFVBjS^`uW&a)ncHpO~4%A>CtVKBgnTDT$9^!9~Yd8pnm8EJU#`&?&o+Yi8*q zV+s6oHRzd`+geX+rW8ru%rKW6{s@f~C;u!sXy)rJnWtcwk}FNQ@2!L;M0qf!nQ6_K z0TKX%!x9QU#DNSFwzyTn09r6AnD>COI1&ZO$lk3K$pC>v z;>KzAq$ypjjBKW=*;YdrVE#Pu%@82v&Fz>3fp(--hk7zTvSEwGp76d;P7vTG)J@z=J;l=!xXIik>e9p6!S4P9Rp&VG$AAiVxt{MWBSN(KM`iFmRs z8u2F1BS6`fvl1_BMUoVSgketTmC*I&s#7M4ijGXx@nA?~Cf4z`%_N5hF=eJITW^B- zG#Ux1P%YQKDr%skB5}sK|D~b|nc!=e@=WzJQrf@4rZr4K^1pAtkCj6WpHqbTJ`_x; zudALa*je>)O<7qCHYfY71_Y0RRR0XJjmb5!#UvgCYN#sa9e`xOVwP%;GoAfgfG%y> ztUirR#xsksRLv?emUbj|jzi#3m(A9JRZ*El9HAOvfn@o`R)XXGBV}qSmQ5C; zE_=9heEiQ3M|<;(l3Y3~D_THHji^J*I*fmS>%`3jT!THt9Ev4pmcNuAtXzS~b8VYX z#V@NQmDn|ic|N!X`T`)}Q^@1JjK$l4;%(+;a9w&YFl&s-cI9Lm%NBC$JUEoQr`)-9 zD=w0o+qEOv7ezi9JuFlJAFAbUrr5NcuRC zu_*!>MU^}u+ENXW0IMu`(nZ)RyN#KFt~qL|l*j8tajN7>p4jw_>vhsNZ&lsiGvLc2 zDVXdUEw);Ux6y6^a`LS$Wb=Mf*+{f-U%FOlQ}eFn8EE_RRI*^|0-<@7rbAnYUL-`k z@^c-D$g0dd(lsW&3$n>F){;rd-LNW7iF~6~sqFnKxj3|eKFwfNcabmOTFt=fk^mZQ zC8CAdo*Y~=+)WAY>F0#>B_B_Sz|b1SEUJT-R1Cj11t!bLD4oSTyM$#iQvfnZJ{4mu zBMtRT&@`l6ve`n;+Gd!dFbLz)J2GmL0q0on?WJ5M-uSiEQ7NMoO)%qBDti*RYA0S& z7s*AiCd@b#t4ApuRxWL)QP;)ls9ae;-xF6*k1nXL;3aKmQ*s(Gb|{6idagny&#H;< z;YXdPHKELqh($fv*zm1%C@-x)hMxg5*n9`&@;& z<(rWxVm%^>$C--$Sg;K)`F64km8F3!+ZFQoO6G69Cp^xUo0T5Lpqa9PJn{A;u9Oq> zP3)cc0(AvWBf_WhyHrioiMT05kFkfcz+{I<2u$z=3P4CP5fjt1EK5*kyji*Cse_zh z2*!dddYXsIl-Jsfg4|?N{j6D{;XA6vB(&R6Np}>%}OCmIg{k_@_`c~_j{kXVzLD; zUB#sm%|pS%0XQ?}=1lJ9XQyX!!nw@!p&ilq6!}VtQ@F}cfr}^(COzv{c^yuBC?q<; zndprwrHpN7iG$*q_?gcvnBBX?{A)dP3NH|V@iC(#v2-9ylANf!iahaFGGulXTwqE9 z$tLZrO7fRuI7qoxw>b10u#f#=yc^Rfp%1g0@fiL#oH#=Liz1dLON1J1ze@$T+g&bve_V|TC0O2D(C9crW*Vhj+Ol!ElZk?T- zNe_%1z#$OZtU8rnU;l)mHsHTK(3Rv}J1b+)$ockHSP`_PBG=w)(Ok|jVYZ%3kNAs1 zv4`v)nfRLlAJVYJX(r&`x8LB&LAWcV;Iaro5<#VtNYYIb>y{4;04t!^>uFU$lm%mq zJXbqm?Kln!#nOu>Om%ChrI#)^Qx}Q4;)VEEmpkjqBZxq4*}#V(IQxEcrY2t*$?$(r z$}&`&!^&B-05F!trVvR0FjvKvdX+4Q7vi_-f}kZIbGhlrX4H;07E>L&?FmYYuQsb~ zfsDbKT2*qzr?@5z?*SbJOU6g2mk-F|eqd*>ioSAMxXX@&JqIj7l z{+nn>;CT9J|LFMO!~55Nb1<{D>hh~Bv;uxlvDI%%Dqd{%2AjPNU4YQ)lAFD6wlXiP zGPoqrH@X-H4XakF5}%5^`>jpb&3FEdkDsan=D0^!+36Do#4) z3XYJVY3UiQbrc2V zc5Jcgqrg0*)tJQA?et^buAGeTP~8$Nb)HKg4lNrTpW~2an2fwaXPVLa+K$#s4s@!m zU#2x~LSZ0}B`1jYg{<9|aan~D*=QaEt16jZHTSx2}*NtEx{>kLuus!s<+wP7QIwX zO{C3<62puyItYvEgX(%l^pWpFFQU-PHy}T;DWNi6nFaxX4KDO2984k)(p)_u^a>7P z-jTLI?3|*(*czDb*g*f35cJLW_!TEqhUGHfIaB1r7$E?JO1g7+@M-Hf_W=ME{*lNy z#>Q)P{e|PSTN<(+Nb{)xQ3pnTi%;N+pJJGdi|xMTvknh)KRtV1s5B*v&)3rGs%~q;{^iU1*X#7xSL1{Ib=~-|_NBMBzWRB`{%(AjwYH-XCEn~ir#LNeT3iC$CumNTiYcC zv_xE1n+0%APV(&fUtjva8Pgw+%THf_`qCE!U=Gxm{%>n#gXEAPP+pGjFr`E^dwYt| zwD9%?D3Ss9nAY(ZNb{{}A=|o&1iGkYm*DWzFthH;@X#?-P~aeq&wOaiNCBmciSuxm z_@PjqFbNifR*@}ftbS^V6=D1^9jt0}N<{|HAU23c*<8!Nwb;>8qF2)Gj_ZmM>;e}t zjstnzle}{XImhTAV2JYg*Acp;n4|dTA!O{PozD#?FQOrvDzkmHc=)Slau6=*ieRY$6eO*>?(0z3? ztoZWsX4n$O_RVUcsCd6wRpCWNg{`UzTNM>5QQEAiuzhn~D8E`>^ySUkb=9|5H`l|p z>oNLyW0)+J8}R^^Yu*WWbr`@CUqeO(($a+I%D ze;XRV)_z;7pu*TnT8_T0H}n$u#`hkHP!lI!y#r~6JEaeKgt^Rh>#M}^yZVBiGQuO>-5@h&+c(5=EX`cw?j%eafo*iuu!SGa|r#5pc9wW zaDaQ|L_0EG!(%}v#A2$dr|4dBlCBAdh#o0-+s83dBf|I47zOO%w=y|C4`IqlTYfk* z4pqAQP8c2$GN&D{W-eM4-fD?v-N@A)!^u7zON-+X3?`*x zd;6Z$wJaptcXWJ2B94QJy6#r0izy%@LOcY6!gqWW)oMU@eEJxW0Lhb+d5I~$2d7ND zv-ih`-wtG#O7;52-qt7)%_;<>Va@!R%~Z{z#?tY_eP>FVpfrg5+K{gNv%0ZAZdYFc z!xyOB)C~Y75l1`jh3GAl7k=*=lP-Yrc3l_1;7a`Ps&Hc=lzyrU8ECG~YAX+}XXxTW z6c}}`c}Pgjq3*4BvbwW{*|v<;7Kh{4WvrlAHy&%{yPakT3&C7q^mX;KtsNPpD}*wR z)wX>|Xypp{W~V+-HV(K=sI9Qcc>Uxb7+ifQl`hp|w=`qg&HdMXs1@wN%p`D20be{G zf$kgV!N9@6rE!KM@M87N}mik5mP8Y5ceEO84oW5QK&H|hwLp`b>i(CN$fAMT5Zg?Hyd#-U00T_D@)gvk|nY*L7=5aMhh<3Lis z(B`r#)k{dT8YkvZ+$5YD-<$dEBr|ODjfR1l@tM^)0Kg@}lWC)Etcmnn2ZP<-lcFRq>?Y7-wGR;<7Y~AxsYzC)B%gJ2G&9@-c(?o|R zdTkhSYo)OjWvZvOIGIJao=VlzNUJ8mMv7HWTe?+GE3q?+M=LVXxGcrcr5L&tL+g2< zUMh{^Xm%C0DxNz!50hstwF~F*pFK4n#y?K$OEX8DNo|df&+=@s_OP=J zXPg0xX6`rxuy!1B7B19^OU??g6{oywLr??1Y|k-gLA04`-qt*~NY2@sciv{THS*8) z9Q5{MwJ0vCsP0`OGkrozR|_YByErkZvp%$T7HCBfe&lhi<4nfc7N6EOs6%E}-M%We z++u+|#)FMu;U^lcEF|i=^^#Rj`{kQ0-=eRN|Fos8MbV)5xonSdsf4cDK@-$c z#hKcl7ClBr((*j$cDwBI3}|@%c4L(qW<_r#hKRG$9Qdyhigj(5P7I{D*aeV(+ zWYq8r=wVkS|14r*0~&c~2s(eALbl3~H|{0j;n%?RHORgKe|-&}@5+pK&pTyUA;x4( z{LYEWU#F|-bb2F{)Ry@WRk|nS_KL6)#LDn`{ThhZ#B+~xU;fYk0jn*$^7=I>0;um) zS%-Y$sy=`{8EOVwM00E(;%7ILoCv&cjP~{R}9P+5JUTZ8Fb=Hduc6+@f3CI3krH9Kt zZpW-L`zf~*1Ve;5f4A)gLGPt1KU12t|c8+m=kMo-=z16>*fvyTp5cPF{@4CS#X)H$M;7}9sjA$Gj#uht3#@Pi~gGt%KEufSv^%+r0 zS;RQy5r8$}RBX-|n|Gg%?`wSIn(rk{rGU-x$?@WqI zMlh0cSaDhCKF>`rOI zO8GKQ?PP$K@5}N!aW9|PDXq24>ZGfAY!`>q@@TSiMi=59i;26!Sla&HeP__y=yXA6 z&>N`#Hr0PyopS#M9Z%}y?eV9~lvd#|_g(dN;jU)wh9l>u0r#4wRsGsvR<$sMobhMP zU&ZV0{oa02q$17ys{*+bnGgyE4!sI_S7wXnQ%a)Aw1S{yKO*l;u>j)c6sTSv~+k_Iy~Hy!^49+8az}^>>nVv`-5aQUsNg}^V(X&Ts?*yKt6GA z)3BC}g_z|+>UKeh=$KGnNL?javnwvVwreB}In5kidgm?`m7VaOY>j^cv)T{Wv%4~2 z6-n|>mluDT6BOLlMdrIn4!Q{J9&2XGFwMBXpp?0Dv!6$pS?=-V?|l2>p%M8Ja;iOW zO0xMUA@QcV1JS=W7pL6Jk4VJP9`PZrF$cBK8_O;gH--mD1lVHjWrnt8hPEf4p>6&= zy^lOc+Z@sOmKoRP%eYn_Afin(?K8m)DuOMw4hO#=)p;R-8C%6lX&p3S-Z&|Jm8Exvp#o)=Un90*wF5?* zxPk4~XN!1&?E$rj6WEq(wBi}55W6j-xWV@&}y z8-YBfJf+Qi1I)7L&y%fm8GUpaee}nOKKkgw`~IMrJ7)>R`Iwk)>+qW`spN5~lP!a8 z&epePJ~mgl%~ruSXA8C2I?(3R)@>hWc+G0e?V__4}mnpzphL@=bFB8YCsEs#Lip|VHJZ1=SQi@e(+bG|hGdPLzx5UP1Dn=!2qDHahGRlwWP1bKrhWrXJg7FS8(!CWtw8j)JK$=l@ME@ zQ65gFBA84w25BIfvfEANjb{SMl!cK|&1QngEHH!&xcL)YS`*!&0rcE}%@IUqUqjh@ zuV^B^t(JiSeJ`zjRGdgmL%VYSAMrxlD{?9zkqqQ;|gULUrt&4#vL z-d)>+&7TXOIrk3J@w-ji^5P1YC0@R`HEu69e|hoC%U7Gf6b+6-y0{C^%(NK^sFL6>`^n zAeLEbXKww+&r;jY)k(mrEfDvwp7fqrBBZ-HMW2O`ALF@W{5<-D{kA6^4aD6@-c9Y; zIoZH!TirG^75%Y&H0MH9P(8UB`+~Z(A)y%7Ep6aPEb~U~yve1cRDiH zmBxUZZ9Og@k}tIKu52+TE&Lc;Kxy>NYyqRmL$IBeJ4-VCsGI26C?bybM3E3_tMX!w=j_mRkDMK7F6srPpT` zX2qhJ->Wlx%!+@MED*WqncTG z2&~4KqD$y`Y8$-|%;H0tI;?Pb5OCyqcp}5X-WzUhM@>c`J(gnD5ez1kGdjQZx5>g> z9}9IcIJ6zW_4GyW3v1#^bv^UAe}{|#2Mjq8y^D32SmcMZkozM;C#0BA%;#Bg+GgdE z%PyGWvK*XEXPl2@b^{V18QpymY~#@)wzwGw$&{BI1<5&oi|bq#?)YeXVWXyPDTj|e z)ahyqx036!;po+k$J#PDYVs^FIO;O2W6ARahIM=r5r-Ck$Kni(CN$fAM`uH>7-fYCV%(J@8v%1W)TCzkICI~bnUNwp}alxj{>{^eX72YGK;!i^-nZ9CeAr(aQt`>+}=eV z$DxP5Jto{Jx}=yddKt{?2;h-P(}s4h=i7QTd#CfAZ-dlj=xx%&$3zWclX^$TM%OmKAC%DOXWl_EQrQ-Bc-Z(!bq$$!USlmY8 zHw2+`8<+FU2&+=K| S^Zy3`0RR6<)jpE|<^ceD(7F=< literal 0 HcmV?d00001 diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/.helmignore b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/.helmignore new file mode 100644 index 00000000..f0c13194 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/Chart.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/Chart.yaml new file mode 100644 index 00000000..d1611754 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +description: Deploy the F5 Networks BIG-IP Controller for Kubernetes and OpenShift (k8s-bigip-ctlr). +icon: https://helm.sh/img/helm.svg +name: f5-bigip-ctlr +version: 0.0.38 diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/RBAC-UPGRADE-GUIDE.md b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/RBAC-UPGRADE-GUIDE.md new file mode 100644 index 00000000..5b6ed6c7 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/RBAC-UPGRADE-GUIDE.md @@ -0,0 +1,177 @@ +# Upgrading from Cluster-wide RBAC to Namespaced RBAC + +## Overview + +When upgrading F5 BIG-IP Controller and switching from cluster-wide RBAC (`rbac.namespaced: false`) to namespaced RBAC (`rbac.namespaced: true`), you need to manually clean up the old cluster-wide RBAC resources to maintain the principle of least privilege. + +## Why Manual Cleanup is Required + +Helm does not automatically remove resources when their conditional statements change. When you switch to namespaced RBAC: + +- **Old resources persist**: The original ClusterRole and ClusterRoleBinding remain in the cluster +- **New resources are created**: Namespaced Roles/RoleBindings and minimal ClusterRole are created +- **Security concern**: The controller retains broader permissions than intended +- **Resource clutter**: Unused RBAC resources remain in the cluster + +## Pre-Upgrade Cleanup Steps + +### 1. Identify Resources to Clean Up + +Before upgrading, identify the current cluster-wide RBAC resources: + +```bash +# Replace with your actual Helm release name +RELEASE_NAME="" + +# List current ClusterRole +kubectl get clusterrole | grep $RELEASE_NAME + +# List current ClusterRoleBinding +kubectl get clusterrolebinding | grep $RELEASE_NAME +``` + +### 2. Backup Current RBAC Configuration (Optional) + +```bash +# Backup ClusterRole +kubectl get clusterrole $RELEASE_NAME -o yaml > clusterrole-backup.yaml + +# Backup ClusterRoleBinding +kubectl get clusterrolebinding $RELEASE_NAME -o yaml > clusterrolebinding-backup.yaml +``` + +### 3. Clean Up Old Resources + +**Important**: Perform this cleanup BEFORE upgrading to avoid permission conflicts. + +```bash +# Delete ClusterRoleBinding first to avoid permission issues +kubectl delete clusterrolebinding $RELEASE_NAME + +# Delete ClusterRole +kubectl delete clusterrole $RELEASE_NAME +``` + +### 4. Upgrade with Namespaced RBAC + +```bash +# Upgrade with namespaced RBAC enabled +helm upgrade $RELEASE_NAME f5networks/f5-bigip-ctlr \ + --set rbac.namespaced=true \ + --set args.namespaces='["namespace1","namespace2"]' \ + --set args.bigip_url= \ + [other-parameters] +``` + +## Post-Upgrade Verification + +### 1. Verify Old Resources are Gone + +```bash +# Should return no results +kubectl get clusterrole $RELEASE_NAME +kubectl get clusterrolebinding $RELEASE_NAME +``` + +### 2. Verify New Namespaced Resources + +```bash +# Check minimal cluster-scope resources +kubectl get clusterrole ${RELEASE_NAME}-clusterscope +kubectl get clusterrolebinding ${RELEASE_NAME}-clusterscope + +# Check namespaced roles (replace with your actual namespaces) +kubectl get role -n namespace1 | grep $RELEASE_NAME +kubectl get rolebinding -n namespace1 | grep $RELEASE_NAME + +# If IPAM is enabled, check IPAM namespace permissions +kubectl get role -n kube-system | grep ipam +kubectl get rolebinding -n kube-system | grep ipam +``` + +### 3. Verify Controller Functionality + +```bash +# Check controller pod status +kubectl get pods -n | grep $RELEASE_NAME + +# Check controller logs for permission errors +kubectl logs -n deployment/$RELEASE_NAME +``` + +## Troubleshooting + +### Permission Denied Errors + +If you see permission-related errors in the controller logs: + +1. **Check namespaces configuration**: Ensure `args.namespaces` includes all required namespaces +2. **Verify IPAM permissions**: If using IPAM, ensure IPAM namespace has proper Role/RoleBinding +3. **Check cluster-scope permissions**: Verify minimal cluster-scope resources were created + +### Rolling Back + +If you need to revert to cluster-wide RBAC: + +```bash +# Upgrade back to cluster-wide RBAC +helm upgrade $RELEASE_NAME f5networks/f5-bigip-ctlr \ + --set rbac.namespaced=false \ + [other-parameters] + +# Clean up namespaced resources if needed +kubectl delete role $RELEASE_NAME-namespace1 -n namespace1 +kubectl delete rolebinding $RELEASE_NAME-namespace1 -n namespace1 +# Repeat for other namespaces +``` + +## IPAM Considerations + +When using IPAM with namespaced RBAC: + +- IPAM CRs are created in the namespace specified by `--ipam-namespace` (defaults to `kube-system`) +- Ensure the `args.ipam_namespace` value in your Helm values matches your CIS configuration +- The chart automatically creates appropriate IPAM namespace permissions + +## Example Complete Upgrade Process + +```bash +# 1. Set variables +RELEASE_NAME="my-f5-controller" +NAMESPACES='["app1","app2","app3"]' +BIGIP_URL="https://192.168.1.100" + +# 2. Backup and clean up old resources +kubectl get clusterrole $RELEASE_NAME -o yaml > clusterrole-backup.yaml +kubectl get clusterrolebinding $RELEASE_NAME -o yaml > clusterrolebinding-backup.yaml +kubectl delete clusterrolebinding $RELEASE_NAME +kubectl delete clusterrole $RELEASE_NAME + +# 3. Upgrade to namespaced RBAC +helm upgrade $RELEASE_NAME f5networks/f5-bigip-ctlr \ + --set rbac.namespaced=true \ + --set args.namespaces=$NAMESPACES \ + --set args.bigip_url=$BIGIP_URL \ + --set args.ipam=true \ + --set args.ipam_namespace=kube-system + +# 4. Verify upgrade +kubectl get clusterrole ${RELEASE_NAME}-clusterscope +kubectl get role -A | grep $RELEASE_NAME +kubectl logs -n kube-system deployment/$RELEASE_NAME +``` + +## Security Benefits + +After successful migration to namespaced RBAC: + +- **Principle of least privilege**: Controller only has permissions for specified namespaces +- **Reduced attack surface**: No cluster-wide permissions for most resources +- **Better compliance**: Easier to audit and meet security requirements +- **Namespace isolation**: Clear boundary of controller permissions + +## Additional Resources + +- [F5 CIS RBAC Documentation](https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#cis-installation) +- [Kubernetes RBAC Best Practices](https://kubernetes.io/docs/concepts/security/rbac-good-practices/) +- [Helm Upgrade Documentation](https://helm.sh/docs/helm/helm_upgrade/) diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/README.md b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/README.md new file mode 100644 index 00000000..4c8f1c1a --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/README.md @@ -0,0 +1,161 @@ +# Helm Chart for the F5 Container Ingress Services + +This chart simplifies repeatable, versioned deployment of the [Container Ingress Services](https://clouddocs.f5.com/containers/latest/). + +### Prerequisites +- Refer to [CIS Prerequisites](https://clouddocs.f5.com/containers/latest/userguide/cis-helm.html#prerequisites) to install Container Ingress Services on Kubernetes or Openshift +- [Helm 3](https://helm.sh/docs/intro/) should be installed. + + +## Installing CIS Using Helm Charts + +This is the simplest way to install the CIS on OpenShift/Kubernetes cluster. Helm is a package manager for Kubernetes. Helm is Kubernetes version of yum or apt. Helm deploys something called charts, which you can think of as a packaged application. It is a collection of all your versioned, pre-configured application resources which can be deployed as one unit. This chart creates a Deployment for one Pod containing the [k8s-bigip-ctlr](https://clouddocs.f5.com/containers/latest/), it's supporting RBAC, Service Account and Custom Resources Definition installations. + +## Installing the Chart + +- (Optional) Add BIG-IP credentials as K8S secrets. + +For Kubernetes, use the following command: + +```kubectl create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=``` + +For OpenShift, use the following command: + +```oc create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=``` + +- Add the CIS chart repository in Helm using following command: + +```helm repo add f5-stable https://f5networks.github.io/charts/stable``` + +- Create values.yaml as shown in [examples](https://github.com/F5Networks/charts/tree/master/example_values/f5-bigip-ctlr): + +- Install the Helm chart if BIGIP credential secrets created manually using the following command: + +```helm install -f values.yaml f5-stable/f5-bigip-ctlr``` + +- Install the Helm chart with skip crds if BIGIP credential secrets created manually (without custom resource definitions installations) + +```helm install --skip-crds -f values.yaml f5-stable/f5-bigip-ctlr``` + +- If you want to create the BIGIP credential secret with helm charts use the following command: + +```helm install --set bigip_secret.create="true" --set bigip_secret.username=$BIGIP_USERNAME --set bigip_secret.password=$BIGIP_PASSWORD -f values.yaml f5-stable/f5-bigip-ctlr``` + +## Chart parameters: + +Parameter | Required | Description | Default +----------|-------------|-------------|-------- +bigip_login_secret | Optional | Secret that contains BIG-IP login credentials | f5-bigip-ctlr-login +args.bigip_url | Required | The management IP for your BIG-IP device | **Required**, no default +args.bigip_partition | Required | BIG-IP partition the CIS Controller will manage | f5-bigip-ctlr +args.namespaces | Optional | List of Kubernetes namespaces which CIS will monitor | empty +bigip_secret.create | Optional | Create kubernetes secret using username and password | false +bigip_secret.username | Optional | bigip username to create the kubernetes secret | empty +bigip_secret.password | Optional | bigip password to create the kubernetes secret | empty +rbac.create | Optional | Create ClusterRole and ClusterRoleBinding | true +rbac.namespaced | Optional | Enable namespaced RBAC: per-namespace Roles plus a minimal cluster-scope Role (nodes, namespaces, ingressclasses) | false +serviceAccount.name | Optional | name of the ServiceAccount for CIS controller | f5-bigip-ctlr-serviceaccount +serviceAccount.create | Optional | Create service account for the CIS controller | true +namespace | Optional | name of namespace CIS will use to create deployment and other resources | kube-system +image.user | Optional | CIS Controller image repository username | f5networks +image.repo | Optional | CIS Controller image repository name | k8s-bigip-ctlr +image.pullPolicy | Optional | CIS Controller image pull policy | Always +image.pullSecrets | Optional | List of secrets of container registry to pull image | empty +version | Optional | CIS Controller image tag | latest +nodeSelector | Optional | dictionary of Node selector labels | empty +tolerations | Optional | Array of labels | empty +limits_cpu | Optional | CPU limits for the pod | 100m +limits_memory | Optional | Memory limits for the pod | 512Mi +requests_cpu | Optional | CPU request for the pod | 100m +requests_memory | Optional | Memory request for the pod | 512Mi +affinity | Optional | Dictionary of affinity | empty +securityContext | Optional | Dictionary of deployment pod securityContext. Set to `none` to disable (useful on OpenShift). See [Disabling securityContext](#disabling-securitycontext) | If not set, defaults to runAsUser=1000, runAsGroup=1000, fsGroup=1000 +podSecurityContext | Optional | Dictionary of container-level securityContext for Pod Security Admission and Pod Security Standards | empty +ingressClass.ingressClassName | Optional | Name of ingress class | f5 +ingressClass.isDefaultIngressController | Optional | CIS will monitor all the ingresses resource if set true | false +ingressClass.create | Optional | Create ingress class | true + +Note: bigip_login_secret and bigip_secret are mutually exclusive, if both are defined in values.yaml file bigip_secret will be given priority. + + +See the CIS documentation for a full list of args supported for CIS [CIS Configuration Options](https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html) + +> **Note:** Helm value names cannot include the character `-` which is commonly used in the names of parameters passed to the controller. To accomodate Helm, the parameter names in `values.yaml` use `_` and then replace them with `-` when rendering. +> e.g. `args.bigip_url` is rendered as `bigip-url` as required by the CIS Controller. + + +If you have a specific use case for F5 products in the Kubernetes environment that would benefit from a curated chart, please [open an issue](https://github.com/F5Networks/charts/issues) describing your use case and providing example resources. + +## Disabling securityContext + +By default, the chart applies a pod-level `securityContext` with `runAsUser: 1000`, `runAsGroup: 1000`, and `fsGroup: 1000`. On OpenShift, the Security Context Constraints (SCC) automatically manage these values, so you may need to disable the chart's `securityContext` to avoid conflicts. + +To disable `securityContext`, use any of the following methods: + +**In values.yaml:** +```yaml +securityContext: none +``` + +**Via Helm CLI:** +```shell +helm install f5-stable/f5-bigip-ctlr --set securityContext=none -f values.yaml +``` + +**Via OpenShift Operator CR:** +```yaml +apiVersion: cis.f5.com/v1 +kind: F5BigIpCtlr +metadata: + name: f5bigipctlr-sample +spec: + securityContext: none + # ... other spec fields +``` + +Accepted disable values: `none`, `false`, `no`, `disable`, or an empty map `{}`. + +To customize specific fields: +```yaml +securityContext: + runAsUser: 2000 + runAsGroup: 3000 + fsGroup: 4000 +``` + +Any omitted fields will fall back to the default value of `1000`. + +## Upgrading CIS with Helm and CRDs + +For upgrades that use CIS Custom Resources (for example VirtualServer, TransportServer, Policy, TLSProfile, IngressLink), update CRDs before running `helm upgrade`. + +```shell + export CIS_VERSION= + # For example + # export CIS_VERSION=v2.12.0 + # or + # export CIS_VERSION=2.x-master + # + # the latter if using a CIS image with :latest label + + kubectl create -f https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/${CIS_VERSION}/docs/config_examples/customResourceDefinitions/customresourcedefinitions.yml + + # Then upgrade Helm release + helm upgrade f5-stable/f5-bigip-ctlr -f values.yaml +``` + +Notes: + +- The chart does not automatically manage CRD upgrades during `helm upgrade`. +- Helm hook-based CRD auto-upgrade is not currently provided or supported in this chart. +- If you are not using CIS CRDs, CRD update can be skipped. + +## Uninstalling Helm Chart +Run the following command to uninstall the chart. +```helm uninstall ``` + +Note: When rbac.namespaced=true the chart: +- Skips the default broad ClusterRole/Binding. +- Creates a minimal cluster-scope ClusterRole granting get/list/watch on nodes, namespaces, ingressclasses (and CRDs if ipam enabled). +- Creates a limited Role in the controller namespace (configmaps + secrets only). +- Creates Roles/RoleBindings in each args.namespaces granting required namespace-scoped permissions. diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/crds/f5-bigip-ctlr-customresourcedefinitions.yml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/crds/f5-bigip-ctlr-customresourcedefinitions.yml new file mode 100644 index 00000000..3115a5c8 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/crds/f5-bigip-ctlr-customresourcedefinitions.yml @@ -0,0 +1,1589 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: virtualservers.cis.f5.com +spec: + group: cis.f5.com + names: + kind: VirtualServer + plural: virtualservers + shortNames: + - vs + singular: virtualserver + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + partition: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.]+$' + host: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + hostAliases: + type: array + items: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + hostGroup: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]*[A-z0-9]*$' + hostGroupVirtualServerName: + type: string + pattern: '^[a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$' + httpTraffic: + type: string + enum: [allow, none, redirect] + ipamLabel: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + bigipRouteDomain: + type: integer + minimum: 0 + maximum: 65535 + default: 0 + snat: + type: string + pattern: '^$|^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)+$' + connectionMirroring: + type: string + enum: [ none, L4 ] + tlsProfileName: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + tlsProfileNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + persistenceProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + httpCompressionProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + hostPersistence: + type: object + properties: + method: + type: string + enum: [ sourceAddress, destinationAddress, cookieInsert, cookieRewrite, cookiePassive, cookieHash, universal, hash, carp, none ] + metaData: + type: object + properties: + name: + type: string + key: + type: string + netmask: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + timeout: + type: integer + minimum: 1 + maximum: 65535 + offset: + type: integer + minimum: 1 + maximum: 65535 + length: + type: integer + minimum: 1 + maximum: 65535 + expiry: + type: string + pattern: '^((?:(?:[0-9]+d))|(?:(?:[0-9]+d)?((?:[01]?[0-9]|2[0-3]):[0-5][0-9](?::[0-5][0-9])?)))$' + required: + - method + htmlProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profiles: + type: object + properties: + tcp: + type: object + properties: + client: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + server: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + http2: + type: object + properties: + client: + type: string + pattern: ^(\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*)?$ + server: + type: string + pattern: ^(\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*)?$ + profileProtocolInspection: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + dos: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAccess: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileApiProtection: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + policyPerRequestAccess: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + botDefense: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + policyName: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + policyNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + rewriteAppRoot: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)*([-A-z0-9_.:]+\/?)*$' + waf: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAnalyticsTcp: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileMultiplex: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAdapt: + type: object + properties: + request: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + response: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + allowVlans: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.]+\/?)*$' + type: array + allowSourceRange: + items: + type: string + type: array + httpMrfRoutingEnabled: + type: boolean + iRules: + type: array + items: + type: string + pattern: '^none$|^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + serviceAddress: + type: array + maxItems: 1 + items: + type: object + properties: + arpEnabled: + type: boolean + icmpEcho: + type: string + enum: [enable, disable, selective] + routeAdvertisement: + type: string + enum: [enable, disable, selective, always, any, all] + spanningEnabled: + type: boolean + trafficGroup: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + defaultPool: + type: object + properties: + name: + type: string + pattern: '^([a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$|\/[a-zA-Z]+([A-z0-9-._+]+\/)+([-A-z0-9_.:]+\/?)*$)' + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + loadBalancingMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + nodeMemberLabel: + type: string + pattern: '^[a-zA-Z0-9][-A-Za-z0-9_.\/]{0,61}[a-zA-Z0-9]=(\s?|""|[a-zA-Z0-9][-A-Za-z0-9_.]{0,61}[a-zA-Z0-9])$' + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [ tcp, udp, http, https ] + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip ] + send: + type: string + recv: + type: string + sslProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip, service ] + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + staticPoolMembers: + type: array + items: + type: object + properties: + address: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + port: + type: integer + minimum: 1 + maximum: 65535 + required: + - reference + pools: + type: array + items: + type: object + properties: + name: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + path: + type: string + pattern: '^\/([A-z0-9-_+]+\/)*([-A-z0-9_.:]+\/?)*$' + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + weight: + type: integer + minimum: 0 + maximum: 256 + alternateBackends: + type: array + items: + type: object + properties: + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + weight: + type: integer + minimum: 0 + maximum: 256 + staticPoolMembers: + type: array + items: + type: object + properties: + address: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + port: + type: integer + minimum: 1 + maximum: 65535 + required: + - service + loadBalancingMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + nodeMemberLabel: + type: string + pattern: '^[a-zA-Z0-9][-A-Za-z0-9_.\/]{0,61}[a-zA-Z0-9]=(\s?|""|[a-zA-Z0-9][-A-Za-z0-9_.]{0,61}[a-zA-Z0-9])$' + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + rewrite: + type: string + pattern: '^\/([A-z0-9-_+]+\/)*([-A-z0-9_.:]+\/?)*$' + hostRewrite: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + waf: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + monitor: + type: object + properties: + type: + type: string + enum: [http, https, tcp] + send: + type: string + recv: + type: string + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip] + sslProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [ http, https, tcp ] + send: + type: string + recv: + type: string + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip] + sslProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + minimumMonitors: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + multiClusterServices: + type: array + items: + type: object + properties: + clusterName: + type: string + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + namespace: + type: string + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + weight: + type: integer + minimum: 0 + maximum: 256 + required: + - clusterName + - service + - namespace + - servicePort + staticPoolMembers: + type: array + items: + type: object + properties: + address: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + port: + type: integer + minimum: 1 + maximum: 65535 + virtualServerAddress: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + additionalVirtualServerAddresses: + type: array + items: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + virtualServerName: + type: string + pattern: '^[a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$' + virtualServerHTTPPort: + type: integer + minimum: 1 + maximum: 65535 + virtualServerHTTPSPort: + type: integer + minimum: 1 + maximum: 65535 + x-kubernetes-validations: + - rule: "!has(self.partition) || self.partition != 'Common'" + message: "The partition cannot be 'Common' if specified." + - rule: "has(self.partition) == has(oldSelf.partition) && (!has(self.partition) || self.partition == oldSelf.partition)" + message: "partition cannot be modified. Delete the resource and recreate with new partition" + - rule: "!(has(self.serviceAddress) && !has(oldSelf.serviceAddress))" + message: "'serviceAddress' cannot be added when it is not already present." + - rule: "!(has(oldSelf.serviceAddress) && !has(self.serviceAddress))" + message: "'serviceAddress' cannot be deleted when it is present." + - rule: "has(self.ipamLabel) || has(self.virtualServerAddress)" + message: "either ipamLabel or virtualServerAddress needs to be specified." + status: + type: object + properties: + vsAddress: + type: string + default: None + status: + type: string + default: Pending + lastUpdated: + type: string + error: + type: string + additionalPrinterColumns: + - name: host + type: string + description: hostname + jsonPath: .spec.host + - name: tlsProfileName + type: string + description: TLS Profile attached + jsonPath: .spec.tlsProfileName + - name: httpTraffic + type: string + description: Http Traffic Termination + jsonPath: .spec.httpTraffic + - name: IPAddress + type: string + description: IP address of virtualServer + jsonPath: .spec.virtualServerAddress + - name: ipamLabel + type: string + description: ipamLabel for virtual server + jsonPath: .spec.ipamLabel + - name: IPAMVSAddress + type: string + description: IP address of virtualServer + jsonPath: .status.vsAddress + - name: STATUS + type: string + description: status of VirtualServer + jsonPath: .status.status + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: tlsprofiles.cis.f5.com +spec: + group: cis.f5.com + names: + kind: TLSProfile + plural: tlsprofiles + shortNames: + - tls + singular: tlsprofile + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + tlsCipher: + type: object + properties: + tlsVersion: + type: string + enum: ["1.0", "1.1", "1.2", "1.3"] + disableTLSVersions: + type: array + items: + type: string + enum: ["1.0", "1.1", "1.2", "1.3"] + ciphers: + type: string + cipherGroup: + type: string + hosts: + type: array + items: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + tls: + type: object + properties: + termination: + type: string + enum: [edge, reencrypt, passthrough] + clientSSL: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + clientSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + serverSSL: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + serverSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip, secret, hybrid] + clientSSLParams: + type: object + properties: + renegotiationEnabled: + type: boolean + default: true + profileReference: + type: string + enum: [ bigip, secret ] + dtlsEnabled: + type: boolean + default: true + singleUseDhEnabled: + type: boolean + default: false + serverSSLParams: + type: object + properties: + serverName: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + renegotiationEnabled: + type: boolean + default: true + profileReference: + type: string + enum: [ bigip, secret ] + dtlsEnabled: + type: boolean + default: true + singleUseDhEnabled: + type: boolean + default: false + required: + - termination + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: transportservers.cis.f5.com +spec: + group: cis.f5.com + names: + kind: TransportServer + plural: transportservers + shortNames: + - ts + singular: transportserver + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + partition: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.]+$' + virtualServerAddress: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + virtualServerPort: + type: integer + minimum: 1 + maximum: 65535 + virtualServerName: + type: string + pattern: '^[a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$' + host: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + hostGroup: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]*[A-z0-9]*$' + policyName: + type: string + pattern: '^([A-z0-9-_+])*([A-z0-9])$' + policyNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + mode: + type: string + enum: [standard, performance] + type: + type: string + enum: [tcp, udp, sctp] + default: tcp + tls: + type: object + properties: + clientSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + serverSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip, secret] + snat: + type: string + pattern: '^$|^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)+$' + connectionMirroring: + type: string + enum: [ none, L4 ] + profiles: + type: object + properties: + tcp: + type: object + properties: + client: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + server: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileProtocolInspection: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + persistenceProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + profileAnalyticsTcp: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + dos: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileL4: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + allowVlans: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.]+\/?)*$' + type: array + iRules: + type: array + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + ipamLabel: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + bigipRouteDomain: + type: integer + minimum: 0 + maximum: 65535 + default: 0 + serviceAddress: + type: array + maxItems: 1 + items: + type: object + properties: + arpEnabled: + type: boolean + icmpEcho: + type: string + enum: [enable, disable, selective] + routeAdvertisement: + type: string + enum: [enable, disable, selective, always, any, all] + spanningEnabled: + type: boolean + trafficGroup: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + pool: + type: object + properties: + name: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + weight: + type: integer + minimum: 0 + maximum: 100 + alternateBackends: + type: array + items: + type: object + properties: + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + weight: + type: integer + minimum: 0 + maximum: 100 + required: + - service + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + loadBalancingMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + nodeMemberLabel: + type: string + pattern: '^[a-zA-Z0-9][-A-Za-z0-9_.\/]{0,61}[a-zA-Z0-9]=(\s?|""|[a-zA-Z0-9][-A-Za-z0-9_.]{0,61}[a-zA-Z0-9])$' + monitor: + type: object + properties: + type: + type: string + enum: [tcp, udp, http, https] + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip] + send: + type: string + recv: + type: string + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [ tcp, udp, http, https ] + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [bigip] + send: + type: string + recv: + type: string + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + multiClusterServices: + type: array + items: + type: object + properties: + clusterName: + type: string + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + namespace: + type: string + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + weight: + type: integer + minimum: 0 + maximum: 100 + required: + - clusterName + - service + - namespace + - servicePort + required: + - virtualServerPort + - pool + - mode + x-kubernetes-validations: + - rule: "!has(self.partition) || self.partition != 'Common'" + message: "The partition cannot be 'Common' if specified." + - rule: "has(self.partition) == has(oldSelf.partition) && (!has(self.partition) || self.partition == oldSelf.partition)" + message: "partition cannot be modified. Delete the resource and recreate with new partition" + - rule: "!(has(self.serviceAddress) && !has(oldSelf.serviceAddress))" + message: "'serviceAddress' cannot be added when it is not already present." + - rule: "!(has(oldSelf.serviceAddress) && !has(self.serviceAddress))" + message: "'serviceAddress' cannot be deleted when it is present." + - rule: "has(self.ipamLabel) || has(self.virtualServerAddress)" + message: "either ipamLabel or virtualServerAddress needs to be specified." + status: + type: object + properties: + vsAddress: + type: string + default: None + status: + type: string + default: Pending + lastUpdated: + type: string + error: + type: string + additionalPrinterColumns: + - name: virtualServerAddress + type: string + description: IP address of virtualServer + jsonPath: .spec.virtualServerAddress + - name: virtualServerPort + type: integer + description: Port of virtualServer + jsonPath: .spec.virtualServerPort + - name: pool + type: string + description: Name of service + jsonPath: .spec.pool.service + - name: poolPort + type: string + description: Port of service + jsonPath: .spec.pool.servicePort + - name: ipamLabel + type: string + description: ipamLabel for transport server + jsonPath: .spec.ipamLabel + - name: IPAMVSAddress + type: string + description: IP address of transport server + jsonPath: .status.vsAddress + - name: STATUS + type: string + description: status of TransportServer + jsonPath: .status.status + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + subresources: + status: { } +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: externaldnses.cis.f5.com +spec: + group: cis.f5.com + names: + kind: ExternalDNS + plural: externaldnses + shortNames: + - edns + singular: externaldns + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + domainName: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + dnsRecordType: + type: string + pattern: 'A' + loadBalanceMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + clientSubnetPreferred: + type: boolean + persistenceEnabled: + type: boolean + persistCidrIpv4: + type: integer + minimum: 0 + maximum: 32 + persistCidrIpv6: + type: integer + minimum: 0 + maximum: 128 + ttlPersistence: + type: integer + format: int64 + minimum: 0 + maximum: 4294967295 + pools: + type: array + items: + type: object + properties: + dataServerName: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + dnsRecordType: + type: string + pattern: 'A' + loadBalanceMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + lbModeFallback: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + order: + type: integer + ratio: + type: integer + monitor: + type: object + properties: + type: + type: string + enum: [http, https, tcp] + send: + type: string + recv: + type: string + interval: + type: integer + timeout: + type: integer + required: + - type + - interval + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [http, https, tcp] + send: + type: string + recv: + type: string + interval: + type: integer + timeout: + type: integer + required: + - type + - interval + required: + - dataServerName + required: + - domainName + additionalPrinterColumns: + - name: domainName + type: string + description: Domain name of virtual server resource + jsonPath: .spec.domainName + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + - name: CREATED ON + type: string + jsonPath: .metadata.creationTimestamp +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: ingresslinks.cis.f5.com +spec: + group: cis.f5.com + names: + kind: IngressLink + shortNames: + - il + singular: ingresslink + plural: ingresslinks + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + partition: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.]+$' + virtualServerAddress: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$' + virtualServerName: + type: string + pattern: '^[a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$' + host: + type: string + pattern: '^(([a-zA-Z0-9\*]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$' + ipamLabel: + type: string + pattern: '^[a-zA-Z]+[-A-z0-9_.:]+[A-z0-9]+$' + bigipRouteDomain: + type: integer + minimum: 0 + maximum: 65535 + default: 0 + iRules: + type: array + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + monitors: + type: array + items: + type: object + properties: + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip ] + tls: + type: object + properties: + clientSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + serverSSLs: + type: array + items: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip, secret ] + multiClusterServices: + type: array + items: + type: object + properties: + clusterName: + type: string + namespace: + type: string + service: + type: string + weight: + type: integer + minimum: 0 + maximum: 256 + required: + - clusterName + - namespace + - service + selector: + properties: + matchLabels: + additionalProperties: + type: string + type: object + type: object + serviceAddress: + type: array + maxItems: 1 + items: + type: object + properties: + arpEnabled: + type: boolean + icmpEcho: + type: string + enum: [enable, disable, selective] + routeAdvertisement: + type: string + enum: [enable, disable, selective, always, any, all] + spanningEnabled: + type: boolean + trafficGroup: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + x-kubernetes-validations: + - rule: "!has(self.partition) || self.partition != 'Common'" + message: "The partition cannot be 'Common' if specified." + - rule: "has(self.partition) == has(oldSelf.partition) && (!has(self.partition) || self.partition == oldSelf.partition)" + message: "partition cannot be modified. Delete the resource and recreate with new partition" + - rule: "has(self.ipamLabel) || has(self.virtualServerAddress)" + message: "either ipamLabel or virtualServerAddress needs to be specified." + status: + type: object + properties: + vsAddress: + type: string + status: + type: string + default: pending + lastUpdated: + type: string + error: + type: string + additionalPrinterColumns: + - name: IPAMVSAddress + type: string + description: IP address of virtualServer + jsonPath: .status.vsAddress + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + subresources: + status: { } +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + app.kubernetes.io/instance: f5-bigip-ctlr + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: f5-bigip-ctlr + name: policies.cis.f5.com +spec: + group: cis.f5.com + names: + kind: Policy + shortNames: + - plc + singular: policy + plural: policies + scope: Namespaced + versions: + - + name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + l7Policies: + type: object + properties: + profileApiProtection: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + waf: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAccess: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + policyPerRequestAccess: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileAdapt: + type: object + properties: + request: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + response: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + l3Policies: + type: object + properties: + dos: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + botDefense: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + firewallPolicy: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([A-z0-9]+\/?)*$' + ipIntelligencePolicy: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + allowSourceRange: + items: + type: string + type: array + allowVlans: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)*([A-z0-9-_.\s]+\/?)*$' + type: array + ltmPolicies: + type: object + properties: + insecure: + type: string + pattern: '^\/[a-zA-Z]+([-A-z0-9_+:]+\/)+([A-z0-9]+\/?)*$' + secure: + type: string + pattern: '^\/[a-zA-Z]+([-A-z0-9_+:]+\/)+([A-z0-9]+\/?)*$' + priority: + type: string + enum: [low, high] + iRules: + type: object + properties: + insecure: + type: string + pattern: '^none$|^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + secure: + type: string + pattern: '^none$|^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + priority: + type: string + enum: [ low, high ] + iRuleList: + type: array + items: + type: string + pattern: '^none$|^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + defaultPool: + type: object + properties: + name: + type: string + pattern: '^([a-zA-Z]+([A-z0-9-._+])*([A-z0-9])$|\/[a-zA-Z]+([A-z0-9-._+]+\/)+([-A-z0-9_.:]+\/?)*$)' + service: + type: string + pattern: '[a-z]([-a-z0-9]*[a-z0-9])?' + servicePort: + x-kubernetes-int-or-string: true + anyOf: + - type: integer + - type: string + serviceNamespace: + type: string + pattern: '^[a-zA-Z]+([-A-z0-9_.+:])*([A-z0-9])+$' + loadBalancingMethod: + type: string + pattern: '^[a-z]+[a-z_-]+[a-z]+$' + nodeMemberLabel: + type: string + pattern: '^[a-zA-Z0-9][-A-Za-z0-9_.\/]{0,61}[a-zA-Z0-9]=(\s?|""|[a-zA-Z0-9][-A-Za-z0-9_.]{0,61}[a-zA-Z0-9])$' + monitors: + type: array + items: + type: object + properties: + type: + type: string + enum: [ tcp, udp, http, https ] + interval: + type: integer + timeout: + type: integer + timeUntilUp: + type: integer + minimum: 0 + maximum: 1800 + targetPort: + type: integer + name: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip ] + send: + type: string + recv: + type: string + sslProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + reference: + type: string + enum: [ bigip, service ] + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + staticPoolMembers: + type: array + items: + type: object + properties: + address: + type: string + pattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$' + port: + type: integer + minimum: 1 + maximum: 65535 + required: + - reference + profiles: + type: object + properties: + tcp: + type: object + properties: + client: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + server: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + udp: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + http: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + httpProfiles: + type: object + properties: + insecure: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + secure: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + http2: + type: object + properties: + client: + type: string + pattern: ^(\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*)?$ + server: + type: string + pattern: ^(\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*)?$ + persistenceProfile: + type: string + pattern: '^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)*$' + profileAnalyticsTcp: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileL4: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileWebSocket: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileMultiplex: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + rewriteProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([A-z0-9]+\/?)*$' + logProfiles: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)*([-A-z0-9._\s]+\/?)*$' + type: array + requestLogProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + httpMrfRoutingEnabled: + type: boolean + sslProfiles: + type: object + properties: + clientProfiles: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + type: array + serverProfiles: + items: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + type: array + analyticsProfiles: + type: object + properties: + http: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + htmlProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + ftpProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + httpCompressionProfile: + type: string + pattern: '^\/[a-zA-Z]+([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + profileProtocolInspection: + type: string + pattern: '^\/([A-z0-9-_+]+\/)+([-A-z0-9_.:]+\/?)*$' + autoLastHop: + type: string + enum: [ default, auto, disable ] + snat: + type: string + pattern: '^$|^\/?[a-zA-Z]+([-A-z0-9_+]+\/)*([-A-z0-9_.:]+\/?)+$' + poolSettings: + type: object + properties: + reselectTries: + type: integer + minimum: 0 + maximum: 65535 + serviceDownAction: + type: string + slowRampTime: + type: integer + minimum: 0 + maximum: 900 + multiPoolPersistence: + type: object + properties: + method: + type: string + enum: [ uieSourceAddress, hashSourceAddress ] + timeOut: + type: integer + minimum: 1 + default: 180 diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/NOTES.txt b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/NOTES.txt new file mode 100644 index 00000000..302512a9 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/NOTES.txt @@ -0,0 +1,6 @@ +Container Ingress Services controller: {{ .Release.Name }} + +Controller Documentation: +- Kubernetes: https://clouddocs.f5.com/containers/latest/userguide/kubernetes/ +- OpenShift: https://clouddocs.f5.com/containers/latest/userguide/openshift/ + diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/_helpers.tpl b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/_helpers.tpl new file mode 100644 index 00000000..7ce05d2e --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/_helpers.tpl @@ -0,0 +1,64 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "f5-bigip-ctlr.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "deployment.apiVersion" -}} +{{- if semverCompare ">=1.9-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "apps/v1" -}} +{{- else -}} +{{- print "extensions/v1beta1" -}} +{{- end -}} +{{- end -}} + +{{/* +Check for user given namespace or give kube-system +*/}} +{{- define "f5-bigip-ctlr.namespace" -}} +{{- if hasKey .Values "namespace" -}} +{{- .Values.namespace -}} +{{- else -}} +{{- print "kube-system" -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "f5-bigip-ctlr.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "f5-bigip-ctlr.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + + {{/* +Create the name of the service account to use +*/}} +{{- define "f5-bigip-ctlr.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "f5-bigip-ctlr.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrole.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrole.yaml new file mode 100644 index 00000000..16a753f4 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrole.yaml @@ -0,0 +1,119 @@ +{{- if and .Values.rbac.create (not .Values.rbac.namespaced) -}} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "f5-bigip-ctlr.fullname" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: + - '' + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - nodes + - services + - endpoints + - namespaces + - ingresses + - pods + - ingressclasses + - policies + - routes + verbs: + - get + - list + - watch + - apiGroups: + - '' + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - events + - ingresses/status + - services/status + - routes/status + verbs: + - get + - list + - watch + - update + - create + - patch + - apiGroups: + - cis.f5.com + resources: + - virtualservers + - virtualservers/status + - tlsprofiles + - transportservers + - transportservers/status + - ingresslinks + - ingresslinks/status + - externaldnses + - policies + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - '' + - extensions + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - config.openshift.io/v1 + resources: + - network + verbs: + - list + - apiGroups: + - crd.projectcalico.org + resources: + - blockaffinities + verbs: + - get + - watch + - list +{{- if .Values.args.ipam }} + - apiGroups: + - fic.f5.com + resources: + - ipams + - ipams/status + verbs: + - get + - list + - watch + - update + - create + - patch + - delete + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - update + - create + - patch +{{- end }} +{{- end }} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrolebinding.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrolebinding.yaml new file mode 100644 index 00000000..3836caff --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrolebinding.yaml @@ -0,0 +1,23 @@ +{{- if and .Values.rbac.create (not .Values.rbac.namespaced) -}} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "f5-bigip-ctlr.fullname" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "f5-bigip-ctlr.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "f5-bigip-ctlr.serviceAccountName" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} +{{- end -}} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-deploy.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-deploy.yaml new file mode 100644 index 00000000..a7b778a6 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-deploy.yaml @@ -0,0 +1,181 @@ +{{- if or (not .Values.args.bigip_url) (not .Values.args.bigip_partition) }} +{{/* +Generate errors for missing required values. +*/}} +# {{required "BIG-IP url not specified - add to Values or pass with `--set` " .Values.args.bigip_url }} +# {{required "BIG-IP partition not specified - add to Values or pass with `--set` " .Values.args.bigip_partition }} +{{- else -}} +apiVersion: {{ template "deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "f5-bigip-ctlr.fullname" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "-" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: 1 + selector: + matchLabels: + app: {{ template "f5-bigip-ctlr.name" . }} + template: + metadata: + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + release: {{ .Release.Name }} + spec: +{{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | indent 8 }} +{{- end }} + serviceAccountName: {{ template "f5-bigip-ctlr.serviceAccountName" . }} +{{- if .Values.image.pullSecrets }} + imagePullSecrets: + {{- range $pullSecret := .Values.image.pullSecrets }} + - name: {{ $pullSecret }} + {{- end }} +{{- end }} + {{- $oscpOperator := .Files.Glob "oscp-operator.txt" }} + {{- $scType := kindOf .Values.securityContext }} + {{- $scDisabled := false }} + {{- $scIsMap := false }} + {{- if eq $scType "string" }} + {{- $scVal := lower (trim .Values.securityContext) }} + {{- if or (eq $scVal "") (eq $scVal "none") (eq $scVal "false") (eq $scVal "no") (eq $scVal "disable") (eq $scVal "{}") }} + {{- $scDisabled = true }} + {{- end }} + {{- else if eq $scType "bool" }} + {{- if not .Values.securityContext }} + {{- $scDisabled = true }} + {{- end }} + {{- else if eq $scType "map" }} + {{- if eq (len .Values.securityContext) 0 }} + {{- $scDisabled = true }} + {{- else }} + {{- $scIsMap = true }} + {{- end }} + {{- else if eq $scType "slice" }} + {{- $scDisabled = true }} + {{- end }} + {{- if $scDisabled }} + {{- /* securityContext disabled - do not add securityContext to the deployment */ -}} + {{- else if $scIsMap }} + securityContext: + {{- $sc := .Values.securityContext }} + {{- if (index $sc "runAsUser") }} + runAsUser: {{ index $sc "runAsUser" }} + {{- else if (not $oscpOperator) }} + runAsUser: 1000 + {{- end }} + {{- if (index $sc "runAsGroup") }} + runAsGroup: {{ index $sc "runAsGroup" }} + {{- else if (not $oscpOperator) }} + runAsGroup: 1000 + {{- end }} + {{- if (index $sc "fsGroup") }} + fsGroup: {{ index $sc "fsGroup" }} + {{- else if (not $oscpOperator) }} + fsGroup: 1000 + {{- end }} + {{- else }} + securityContext: + {{- if (not $oscpOperator) }} + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + {{- end }} + {{- end }} + containers: + - name: {{ template "f5-bigip-ctlr.name" . }} + image: "{{ .Values.image.user }}/{{ .Values.image.repo }}:{{ .Values.version }}" + {{- if .Values.podSecurityContext }} + securityContext: +{{ toYaml .Values.podSecurityContext | indent 12 }} + {{- end }} + livenessProbe: + failureThreshold: 3 + httpGet: + path: /health + port: 8080 + scheme: HTTP + initialDelaySeconds: 15 + periodSeconds: 120 + successThreshold: 1 + timeoutSeconds: 15 + readinessProbe: + failureThreshold: 3 + httpGet: + path: /health + port: 8080 + scheme: HTTP + initialDelaySeconds: 30 + periodSeconds: 120 + successThreshold: 1 + timeoutSeconds: 15 + volumeMounts: + - name: bigip-creds + mountPath: "/tmp/creds" + readOnly: true + {{- if .Values.podSecurityContext }} + {{- if .Values.podSecurityContext.readOnlyRootFilesystem }} + - name: tmp + mountPath: /tmp + {{- end }} + {{- end }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /app/bin/k8s-bigip-ctlr + args: +{{- if .Values.ingressClass.ingressClassName }} + - --ingress-class={{ .Values.ingressClass.ingressClassName | default "f5" }} +{{- end }} + - --credentials-directory + - /tmp/creds + {{- $ns := .Values.args.namespaces }} + {{- range $key, $value := .Values.args }} + {{- if eq $key "namespaces" }} + {{- range $ns}} + - --namespace={{ . }} + {{- end }} + {{- else }} + - --{{ $key | replace "_" "-"}}={{ $value }} + {{- end }} + {{- end }} + resources: + limits: + cpu: {{ .Values.limits_cpu | default "100m" }} + memory: {{ .Values.limits_memory | default "512Mi" }} + requests: + cpu: {{ .Values.requests_cpu | default "100m" }} + memory: {{ .Values.requests_memory | default "512Mi" }} +{{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} +{{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 6}} +{{- end }} + volumes: + - name: bigip-creds + secret: + {{- if .Values.bigip_secret.create }} + secretName: f5-bigip-ctlr-login + {{- else }} + secretName: {{ .Values.bigip_login_secret }} + {{- end }} + {{- if .Values.podSecurityContext }} + {{- if .Values.podSecurityContext.readOnlyRootFilesystem }} + - name: tmp + emptyDir: {} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-ingress-class.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-ingress-class.yaml new file mode 100644 index 00000000..2105a219 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-ingress-class.yaml @@ -0,0 +1,12 @@ +{{- if .Values.ingressClass.create -}} + +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + name: {{ .Values.ingressClass.ingressClassName | default "f5" }} + annotations: + ingressclass.kubernetes.io/is-default-class: "{{ .Values.ingressClass.isDefaultIngressController | default false }}" +spec: + controller: f5.com/cntr-ingress-svcs + +{{- end -}} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-minimal-clusterscope.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-minimal-clusterscope.yaml new file mode 100644 index 00000000..28e32d1d --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-minimal-clusterscope.yaml @@ -0,0 +1,60 @@ +{{- /* +Minimal cluster-scoped RBAC when rbac.namespaced=true. +Provides only the cluster-scoped resources required by the controller. +*/ -}} +{{- if and .Values.rbac.create .Values.rbac.namespaced }} +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "f5-bigip-ctlr.fullname" . }}-clusterscope + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: [''] + resources: ["nodes"] + verbs: ["get", "list", "watch"] + - apiGroups: [ "crd.projectcalico.org" ] + resources: [ "blockaffinities" ] + verbs: [ "get", "watch", "list" ] +{{- if .Values.args.namespace_label }} + - apiGroups: [''] + resources: ["namespaces"] + verbs: ["get", "list", "watch"] +{{- end }} + - apiGroups: ["networking.k8s.io"] + resources: ["ingressclasses"] + verbs: ["get", "list", "watch"] +{{- if .Values.args.ipam }} + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "watch", "create", "update", "patch"] +{{- end }} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "f5-bigip-ctlr.fullname" . }}-clusterscope + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "f5-bigip-ctlr.fullname" . }}-clusterscope +subjects: + - kind: ServiceAccount + name: {{ template "f5-bigip-ctlr.serviceAccountName" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} +{{- end }} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-namespaced-rbac.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-namespaced-rbac.yaml new file mode 100644 index 00000000..5ca2642f --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-namespaced-rbac.yaml @@ -0,0 +1,177 @@ +{{- /* +Namespaced RBAC template for F5 BIG-IP Controller + +This template creates namespace-scoped Roles and RoleBindings when rbac.namespaced=true. +It provides minimal permissions per namespace instead of cluster-wide access. + +Creates three types of RBAC: +1. Controller namespace: ConfigMap-only permissions (if not in watched namespaces) +2. Watched namespaces: Full CIS resource permissions for each namespace in args.namespaces +3. IPAM namespace: IPAM resource permissions in the namespace specified by args.ipam_namespace + +A minimal ClusterRole is created separately (see f5-bigip-ctlr-minimal-clusterscope.yaml). +*/ -}} +{{- if and .Values.rbac.create .Values.rbac.namespaced }} +{{- $saName := include "f5-bigip-ctlr.serviceAccountName" . -}} +{{- $controllerNs := include "f5-bigip-ctlr.namespace" . -}} +{{- $namespaces := .Values.args.namespaces | default list -}} + +{{- if not (has $controllerNs $namespaces) }} +--- +# Controller namespace limited RBAC (configmaps only) +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "configmap-%s-%s" (include "f5-bigip-ctlr.fullname" $) $controllerNs | trunc 63 | trimSuffix "-" }} + namespace: {{ $controllerNs }} + labels: + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" $ }} + app: {{ template "f5-bigip-ctlr.name" $ }} + chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} +rules: + - apiGroups: [''] + resources: ["configmaps"] + verbs: ["get", "list", "watch", "create", "update", "patch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "configmap-%s-%s" (include "f5-bigip-ctlr.fullname" $) $controllerNs | trunc 63 | trimSuffix "-" }} + namespace: {{ $controllerNs }} + labels: + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" $ }} + app: {{ template "f5-bigip-ctlr.name" $ }} + chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} +subjects: + - kind: ServiceAccount + name: {{ $saName }} + namespace: {{ $controllerNs }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ printf "configmap-%s-%s" (include "f5-bigip-ctlr.fullname" $) $controllerNs | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- range $i, $ns := $namespaces }} +--- +# Namespaced RBAC for managed namespace {{ $ns }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "%s-%s" (include "f5-bigip-ctlr.fullname" $) $ns | trunc 63 | trimSuffix "-" }} + namespace: {{ $ns }} + labels: + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" $ }} + app: {{ template "f5-bigip-ctlr.name" $ }} + chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} +rules: + - apiGroups: [''] + resources: ["services", "endpoints", "pods", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: ["", "apps", "extensions", "networking.k8s.io", "route.openshift.io"] + resources: ["ingresses", "routes"] + verbs: ["get", "list", "watch"] + - apiGroups: [''] + resources: ["configmaps", "events"] + verbs: ["get", "list", "watch", "create", "update", "patch"] + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses/status"] + verbs: ["get", "update", "patch"] + - apiGroups: ["route.openshift.io"] + resources: ["routes/status"] + verbs: ["get", "update", "patch"] + - apiGroups: [''] + resources: ["services/status"] + verbs: ["get", "list", "watch", "update", "create", "patch"] + - apiGroups: ["cis.f5.com"] + resources: ["virtualservers", "tlsprofiles", "transportservers", "externaldnses", "ingresslinks", "virtualservers/status", "transportservers/status", "ingresslinks/status", "policies"] + verbs: ["get", "list", "watch", "update", "patch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "%s-%s" (include "f5-bigip-ctlr.fullname" $) $ns | trunc 63 | trimSuffix "-" }} + namespace: {{ $ns }} + labels: + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" $ }} + app: {{ template "f5-bigip-ctlr.name" $ }} + chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} +subjects: + - kind: ServiceAccount + name: {{ $saName }} + namespace: {{ $controllerNs }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ printf "%s-%s" (include "f5-bigip-ctlr.fullname" $) $ns | trunc 63 | trimSuffix "-" }} +{{ end }} +{{ end }} + +{{- /* +IPAM namespace RBAC - when IPAM is enabled and using namespaced RBAC, +create additional Role/RoleBinding for the IPAM namespace. +This is always created when IPAM is enabled, regardless of whether the +IPAM namespace is already included in the watched namespaces list. +*/ -}} +{{- if and .Values.rbac.create .Values.rbac.namespaced .Values.args.ipam }} +{{- $ipamNamespace := .Values.args.ipam_namespace | default "kube-system" -}} +{{- $controllerNs := include "f5-bigip-ctlr.namespace" . -}} +{{- $saName := include "f5-bigip-ctlr.serviceAccountName" . -}} +--- +# IPAM namespace RBAC for namespace {{ $ipamNamespace }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "ipam-%s" (include "f5-bigip-ctlr.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ $ipamNamespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: ["fic.f5.com"] + resources: ["ipams", "ipams/status"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "ipam-%s" (include "f5-bigip-ctlr.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ $ipamNamespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +subjects: + - kind: ServiceAccount + name: {{ $saName }} + namespace: {{ $controllerNs }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ printf "ipam-%s" (include "f5-bigip-ctlr.fullname" .) | trunc 63 | trimSuffix "-" }} +{{- end }} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-secrets.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-secrets.yaml new file mode 100644 index 00000000..18141583 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-secrets.yaml @@ -0,0 +1,19 @@ +{{- if .Values.bigip_secret.create -}} +apiVersion: v1 +kind: Secret +metadata: + name: f5-bigip-ctlr-login + namespace: {{ template "f5-bigip-ctlr.namespace" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +type: Opaque +data: + username: {{ .Values.bigip_secret.username | b64enc | quote }} + password: {{ .Values.bigip_secret.password | b64enc | quote }} +{{- end -}} \ No newline at end of file diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-serviceaccount.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-serviceaccount.yaml new file mode 100644 index 00000000..5729a8bc --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/f5-bigip-ctlr-serviceaccount.yaml @@ -0,0 +1,17 @@ +{{- if .Values.rbac.create -}} +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "f5-bigip-ctlr.serviceAccountName" . }} + namespace: {{ template "f5-bigip-ctlr.namespace" . }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ template "f5-bigip-ctlr.name" . }} + app: {{ template "f5-bigip-ctlr.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- end -}} +{{- end -}} diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/validate-rbac-namespaced.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/validate-rbac-namespaced.yaml new file mode 100644 index 00000000..ec5f4562 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/templates/validate-rbac-namespaced.yaml @@ -0,0 +1,10 @@ +{{- /* +Abort if rbac.namespaced=true and args.namespaces is not a non-empty list. +This template produces no manifest output on success. +*/ -}} +{{- if .Values.rbac.namespaced }} + {{- $ns := .Values.args.namespaces | default nil }} + {{- if or (not $ns) (not (kindIs "slice" $ns)) (eq (len $ns) 0) }} + {{- fail "rbac.namespaced=true requires args.namespaces to be a non-empty list, e.g.\nargs:\n namespaces: [\"foo\", \"bar\"]" }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/values.yaml b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/values.yaml new file mode 100644 index 00000000..3e0dfed7 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/values.yaml @@ -0,0 +1,110 @@ +# For additional information on installing the k8-bigip-ctlr please see: +# Kubernetes: https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#cis-installation +# OpenShift: https://clouddocs.f5.com/containers/latest/userguide/openshift/#cis-installation +# +# access / permissions / RBAC +# To create a secret using kubectl see +# https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#installing-cis-manually +bigip_login_secret: f5-bigip-ctlr-login + +bigip_secret: + create: false + username: + password: + +rbac: + create: true + # When set to true, create namespaced Roles/RoleBindings (one per namespace in args.namespaces) + # granting only ConfigMap and Secret access instead of a cluster-wide ClusterRole. + # Ensure args.namespaces is defined as a non-empty list when enabling this. + # + # IMPORTANT: When upgrading from cluster-wide RBAC (namespaced: false) to namespaced RBAC (namespaced: true), + # you must manually clean up the old ClusterRole and ClusterRoleBinding resources before upgrading. + # See RBAC-UPGRADE-GUIDE.md for detailed instructions. + namespaced: false +serviceAccount: + # Specifies whether a service account should be created + create: true + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: f5-bigip-ctlr-serviceaccount +# This namespace is where the Controller lives; +namespace: kube-system + +ingressClass: + create: true + ingressClassName: f5 + isDefaultIngressController: true +args: + # See https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html + # NOTE: helm has difficulty with values using `-`; `_` are used for naming + # and are replaced with `-` during rendering. + # REQUIRED Params + bigip_url: ~ + bigip_partition: f5-bigip-ctlr + # OPTIONAL PARAMS -- uncomment and provide values for those you wish to use. + # verify_interval: + # node-poll_interval: + # log_level: + # python_basedir: ~ + # VXLAN + # openshift_sdn_name: + # flannel_name: + # KUBERNETES + # default_ingress_ip: + # kubeconfig: + # namespaces: ["foo", "bar"] + # namespace_label: + # node_label_selector: + # pool_member_type: + # resolve_ingress_names: + # running_in_cluster: + # use_node_internal: + # use_secrets: + # insecure: true + # custom-resource-mode: true + # log-as3-response: true + # gtm-bigip-password + # gtm-bigip-url + # gtm-bigip-username + # ipam : true + # ipam_namespace: kube-system + +image: + # Use the tag to target a specific version of the Controller + user: f5networks + repo: k8s-bigip-ctlr + pullPolicy: Always +version: latest +# affinity: +# nodeAffinity: +# requiredDuringSchedulingIgnoredDuringExecution: +# nodeSelectorTerms: +# - matchExpressions: +# - key: kubernetes.io/arch +# operator: Exists +# Pod-level securityContext for the CIS controller deployment. +# If not set, defaults to runAsUser=1000, runAsGroup=1000, fsGroup=1000. +# securityContext: +# runAsUser: 1000 +# runAsGroup: 3000 +# fsGroup: 2000 +# +# To disable securityContext entirely (useful on OpenShift where SCC manages +# security settings automatically), set securityContext to one of: +# "none", "false", "no", "disable", or an empty map {} +# Examples: +# securityContext: none # via values.yaml or --set securityContext=none +# securityContext: {} # via values.yaml +# securityContext: none +# If you want to specify resources, uncomment the following +# limits_cpu: 100m +# limits_memory: 512Mi +# requests_cpu: 100m +# requests_memory: 512Mi +# Set podSecurityContext for Pod Security Admission and Pod Security Standards +# podSecurityContext: +# runAsUser: 1000 +# runAsGroup: 1000 +# privileged: true +# readOnlyRootFilesystem: true \ No newline at end of file diff --git a/packs/f5-bigip-ctlr-0.0.38/logo.png b/packs/f5-bigip-ctlr-0.0.38/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..72af0bccc933edfaf00f947f90fdd5962eebf898 GIT binary patch literal 20435 zcma%jby(AH*e{Z!Ljk2bBn6cmF&d;Lq>)l-28`|y=@6tP6c8zq7#-3zLO>ZE8z7^* z&R2i$d#>yJceohabKjpkpZm#uFJg4GR7i>Fh_JA*NYzvo^{}vT(0^Yb9Dw2%$T1DP z9qK%LuJr7+`x+MCI=(RQ_y7LxIY*&6)c$K8Wq zHr@Vz{2YX3tdldX9vjk zqsEHqc^P(UKqsM_>I*0q7BSV|*PV&^perma7A!SI`R6`4JGl;~Y$G!}cPMq9-+M4w zx(bHn1p9c1OAy>SmRP)<%ps=Z_=EY(_vcG%`Sk85NiEpqkV&0>ot)qIxt$Zcs+n!D zXT~#fx9?YF(LL>rW>=;yR9OAR^KF~Qe)BG;#TJvA5}V%54Xq2B&4F>+3?ZcqLNpkC z*OkiRIq=Rgi!WA}NBz`ksd`30TvJKw(8&WC7cBADi$5sOWVq)i7f20#u%w~&I^qoq zV)kXQue(@{lQO$riN(AD8M+Oy1XVDWch39~6YlKM=eQ>0`8&defxdpi=K`siO->pZ z7TH9bG&N?59D0NZ|9z*F1ux!Jyz4hv2NSJWgLRrAl?b;Z?;ha&w#`EI_8S47t`7wc|3+u$H!|$-9%(A$X?gML4=T7r zk|3O}KQ;0cOm5*haF8-s+^0k3@-ZxO;0_s+@SQP1VsW3Pd>bEc-#EeLrBH1_3WtmV zLi^`fu2znM4~`n{2z{@4LaRlqM^Kq#<5(F&x#H0gYSV8%EBdC4sAoGEjTHLq2PQjYs8i{NUS)62J%1>QYDiA&FNcG+q@}5(HdUx-*37P%Hed zT_Sjg2U(oFmN`97B+gSSzv71pxx9G&X_f(cZ zRL%$TdZa#BF;9PeWTieUAifm5uecl{q$PZ5&i~;CB<+#ioEH%`;k}f>J~cqN#!%1b zgU{>b&f-fZ9uk;==Onds=fs?Vz!Adspo8?C!%FyX zZwjobw!ZcI4%}fZIbCfkxB_J?_g`9$ zI4{GK7-TbihU5d>&<{mH-FGNiIQj^?+~kN#Q&w?mZ9^C+0#Iy2ZkLl*!uR7Y@r-Jz zqGDY&@xvVtT<`F4gW777v>UJe_8RXU&y};*{xZ1TkGYcRzzN%B$l<=N_r_1XnRl}P z;xag=a+`eR-GLRhyPyU?ZxOwJDk}{Nh;Aq+JWmX9)j7vxDo(!9PP{H~jdb0Agh{%k z^1*xkG@nDFeC9nGWs`beoAkCQ#a|<-c-xQsU1USN3yQMmAz2v~(C+ za9{MEK3GWQyR#57ah;@kamAa^OS}PVPa?){lM~A(r$U?`pS^puG97nnIbe6k@}p-j zwE2d0YlB$pMZA+- zVxD=RO!Bty%a5NFvoM;EM{jJmq<{4UjF6N_yJ3AY zVykHbZ}tTATxze?hf3-A;bC9?)UzC(3E+fbGHzR>=g#fiaXpozTOpgD-cFuh8(hSm zXEC>&1h$_o1-cJk8niDma|;CWwBo*&yv@_Gdxm4Y^YQ6dXO^NDpsOwhFxiYL2u(2PWf#h3lwPO0S*e%T{YLq9F@w;s`Z z6Q~`|?dq39ok@%`G;mNZay8SkZz#cOZILXw4)sqKBg@q0k#Morg>`k=2PFN$yda+I zyAqPOg8mPsWcf9>SZ};XGjy-|LOW`g+y&>}i5|RSOSZ&KIM`?(>ZyXt4tr$Ma`@(S z7_+RK+4cv-+zQe@MFl1GJiMh^oK@HqkdTZXmfbh!;%3>}e@fr`{0gL54xxL&a_D@O zJ`m}RspG#VOU7KS;@!{FLj+a^F>p49hx(GM?XP_;bTp z{O*&`8-bx9D81RC)0bR-!rJ9n4MD-~uFSVUw+{SJk!?J#x=^xC*S7?)tc7^K|lk_pLIMoq|W!(DBK5 zu+z6jRI061Leb%?%D|H=RY7}eM}ov_ROY*mC3^UoJ;yGRP?P4=46>U{<=EcmzEitj z;50m0e9IcBVx1{B+6~vIkvh$)4#;@LrdEiHynRdMm~Z(c-o}gRk~u8(GTrN=g!Ytx zy3^o#o>Gdypf0JU&D&Q&4#p<#U?w8--#Za``A{KiR@lLr2&i>2X(lvZT)wfu;O6{7 zX=PArVM=*z3#s9gZ@%-ro0Hiuk;VYD^w^jJDOm6$EQ zSez-jAv9Y^cjY%M0p@jWpeKHlYi4Do-H8)BqRB7)C05gJvAZ8i*YnJH29ejs*}%hHLc$#yIkDd@9gZ-s~NxE@xZ@> zELa6M1yq3Jp8U|Fbt|AVqrB1m3~r8dVssD-FfZmFdof8;oSHKD`sBQAW8LzeKj63X zyk=ezdX2xv)L-7AmZK+rOOR0kZ;Q2C7U0(IfHQLqgqY2~Yg}Z9oA0&-#;T>+&7UMJ zA?cH>&EGYIU}SVjoB}KNh@2YFZ%fPuA>_! z>IzCHNnS6XIQgZXP0qd|ZP(1;@pMcbZ%#9>n$u*sGor}uXSz5^ntOyptxLXfb{9N5 zrRynp79Wgxp%KdN-i#Fe-XIY_8UhvL2zB!N_~LH+Uf)MYLZ+CxPf*m0Ef=tl8|HKA z*k^)=?zimUjBG32T|+F(nseWipj;9Tc<+U(BZJ?8StSm_+I|#GG2Xg#!n2E7(BNU= z{zmJ@S*at^wqi`mU&C|zyKjB&QGO=4Za_2ZwIp52EJ{xy#5t!wyJ6CKFq*RLRagZ3 zS;o_|@nDB8z;w(LahT~%alIILIH|FJ`DDge$^ECe`n)d}IH#HMjfS;CTATOEGr#$s zpId%?N?Vw2fn}tCt_cx6TkUl6o?c+m(7VLCDaOBv5-c6AVI=7Ps^lcI`0`n$2DZ1} zsSX7e$|Zh~!8BypWP6b7+Q*hy)@TA(b1vZ@`4w9zXI=loTa za0RAJal=0PN;nSx{^3$kSr4Z5RdX51s5{fwyI9MmgsReBn^3f7@fxbl@D7E-R)VQ` zW1`wQwBkllYZJxe&$leJ;=`dZ8;>$I)D@@uOHV=H*c&zWvdhg5fLsLikYD4V^w)}jIXl(>4tIPkF6SgTWs6qj8xjZdT*9z_3#sh^Iv@SnOzbS1yGk&K@C(* zue7P2pqHy;G~m|zu1!i^!ic%Xp$YiAkC$YNXp2Df&OKvsn3$n!>briaTK8Lp^wIaY z^Dwlu%-B=y{Xn$)5@Sv?{dR+z{95j>##pq*{AX=JU4q=s;>F!l=GI;+AV0olvTFOu zF#ACPIf3h)EjT)urNj1>G=}Eq{W8MCN9V9W8ewf}U=v&z}SGk+yD%T$3;K(e3Kj zPAo^-OGxvATG`Q<;ll1L2rb>)a6|)u`eaMbBb+&!3CW;)%NLWsMx4{kXXkL1OI4s0 z^@NK1F~#YZM&A)xz(`t~#ze|yj!Hr7*SDs+7t3p)oMzEPyQ=u=8oeBIwB-*M1nUv0 z8)h`kNI!P#87l4v;ljsQu!saUApD%+oc$qF--DRT7e^%udij|^%+Cz4Rdl2iM5(x+ zhFf42&`PIrCvvw0`sV2eKT6P4G^1L=2jL{BR*Ynk6ooZA{ZO_Kd8D zR`qx0))NKQKn4fcmosBQ_=+?ji+|?-KH|sf{bv33^tMXYj2v#jp()05_Cm||(2iQq zRk8xw4tTS^A=YI~#PV1iP9F6=>mjYbvjaH37lUGBw3qYW8RoYDE*3G7+z zm6F-}`i=+jQW0&qqw_fHc-4-D87-oprz0{3`9l#UZkQkzZLf@e-lx4&CMs?2(Fo!t zxSQ>AQo^%`W6|qqf6bOYvPvr)1 zjUnH^Jm|$U-|{8BoHCMFyOYyQK=;Y@rNPMF&q1W)c>p4T426kwI55+AJM|$*tLg`B z7)ojvyPzBHU*NIzgG@{@f_2Fham-IeA(_)mn?)-8pa&sgvtOPt^_vfW81Onwdd7q8 zUY7_>dyqEfQ0=}rjCo2kcb2OwWz_iUi-UYLVj0=0Bjxondr3o*=7@7`1qx)2IDY$4 z7;V=}c}s|(jMx&g716@P?&eAi05rEUC-4Epu|9V_VN0=%yk$zD)L-Kd6U_NI(J2Xd ztt|e39qe2K6Ezh(Eao+_{cA5TO~p843vR|8a!oyl3k{f~T}H2+>#stZh%Bzqb6; ze3RN-$vK-c+W66NQ^7JBj+oE6jJRt1>^Z#>tYx$AYJ%0wg-8i{c4HIF^MJpW3tG_J zgQO?XelrTW5V{TuE_MGYHh%}-Wa0r7ZF4|kn+iwdPEYi%&l~d7To0(9tz=w<-?cg= z{8kKQimrUvU{5EYNhXG3I{5{5_SCNAknGhb4ddU8BW|ihnw&tnaV201l?35^LG8D! zKQ^*u-(hJ;qQWXGM<2QtNWFL|&k5=|xna-hYe0VhRTqm2qJKl&Gl}O%;K7{j+PE`A zZZ`%x<8z99f-%D2Zumz>;vPFePqEvdEtY(Ak!V?a(G9$QuHqq?H&O0-$fIy+>`hy+ z$mr`4QBB4^`v*hx2Z{$@$q1I1o^*>{c=>7Oh4}P?Z6mUwu8;f7IC6U=Z~sirnMQJE zW_b3#z)V)H5x$K^DkwKfoC@(umzMO1+%D6>8*(hVn*aKyA89wd#w619T1mtC@tA(i zpsDkQ0AI9mqBETJHdpqZVwz6UsUY>tX#ObIUCh*`14mv^q-W6Ro}4{ zl37pRHUE_~C-yP!Y6oHNDA=Z;Sps%xc!Y~4;kqu5Ut+vLy9;dQ5H~gT*3Gm;V$zkk z+67gJI@_f@_aD{OyBW5>$!0Z3ssgG)%9YPgMi`*g*FNK3bJpn~_n?O_Z6FU_R!>3N z<0K9>ao;wp_zoC_S2vJ0^@ZGc8jSo7$K?~LSl_7s1`W#8%{-c?44vOPC4hB^|Nj#~mDt*Sj+JH6xBLOW7T zGsMHdR>v{ZL@tJ^Y@jx0YZG<)3V-s+^vH=@4K8uYVKUyc)ch){)>wI)25bZvIh`^Y zXJ3`*?#(ux%v2gP1cnaym*J7>*+{kf)52}Awyb_ZbD+tC?}Y?Cj!`>tr-KGGO%8mX zVyHZQKEL|`C)N8K)1MR9yb$tvpK<`mAcvGQ_ zC>8YO+6^cB7U1~L&WpXf2{yUnj|?QSPM+u&Nd1+rUE*ZuGovm!j7#T~AOeO-5p^yh z^G|nVfq1L@DZ}6D8-F(%5xpgj`68Yh{YYRy2c0m=Sb=_)LorX+ZBAVx-kfgT{pp`o zdd#x;2EIYhuQ~>mUbw_x_4{%Wj-bP@jb$t8=_HXD^j~e!j^YV0LnIZ*oYdv7syH*M z&8*J(vBE}}fWqHC2ZCA=mr7{OS8{KC76gHLVqPhsepJ*(%EnY0qlMNCsR%~Rgq`M9Balt)sGyuEswR zWGF%U%gVoP-iS&96;z%%T15QBuKG_dTE9nOzV>cY(O(&{=>@Rdc{w10e46{u;j7v7 zPJDOFyGSh;&esgNQcz^$;j+;<{p)@Tj?KnZG>*1_gX456y+OlS19! z@L3&F{Zr}(`qSbc(pv`@##2EhuOX@-^hKVTb*D z;V`IC=zmQja5-x=&;ts^T~^EU3KFoo?mR&0-{|~!hFkr4fSR8IbN}sKl4PPtIE;K9 z$?8c8l*->`4UGJ`fM~8(ziB~a4v>IKJpEm!&!gsEcuvZ|LTVIV1|!!;Rhpo0AsEgV z|3ZuGMl=&ZF_R7lCa+kFUXKA8P$-7H+?WrSfb~#UpM&Pd;Wlrds}64r<7N`UaUmJx zIn8Ww|5`7w3WoZ|;kOwK> zYmr6p54C4}{X-w4oFaf)Dfh`AsZ1~AzGZb=PV0wfQE)%1DD@$}m!t`&ZQt~>vjHg(#cg1DEi<=!j@lmwHi`!H0e#d-uJx5yx!+O8nueN&woP}h&!pLPt%PHV%~KaR)HfvFuy6hGer?D=D-8d9F2|(=h^oXK1b9E`UAa-K z#Wn3%%i74JQ4$B4S3^sNql9MR+Sy#Q5Uv@PBNl+z0_AQYt*IANua10HDUX(SqiCAg z==$}OV>{44b@MK3s$-VMJhiour@?4o;<<|K9L~!uj#+GP0Bc=M+a!Z(>od*M@DC@e z*HL*?!IDq1m)MFpPQd%M5-2{Z^(R_t)^BaG8X`lz#Ozq$=#6P^32w2aE|fCEo8!EV zy4wR5cvnr+Lw>4t`CN25`)HYI#q&>B-FlH;yGu7Q)XsrgT zY!(D|MBT)^A+`jIkJ=VCudo|_>xQ6zNu6rTOers`C@%5EaWw%GWi_y|y~M8@^84ut zD@vegA^eX*#{3YrZJ<*9fHYUGteI&zk_^>0c4-tSfA)oaHf{p~LHh~QN?y^~$+U2f zsXaB|6ji1rE!gffL%U%<4W~)?ur4dHc8QTq};Lun8T zg$=NYH4<%~tbHLQlqta}YoxLsjKz9}s6&j-HC?kGFBBXrdbyd+&zPL{NkYWsBH&$32XwjDQ`wXo#Oi z^=J6Kcs$BaBc{8rW;-_gnH^`e^^xdu?W@5;cl#RgqwhQ&-}323=dphIAAftra9#k+ z3!BD9PQY~wtI3w)#%C0#0{WXf&o*$+vhD!qeEgWs!H_n(LH;ofWg~E;>mA+=VolV= z2go$B3fi$&_BIFZ4}j~5@F_Z<-(_#6iiiq^dY+(gs_gr+`_1Tgo^#6Tkw*yLJ?*E+ zX%>*>P+mXr3Q`U#WCEG9$TSH62U&{Q+4{w@H;;wLzyehJld^;;OqUtbFfiC9=fxfV z2tl$Exl0=0ia@pe{haKZabX&Qf}xd>8Fk>?I6PLU=X_Zr{vl^xI1*vETm#1jPHMoH z7&h^JH@sv~v>p}L-KwA}?ubtKr4<*?O|Lkprzbhh%o~;iMe#i@lz-sM z26AY&50^6hpwW3+SG_O~l$JaUWRA6aGgI+Y zW}~|(5cY($sYv6Ah)X=50dPoC>MCrL@(&BR#G>$f-Wc`16Yj4JkSd^)>M#(P%ZXhR zI0CV=T(z0+xR`8`6{y$*^<@-ALLID52z*Dae^q*mkv3`Pr(Q~Xc2K-p#2(EJ_g#a) zcdDD0eI9t0^@jS!5#~tUbuV9RP?5>D2j;xb!wz=Rry9NtX^=dbySIg_$qzZ+Jadt1 z_lC6jV}Y)Nk2TWDP;&Dk3;mkd+QY$oz6+t^?)|`YR~2~h?0dK}r&iSdpXNXf;)uLL zM0<)qE>n!dqL{Nl@2@A{i@13_#bFkON{eFWPgeiXMdalHr@UY1nbJorP6v(v1Ox^H z<#{L?OI0zyHWOFtNCOGBw9S;Upr(5Nzs~}st9=>}fq-*^xMhpqt^rFiQ^;w4KNRJV zYAL#7F2!+Vw{dnZdaHPIO!QN8r;Lzs6bw4NmCKWs%C2$Oa_yP(`;<2o(?kL?r*OlB zzC|>>nQwl2Jp-B6UZYno&9g|(0-REylqm|b&Q(4Q-=b;!@z+Q~1A-Oq#Wuh9%F|U2 z?GXYcS4Afw{bY)L>E_8Pni!Ul3L@m?M*u=P9z*aG;*j}^hE)8t1J~K(1^2|rBsxe( z;K*vENFI>XRQ*(ScXQ*lr>q?MCD0xfMmn@>6{ou5VnZ^pbNq3!AGRXSAD#QLJRf6w zrVdO4kIpFhN4y!H#8)<#fq8)(sjwPDT1g8`Q&RwM*(udGcS>IalO2&8rUq1eqyd`G zO8e_|ys-MNQbk56A`%P5l+2k@uEs+`{>Z3{st z0k{W2pYjz2;wA$>TS@|Zn?%y~i6WX_#{1ITIi7!&GJ1bf`KuGa3Szl@YGCy=O`!yi z+PELyFVssW4$yv)&9nu8f?*HNtpYsm)(VqBGO%)*DU6#9{VAFR%0P^x=0rK%wE_`A z8f|n$KbbWi0(NL|Rz1rshP!}e7t0M3c9y#nh=!o+#q;#o@x)>BdzzsM504VI$Rm*n zT1!aI{n7Wf+r9i=MuELA*#Pm39{Tf$D>tgzDMm;lu#*yQOmPB?t$9DkMhTLBMo2}t z5W^YcJK#g%+$^;JP-HpH(i_2UE!57Sc`6Snx=<)BNaN>!z{n1GY(xN{3Dj^lxf7+e`wpYda@c(I}cf)k;XW4`!oLL)+NX22BNZ)`W7Ejau9Uh!fa~aF4 zR=s~Qr`OTL2=>jmSjkW~O5QG3=>K*O-F=>^6Cto3dk-9z6gARF|c`2I|O`L1qj|(nm zn_KqoC5HdQ63!Q4iL7R4&=UXipKA$8z0A!-P+$sVgVGK2Wp4tB{lAT-JzZv6U3Akm zJDgFe1HRqW_hOJTQbzxJZ(s*~XVjd2aeh(YU+4IRKxd+&@6kuN5W*S39q{t*K(*+9 z_VC4FfsKhD|8o>*M2Z`Y{0m4IxI~34m@f+cQ(zJTHHz6zA^T^V*bVd0-F)I-5?%pz zxDzxa|7qszfb;dZ|Bq%|aacuMu7&VFdEkID^Ul zr5Cs>duev@pXO4mQFBqj!2h!J91B%R7rhCrxj@SPpT=W=lMTO?n%+tgio}MH17+#) zHP*iAzvKc;hHVlcZlHScfVlgfcK=rkcib>r@NWS_|8+lL3S7S|4w|R&kU9v3YGVz# znKc~Cwb2lPz`|}ALaPS}{;!VvXCQY92=GV2c$F0vSxo<8+3$dJhnjl^kB|ZB<>c&^?Xz8^u50&6Hexy?Bv2mpqb##6k?!ZZ=QH^B%Qr zIcU15Ja)sV?b}}fi_tXT0BMfD$%nkPY6`#al{6qQgB#|xwWPzwe*@Zf33<2syLctR zzfmOugk^2Q&_HoPdj5um<;bc7UecTTs~kG{riafv8lm8R{bDe2S*7Wd~CBT=;euC@#L8;Dx` zc4wn(L`lZGajsU13*K|T`z)T+(xeu7lw}!x!H<1>wK5=y26O}kj)i}p`KXS}2v>vq zyYe0xtBA{?iC%0mZZ~5++fbthP>*m5w%7gkJR(EPpFi`Pn4@TVvgYl9JLIoOvd{oQ z_pNPP`wXlY@iyWFz zom$@`#s*+vSOqBTsZq!(bVA4ol9;9%ji`OO7Z%uTd7){Uf1-}2 zU6YazLDUwB`YOX)#OPpO@+u;jc$3KrPy>@g6dKLsbhMq7UjI=v96TaF&1XhcjiL3? z?o^vikuEwRph4dNW#{<2q}`Z#?SeivV7yvg939-LnLC*Mb1iXw&o4*uqHeUL85?qn z|HDPCyV`$OADygar+4l)BZsyKofT+wJRw8|5P|jB%;&@B@gb+9>>jT6kH31m1_Q(( z%}G&CIW&VOmr-efalM`pxo3x z2mU{#=*Q=vCR0das^#5VhV2kUW@lH>2W6q<&2+@-+Dx%*uL;W$*0V|-ep8hqML$;! zwEKbM6Br9K2uz}FX}!YtI!(3x7uCgsa~IGTK}$ReKjF$g<}a4iGIWI3PXEwf8muV% zR3#C958^izT((=h6x$fFey&qe_*qG&vW7wZAD4Z2umb|C2a!Su?B%wbA5;3lRM5Iz z7z#;YJf@&*uIS=Z?+7M48IA}t{*Y<0$3A{2DM;ePGKee$pLj6zukOMSM6BWu31*S)B#$6Nq63DIUCcqm&Hj)?N^hfU0{H%; z2O;l;j3gY8WVFqvClO3Vzgx8{O)29O2e6QFhm6mlX96w1?)t?|0_TjS=u5MV<8IgG zUwH_d2w*fV#Xf^=M=y2-=JxS~MIu5~+8pjj$ez()`c_OTOb;@F}mU_=Y0nt%B5s z+GpA#FCE03K!NXYBFMs0(}Jr4iJ9Ma%tQ!g0ubD`&v*Y)hKB4+DAny*JSoCugOU>U zdFx!QmEgl+cMrP1%Ar}v+PS`!0-6*T=&>_~rBjJ#6m|fY)ogXE{E5p4?M#*vO{S#r z>oJr#cpNpQx27Xd!EC`=uD!GeAjTi7?VJ=rRoew$e-%b!9LM>OU>;&}^p*o9U*aVT z?z;EQ6_?9&h9XII`e=8+&QBmh`GR*HQg0xFW|V6#Au>U_GO2~iXahz8JZrJdFVVfp z&3EX|HNBp>m|g#HecQO|46NrAj6Y8Tb*_&RV(R~E=O?VB`PCt|8_=O*n-r2sAq(hB z{q@Q6#X^DwU~-YeZFih6HIi-l&F{CTDG7H|O3J?DH{PUM6||%{t1Gs-)zXGF#P}AHIl;HsIT(YPV@M9}#g8ES=;{B3X!Q$slk43*&{Gg2Xw^a= zS-LgO_$62Xw;!DT+4@hOfKNrd$( z9y@-e{DxQ;=W0EU#x>KAH7e^MT(gh0^Gf+;aS1;bVptNANgp8pSYfL;2?BF|h(n#Lnrr^o%D z%963M!o}W$zQykVFb!seEFmgz2wBsrfA?Z6erSaVo4Sve#&6w9CW-7ctYLFq{#3!C za_8==mgbiQ8L|#ZH0>#4<|OO#Fi{lK*BU$s!M9{nF?}XaF;7fEOY;h)D1{%*72DHn z3rXQhUxlG8;RSQ|{D%>F1nsHX7NAes?f(%OAp{eYSvGvZx1(>9$f?94%)>N5}MQB1wfur+XJFHn*LY(h*%CZW#je}Nu2ek`Zh zDM}Wce~Q<1v!~%zgv;{-r07s2u_~>5-EX_QR+`($nTS2i8vc!NvJbd>XrJyp z4m|zj8s9H;6ua_w(;gJ4i?PBOANDX88A+!n9aIrI}w64V{oNv=@Ja5|T z-f+|rI?DIn_A_UfTpC7g4d_(Qk5U+jDx@pVIMd(Gm2c1WON9Ji2K<%`jz z-=8#sDzsUSRIloTWjR@ysuOW>)KeWR)sCaRCyu@A(l{ihbiP18oOXjsFF)ow%0S!& zFrzfB5Tl%=hcoBf+eQbeR*7e(nkF=;*|Be-(2nMXlP9f^D&QHOtGp}zSm&IFqFmEC)%Ajc@3>(D0_MrupL)ttpgf`-25OU4<(IE@=YK=d*^zIm$FDui+ zhJEtr(6XNr!mcQWmf`A0q(o$k9zS2R|T?ay#kA zr7qoKQd+y4j%$X+lZq(e-RQR$T`7{V2HvrIZNL6ze4qkUk~wO?3*S_mV3@Z7z8XX>!Lj zO4GGQ3Qj$M%ytq8Hu7=|jhUS}(85faW?te~0!Kflu>3fpriI{fPuGGNBYKrBnnd91 z-sQn+!pyI)phy381@&~FI4C7S&?Wk>`1eoG{q@L;S%WQcDKw>3jEQ6xZhk% z*IRE{ha-MHngP(H<4?0~14?!Q2lS(MvXF^1-$C;b)O{8sg|8!AggxhfOy@ou1?~za z(NBa?6_{?eaHQfG{y6wpoZl1dQW3)2t?Z&oEE#drY?t)mL?JAU``~Ms-1dhS+M%z@ zyji}9he%`r_bMnN&efG<*q_?nLQEv?C=@hBE3MJ=o6eZ@FmK0;?9hVHS5KaWUH<+% zyXoqCz`;GB5zVmC`i_TMv{?S9EBl4u&O0d>RIr z_pEzTy%LEjg_0zdvqT|cT32|}Uv%pd5EqCpe}O&=t^|l`F7cl(yl@m4zy5v+TZY_b znpH~_$727Wl;llcHb=bJvidpQkrEKi(-I+LwJ>xhc91j6O5D_^Pd~WdUR+My^vY(N z_Xpvj1>|gm>j7(z!F5yTZHnMhh`JO3qPj?A2GttTyu)kkVJX%|gbhEMWd4hZ#%i(p$HQ>5FT@;VY2boL zCOdftV_>&YbwAGE88^Y@7x#C>Kv|gOXmD~$xJa;wx zhDBX+SYT9)G(dsuQW~N;?$f=IKW!^67l>zvQDqC6aR+v_xZZt^rlj>;1TIG~ghP*# zNJD%Vxk?cO5!Y_SO}l_Uq+hEylLG$g4wYt9enlp>6o&CvBR^jXVADY7{G~@pGbr~j zwFyfcJqgM@F3FvP}oRnk>OcEEt(QB`W2ef+_;=9P5<da4R&J=+5}O;8;~lAWP^RrPqom+#!F_%tgb zEfCiUS>q;j+zzjhjPR%URtv;k4|HA@b_t;Y8=(2*U{Yu?mhbLCgfy+-E3MQ(J+lWl z=|^hSDk$1V5b|#yyIW{+iJK;uWspUdL;EnN*y#yzfZ?UZIqcuRzs5n;2OerAa_y^E zl#HH!zzZQiy|P*;ndCco?!)3xt7w7<6x{5zc;2r1;15&fHTecuHOz)k!YTgnY|4+R z|C2GqMUUV+nFQIL@J!*|0!dMH>V~vT9g{2SQ}hMvLd2)+9SBcro8`j%_pDj|$rEoaPe84~V zvG0$`Tpv7E^L0;L&ZFv1Q74J4Q`fZzXP<4uWdd0|Vu8DA`UuRky`qOhX7<0Uvpm4$5!pA8diP z7q%zg>Kb!Yc02;^RQ*{zqXhU4M_WH;+>EFF#m52*BoipldT5|Uw7o##fLUu@X@w|f z#a+_TDv}WF6IJn&QJr!F?>c@o>w{K_ilQx*Th>A4cl>muiWwWjuKi!rfqYEK%R&k6@{G9SdYx7k}eA@3_Vg z_c7;iOnH|~CRxEHYe19$!Qo9fvQ}mAt|Oa1n%<@V_$e;rR3WbO*FZM#b)0~IF$Cq& zJD6tUZ`-6-kT?+kg9{QR;B`1k7sIFhQA4x9wVLrJF3MBe&FD>fO13fkSc!Gw}^e@kI~L4dd>G+(!z!)sJ@79f60pJG9vCX7xsD_9LH`dkNOP zj(=$l=n7UGs5UV4_!1>lYgh#31XS5AtbT=H-txs~_YPKnYSg@qM-~aa@vLNBY3oI{ z@PV}qJ|l{3XQ}ujuVb9UEsCIwl&4R6H^5hB3bHLpQps|~%fAfPbJRDhThn%*NE+E9 zO*b~cUEf7zLHzNt>DJ{g2n69AS?M<| zZi`?9R-+6mYQ)RbKD`>N4d6*pp2f!0NzyLlm_(^{Z-IU3-msjqg{eNMzu-xI2=Hnp zb2aiF>i5)ima0w@GPRhcW>d-+lbDK7dpJo}k=pbFOr=BJWXpk7L^nH}o>FnJn$hF4 ziIt;f#ZUN}dy?1V+{00$bPB9Y>(dW?lU#^zgXwZrDl zRVOi107r79a5Rzf9lLag*h?kqBfuNuk}Wg%{s7j4PL!Nbk*GE?3{v z2feYh=ZZ_SjbWw!Y<23WcO>NGM|aS}U!8eIYP^{8^^J#!f8b}X0`9Vu4Xz5Z#)K4bmvO$*~!A{pJ8TEpJO zWGQWunqBB0$MFGcKep4d!J4V};fdzH2= zFEwoXqp)BWSpGe|*j3zTE7{C(5VcTV5?CpnOIAOAE6cI-1?=D#q4hJtC*qP(a<`Pu z{&|A{ec!nW86EZg6xH973JsyjatQN;dhGnN;L^1t&DPd+FCIj`de)~v?!F_>MzhNn_XO5Y>Y3&#uCBhhi!prUo2px6K^ZHH z?e1V|oVk?epN0i*Rr54F`cs>}o@cvKZAG@b?>J-$p#}^F|D^cIxpW5bI0>m&3JccG z>Y=iQU8o{eMJXD%&O^*PpG{3Ya6ddRRKKRr9@b1hw8e3EoFMO~9*(x`cc70g4bLCS z?4e5;vHwk)O0_>%KE5s%H+>MR( zF)eHlN_|*fT@xpiqdSm4BIEG0u@xy_x9cCdquhwE?HKNZ>TdP7EXPd=`2$dr70#voTS_wuZO5z zu`v!HN0(1k6~=(bJ>RW=ug{Up=z1Kd#|m=nn{6Gak{OFyjbe zutl9N&lVTV5`T^De}6qN#In@JT7vM$t4+MIm0Q3TEM%(qeLwi+?z2j4FqNnle}RE=Ii~C;J}BR(i>PtJ{Vatx(J~vg4G-0HTTx^>v}lHbbaUq`9b}?z+mB52bIiny-N zo|*1G<~UIl-$a$05c?cQHs@jH^Q_?#!=k={aTIgul~^;&Z4z7vn1qap zY;5O!k17Y{1!mE;`cK4tzEP)YCz6YXl50U&Mg_4h8X2*dKF!j^b|(^2tmOC}LOllP z$;5AqL~r(mo9HElc=Rt)O4M#~el3!YLW~gUf^h|jlt<17gAVGSCNj)qPpYb0+Ak=Y zQtCZF>JM@sI{^#P4P z;Nc72{h#fMMwUu^D}Bvi@RGz5Pj1Wu?1vU9VD6;=ZV%|Z1}>$q=nNkF{SUp0CpYAW z>zABOJkueM(0MJ)O8=x-7RLTL#t|R~2z2`D z)5|dN0Nva37joAgfzBHdU+EjJ2ZQm#+RLc34R_4)v@>~5w6=KuF=jr!7CLW;B&Bch zv{>jDqK~%R1r+*{>*Un_cIE2?_G+N>#t2pV7T1Htj(%~*Ur5!57W$IwRA%(P54o4} zCD6G6@|C_#XRuuB|Ak%lQG~vv^VlD1j?&FPUffTlZ3J{~gf6A;@-$e~JWx1$~86goF2Wu=#}*yt~FdF!>mWW(=x_!v$NzjFS1^QC0aG5!i62+f@#UBAlEBYQ%I)dLn`cX7Kh0g7u_`j6q_>QzAJ4nXM%aJ@`A484o~Z8q$W2k{kNfcfoC z+|-`d1k|xAGFVg+TWsmyXS3Nyzu$ipqwh7)xg+)GvH|_9V~tDwm+)A8J643P8PK^i zP&$y#3C>IPz}XRAbRZd=f9{84C>;m}I`;*X4&;LJc8_FM4h!@EoqGjJ2O>cmi)T!g>Zg+K0+Cjme(j{L^S&YM`&lRQ^-1m8h49=xuuXFID_ zw|Cwy>_WSJdAs|qEW_{!$$?1t4Z~e-mh;gqol|pjyZQdfCHZy+AS4H3;MYQL)rCAz zm9MnES=aq~2_;-0BnN^s@*0NQRC=D)`SSLs)ICQBbbu;35E{SLaG$R9sA@G|b2D1~ zWS-^qmw3@ZNc>jAed@fyuK##l5t^sc+t{dsaQMw|t##gTRP;Itm#5OPQ3s*$yFG6m zuY}upH}Ls~A*J(ipU+2-mqrLDYL^|g=A%l>Jm<{e`r z0T&D-Adicv(srFp-No+)<{y?{JIQy%6o$zG1~^V!Dt4Nq?Jw0{_)b1;wN3Xv%1RG6 zur~Zgtrw-8DO@q@8?PVcs)d(h+?Jp5d9?UMO`pv$neK?Ju5PZnmR4 ze-w(p0om@-TZp~`zc3w?TIhGT!hLn!dwKQG7<0*zK5FGm8^trg6W)ttR$MGEZ%@*z zOWrS_`D}38`IA$;#v;dtY2#FA@6L>Ki*d^1>73?cFi<9e7~WtVi62hRm)i*9nzDj>MM^GmRtl%z0S$c6YI%0LD zM7!%?++NI}Sm(*_&XNn%$pK?{YT>q7UJ;4uudb5_eKm+?KS*DEIpZqW9gt`Ph7bYz zXL&&+j<&kYeWABkU*Es3Vx!NO8c+rnbzlPja=w->k?86w_k_OQe~$LoZU}u3Eb5>! zw;`->bDEL6-As ziB@0W5!ugI|CYSLq7DvGvS>0HKJGv}S>R0@h+`*y_Y6&=(sY0SvS9el=o^r)+ z$sR1~pqg;Yd9_3WzaF$& z$Cw=nc3_(RSj%#qCevY7SG89ew;mZsO5n@C3f3Sf2R0m$g)#)iYO}v#SY6b+C7U>{V<<;_Vi=E#Q9 z$&Rbfg9v^7jh(L*&K+Cy!yu`iGtpdofyqfNJ#T-h zIC~Awy&>nQpUIF|vG#2mo~Bx`T9CHCRJ^!|xiST>P03;7l}uR9ilb!q>G|P@>h8t(Vif~!EZeh{ z&dEV+z!;3BNQt;jY6n@*i5fL4<5|x!rU$VBbC7FG2H`T_QhJjrx6gSg(77id^)!%C z)n3o1(hp9r`wSp8T>e1=Aa(teA7mtsv(F0b+6&&Kgb;`G3Z$-^TGhyU(>7V%)2dbd zX6t95bI(BPdeI~E)@LW%lF=>I`pxO)MGSp-R31R;I?*Nb9s9nZ+q-Np<$m05U*7Ii zaRom-DiDb4R% zyWPI*owwU<`1J@}AOtTIb@?sCPJKpoJ!AxD=`IZ(+3 z;_yxBBKih2b6hoN=COgc*#L3TwKD$m(azw93;mL7WQpMr#CR{ zAWbgLAFyLz?#dB+1Br8XnfVymZVw%4AP?HTOvQeL&>P5%?8JU_i%mJmlWfG^?co?; zkT++S4@r-rI(fLno*aM$7dN*_F6~FR=ZLNYu*2EqX+nwi(J2;k0IFywp!U%NcH{sY zrhTc^$#=1i17O6(P47X`;y&v3Zcw-mfF14gURSu>N8R2zmT>^wIlJkdcI8#ccTcg3 z1K^$ZLhk~S?k5X{Bi;r8D;MqaID#K_A9|Nvg?}{-oRO-u8MokT(EQX}1?keXrMh=q@2L-s5QbQxA)Oak==n_+S&G)oT5J X7uuAja(Rlh00000NkvXXu0mjfr>P)% literal 0 HcmV?d00001 diff --git a/packs/f5-bigip-ctlr-0.0.38/pack.json b/packs/f5-bigip-ctlr-0.0.38/pack.json new file mode 100644 index 00000000..a0523370 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/pack.json @@ -0,0 +1,17 @@ +{ + "addonType": "load balancer", + "annotations": { + "source": "community", + "contributor" : "spectrocloud" + }, + "cloudTypes": [ + "all" + ], + "displayName": "f5-bigip-ctlr", + "charts": [ + "charts/f5-bigip-ctlr-0.0.38.tgz" + ], + "layer":"addon", + "name": "f5-bigip-ctlr", + "version": "0.0.38" + } diff --git a/packs/f5-bigip-ctlr-0.0.38/values.yaml b/packs/f5-bigip-ctlr-0.0.38/values.yaml new file mode 100644 index 00000000..92dad3a0 --- /dev/null +++ b/packs/f5-bigip-ctlr-0.0.38/values.yaml @@ -0,0 +1,121 @@ +pack: + spectrocloud.com/display-name: f5-bigip-ctlr + releaseNameOverride: + f5-bigip-ctlr: f5-bigip-ctlr + namespace: kube-system + content: + images: + + +charts: + f5-bigip-ctlr: + # For additional information on installing the k8-bigip-ctlr please see: + # Kubernetes: https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#cis-installation + # OpenShift: https://clouddocs.f5.com/containers/latest/userguide/openshift/#cis-installation + # + # access / permissions / RBAC + # To create a secret using kubectl see + # https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#installing-cis-manually + bigip_login_secret: f5-bigip-ctlr-login + + bigip_secret: + create: true + username: "{{ .spectro.vars.bigip_username }}" + password: "{{ .spectro.vars.bigip_password }}" + + rbac: + create: true + # When set to true, create namespaced Roles/RoleBindings (one per namespace in args.namespaces) + # granting only ConfigMap and Secret access instead of a cluster-wide ClusterRole. + # Ensure args.namespaces is defined as a non-empty list when enabling this. + # + # IMPORTANT: When upgrading from cluster-wide RBAC (namespaced: false) to namespaced RBAC (namespaced: true), + # you must manually clean up the old ClusterRole and ClusterRoleBinding resources before upgrading. + # See RBAC-UPGRADE-GUIDE.md for detailed instructions. + namespaced: false + serviceAccount: + # Specifies whether a service account should be created + create: true + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: f5-bigip-ctlr-serviceaccount + # This namespace is where the Controller lives; + namespace: kube-system + + ingressClass: + create: true + ingressClassName: f5 + isDefaultIngressController: true + args: + # See https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html + # NOTE: helm has difficulty with values using `-`; `_` are used for naming + # and are replaced with `-` during rendering. + # REQUIRED Params + bigip_url: "{{ .spectro.vars.bigip_url }}" + bigip_partition: "{{ .spectro.vars.bigip_partition }}" + # OPTIONAL PARAMS -- uncomment and provide values for those you wish to use. + # verify_interval: + # node-poll_interval: + # log_level: + # python_basedir: ~ + # VXLAN + # openshift_sdn_name: + # flannel_name: + # KUBERNETES + # default_ingress_ip: + # kubeconfig: + # namespaces: ["foo", "bar"] + # namespace_label: + # node_label_selector: + # pool_member_type: + # resolve_ingress_names: + # running_in_cluster: + # use_node_internal: + # use_secrets: + # insecure: true + # custom-resource-mode: true + # log-as3-response: true + # gtm-bigip-password + # gtm-bigip-url + # gtm-bigip-username + # ipam : true + # ipam_namespace: kube-system + + image: + # Use the tag to target a specific version of the Controller + user: f5networks + repo: k8s-bigip-ctlr + pullPolicy: Always + version: latest + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: kubernetes.io/arch + # operator: Exists + # Pod-level securityContext for the CIS controller deployment. + # If not set, defaults to runAsUser=1000, runAsGroup=1000, fsGroup=1000. + # securityContext: + # runAsUser: 1000 + # runAsGroup: 3000 + # fsGroup: 2000 + # + # To disable securityContext entirely (useful on OpenShift where SCC manages + # security settings automatically), set securityContext to one of: + # "none", "false", "no", "disable", or an empty map {} + # Examples: + # securityContext: none # via values.yaml or --set securityContext=none + # securityContext: {} # via values.yaml + # securityContext: none + # If you want to specify resources, uncomment the following + # limits_cpu: 100m + # limits_memory: 512Mi + # requests_cpu: 100m + # requests_memory: 512Mi + # Set podSecurityContext for Pod Security Admission and Pod Security Standards + # podSecurityContext: + # runAsUser: 1000 + # runAsGroup: 1000 + # privileged: true + # readOnlyRootFilesystem: true From a46e0723761479cfe4e3eebfce5dc3e26a5cabef Mon Sep 17 00:00:00 2001 From: Kyle Jepson Date: Mon, 24 Aug 2026 11:28:54 -0700 Subject: [PATCH 2/2] updated image references --- .../charts/f5-bigip-ctlr-0.0.38.tgz | Bin 15816 -> 15828 bytes .../charts/f5-bigip-ctlr/values.yaml | 2 +- packs/f5-bigip-ctlr-0.0.38/values.yaml | 4 ++-- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr-0.0.38.tgz b/packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr-0.0.38.tgz index eee3053c344d358e1bc4da9f73c6402706f75933..a64f732804d820352db3ef215adb4144c76e288a 100644 GIT binary patch delta 13317 zcmV+gH2TZPd(?XnABzYS000000RJoia&jmDkqx1L{>xx{^TpO+V{7Zh)?YRTTiaW& z{sJ}@iA2>CF%IcpHs)?C-?=C9zz}~zlwlGK!NtIG5pyUGx%|C{LXTVlK1Ja7ZSWrP zOG3{XcysWFeQ*eNNx&)bJVe2mQ1FjvglK>`VgLp%_zUue~LW6$EJPkPxRjx6Dxo|8iEXYS{E^<8@-L**3Z^M58e;(WY_-%^diI- z%>WwK|EtZxX1xAiZg0x<|LWDt<@&#mX9fIDD1feu#hQm6z`>YMABtaq1ONw&L(jv( zMDl_2pAB*Wp@$$tfFU%rRtyf1E^Wsnk?RtFhxNwWJ%{*xhXfqr08!TWAV-Y%BZlZC z!Y=BcCjj~@4raD)TjFA^q%7r@;7N!AChC_#w^jgj9K;ytgAh?4Gr?)ZucJ3RyVeRg zA;6&sas(h?$f1aXh>2klSUcPkqhPJf-|=+7ZGoi^g9v)wl_iJ$)FTrdoT~P7+|ibQ z-z;5F7qNiGdI-kQW5@zPG%J~_1waTHyCl>dS{5Ba$1KiiBucM;Dz4uUQqV*r8UMT{eVYF}a(fnD`OpwN>*_X8GDly4AV23$180dfIk z0D^!7Hu6J$1w70+xD=g50UT+H$4o+#5D(rRemFYWd4DogV-kfE3PoqZm=ZsWjvyMa znvRej{xva(=C~D#i4k7w%J!~E1pJ6`5Yqr~JOo9%aw!teHG3^b%lNG)0#L+%NJK@~ zM`%naO3_y1bc__X_Q%6Nj&}C;?LR&q?Ctk_SMKUA;t+etl_O6hM=TaOB!#Y74ABeh zpdH5{Q6MRA1ssRS!DEb=7+5|i2YwHDL9n;!)8~EBj2)cFrkRCT@Nx=vKr0L?=@E9HQPgD z7R|NneEINIL>hXONZ0iYOQM7<&S-{fZqDaT5z&B~Ml#)rd`gAea_-h#uOqn&rh zz_vjYIK=l+plB$hj!3qJ$eY(F^FQfe(m_?2vd~ z?!8AQryjaM`e%5>rzAKXL55sRRS#Ccr~miu&U^V+vWcBCH#m*?_zD<%FbI%my!pq+ zH~UBL_fPhZDpJBlXW-|m+*?E3f5+CbEEe{2u0&D4lutG0v?bPy_0z(p#M9< z6uEnHc^*4cP(F?Kr9pr1tEg{Z>eBg zCuP>IRDcB+=vn5z(v4RW6Z1o(V26EVh`t_dY;1JZ?>{JsLj7WF{1Sk2t*gEzP=-L1 zOW(=5L$DQpzZ}PJHsu>7n!1?5k%tN$LjlJWc~@XHVrU$BLZnaRXuU%n@9qi_15OY# zkQ4pnQj&uaCqf}`gbcFQl^bim9ZrCd_sCdvrW23=3C1Bs1Mx>7`G`id(*;852!N8j zd>Df7H`WT+{|5cgLwdIJ!z5%i6i@F8xWEt?`l^6`Xxk;Yy%yEV0e-(p>7@X$WTJou zbuds@h`&4jV<%(n8Uz@)D>h<1l5jAlb0dI7uZ9S zSg2KhB@uK#1m4vVA^dmjA;tVufrr+F|C~?O{u2wmtS@A`;~xLU7tltN{deo-R?hyr zy}7ji-p{iei~Kt7y!_GH)p%fZ&t{(CRa_wW66aDn}y6zj&= zLqbn`?TcY?rf3M(`!_e1C}r(`3x&wQbEX(ao*7!YoUP4kpp&62X@ctjJ1rx`XV6mz zj*_GFJ}KEtl>BgkC>09#wGa&g2fW;pe`5bQ8jtZe(6LisC~)Q93dH(= z5>hOUw#hk{wri!5eF1ahV_Ge3503#u{sp4D#1A1wp!4hNLGKrPqXT-oFoYxQVU7{& z2_C3x_x`{i88|GuW8b_XY z1^yjD505c&1trLS_pE;+MNzUm7jz})mw^#-V8jq$#7E{?rlj;SMxM*0SxU<4$d!8e z6f>|oQU|1a?~k<=OR58FJ?mf$sM;|V5WPJywP3Unl7ma^d0?b%VbUZmkk{CMHq1tB ztjtVCJks&UWG&^VqEMjKVl!v!ne4>yb^G;f;F*kvf|3<45?nKHXGTzx(-?IAi`oCh zIyq>n-B~zH_1`HG8nY|7Wo)W}OwF(+7gb7{%o=A|mhDvb$sBU^cg$$6V!zkg5YZ50QO7r8YHqqkNCHPB*g zhG=r|JNl1KDL3Vr!6<|279(ua^4Xy*zs5 z304)8I2}PJUURDf;n@%A!QYys@N*ovL-XL#GF^&f6&Ud;q4+;iIqaQ(|11r*7X!;j z9J-LhVRFXy{d;omR^m?DZfoS>?%1B*tUI;OFOG%f9Ydicew z=g*TrQ(-lErB5SpFwygWpM0St;;5JC=kce+mYTK@5ErEoH6u=6pui0Y4!F^1a+H<4 z(nn6ln~=DL&yELkWjyR)~Jo($hEd6l_xifvZ!Ba zB}3C^9P+3*()ssl5X`r;j)nRag|0eh*O*Gqla77exH&ks{#5mU`vOxQK~MAnQC9If z-!ty9kP@K`8}BF#SV$<(gUWx%1JmQ`;o!XdWxj%-02)Bg4Jv7HAp>1Ivegt>GRXP} zc5&-LQEP^<#fDMQyj~w=&Fd!18=-D5q~w2)!yV{hhx7=YRJAekh;yzFLtD&3cHkuz zIT=?vCdm_G!CNbTP#j~YfxZOAsR39EfeXs=YI6`AF;PF0DLl+hRMa6P<@?g<1NNn$HXxSRxamIer24tDd zYA)J)RQ92E{9m1j-1c5bJ^vrP*nE|@|7>h+Z7uo#eY3s{5Cs8?v(FKl1b;nP^8fpI za{S*kgv^wfr(%Q1NWL=#E?jun)#XNV-y6x3O^Wmh=#KVXK62zf(@_)AZ8b8ohF-}q=dw{*PmJ#UqS-^Bu<5jU&9k3+!o%o`{ z8_F1dvfxG%ic5eQL+pW0=}75Yj;t_ToPZH3j8+$*-lX>>kg;gK1R&!v{P{~~Ovsl` z7kufAApO$$+DW@o2#9dY`OmKZ-V}L0o&tbS zM>LQms-|9@&5a`L$%DNRI_GeLSkGDka&faLlx_ilO_Aq;iAP2%6fq7aT_HC>jxUgm z-etUpforXR08ONg60C+4jqx|+s)*WuUF(4lfp-N+AZrSgq^G}!1Jtv6d&j58oKPe^ zqkW$Q;M49ga4}_8Z-0V$U;eAmw|b-h(7yaPeleZ&#Xs>+b`kVbKqKg!M;G%5fKQNO5;1VFx6iEj9;nsBE`ohkj*|a*ih@mc{U5#A*|k3& z{&BRkw{QRP@nCPi=eu*a(QyA~t6={dyx4xZwEx}9vjRSb6MqWT2|gu$eDgzHqEUB& zNZ#kuvQ}2WhYKO;qf5*Br(hRR0;cS`kQ5=U$2rYs*)95^`iWCC2F z>2UGt0()qJdVg{}{yDt@?_^tGSF{v`LPk2$VGk_p@5u9kOOTeEB2IkBu_IBV$R`)b zXkKz)K1G-UhXje!1>=w-9|c@ykq#!P2jt+3{;JU}8K|LU*&5i{eu#aOWs+kt+cn#kZ#%FB1EX0QfPG z*_v}iQQmVg`G*wQY9XOy_K!IVnfST_20d^fL-~!bz>!H~vMl%*TGksh7F%z!jJg2F zHDqHErGF^kbu>G)th2MT5oA+q1srLm{%=~1mnz(^YOlQ_5e3lUf>b3{nt95tqy4x0 zJIDK{?|0tqzwTt~cPwiKyv2+s_?UN@&!Z7?xCbUE!IO$Pyap4BLh#IlTn8v7G*AUm z=O8Nwe0FxG27R*!-l(m8SGOU@OWo{?s1`#$gnw#nt(l`2*K5(aOyj^NKq$!ISF?<* zBn+uKTcyxrFN22uwrEQi%`};e$W|{QI3UYUvje6awKsbBuhR+z*Y7yA(~sgEDRmhtRJ>ud0g4BsEPK;(zP! zQQ)Y30`sdPO&GFANL-*3u$owe#ATxSzokV}tLm?nBUJ$Jk%_u3ZZJxfXe((>7O8G3 z&706KT@~Pjl4#^1HYJ3MO-YW*VcOgt3NUiPzG~Gv7%TA;nbT!UD*$riBw(?~lh2o5aL3vW zMHh(5{j(q$4$HPEAs3XEUhw{;0wz{$9{>o_j@2=fZ6(8i$Fhsa&F|br-hXc!94Etn z%Bq%b2-OgzAdMiGOHOvgq^)?xNNU+70mE(_VK~-`6VfUb4y0AtuhhmNL0~AB4#kic)_;}B-^D=ge}lfzv3H61kE4Wa4=HgF%k0L39ymrETtJG& z7Q%9hi+^R0x9ybSbS&}y_;6=;|5%7eFbsuY1jBGs{kPTm`rLYR@W;X7>BpnDuRBxD zLpJR92fu9g1}}f^4SIu(4XFU7iiOZx6SD#_73_uS3wNUu%qmp37Jr{Dxq-&hRy0Q3 zuNeF+o%3p;_gOOO`7&aWls1uFJ+F<`CI;X|B0=bW&My-xfoG>)7>hT4Q^aZ9?Gtm# z8x){1=FGBo#vIZ3Xl@*Nz{eA~KY4r}aVV)rv-DH%{l?x?u{I4O%Wc&xI}xRGcN zaxS(n7SSgvb`VQj&APFO=KInP7jo8*$Eq)V1}22Kb{IqG%U0yR5;KR2ehCKAV^alN z{E+{g>ZR0Qdy1zlkN3%)|LpJVy<5nckNMP}|7>n-=kq@gwl-cZ0$v+DYn)!N5<|!Da3_7wGlrQQe>r7>yI;a96MOMZ zR40K%?pPq#H;~r*Y)?VP48YhkK!<;!l77+}X-NZ0oXm}k!Bymok$@rBB^9kOz=)5y zJSTKyHx;e1F1VaxN7}J~1BHHsgL4508o0PZ-SD&(vIh>h!qgG_ue9LE3ZAFbnS@Te zAf(8SHGi8dl+3Z5KtMD;iW5+ZvP^m{L;>bKU@VSA0Wz|8D@8Iu;E=d+nmuVs7b_#1 zscN>>&;^)3Pkb{3NO^NRCPAPbY1N^gjE`&>WcQK~$-tBhST9dsl1N17gp`t=od`iD zKJ+!RR*8}M$Ir(gzCL7Gzh@|<3nHeJ(lPNoa(^kOJkI1LB-B{4)sDtGpUngXh+?Pg znn_;#we2w_zU^U-DD+;(cNAVj*B6DeU*ii1um2YR^{bGQ0RTWEo-B(-yovJ&P`2f) z#LHTdBt;=%m=k&>bbYz%l!>CEBU5!e7!sL@b-Zme$>BjvnW@Uwn_xbTMnWo7%eAkH z8h_}hNStx*f2pWKCivQ=JX8IQl=g41X$@15{O{ZEW93l8=M#C;;c2<2{ zQ&tv(&B=bN0l{M+)jxx5V{%PwF^LC(8mfwU2Ot@+n5Ej|OlSWVpi5get50K-@ysGD zRkKQrr5%Z#;}AI1WwUi)Ra7Ps2P#5(8h<#{h>@P<0BcsUSGH)~maWg(LuJdngn_bP zD*6!pt>}{K{4^O1*0d1wh$9Y4uDHGK2qnK$Rv=k^v6bL>|45lyie;0Hk%8C}yQX}fnvJT@P;5u2B8crRn|HlTQ$xfxuS-V4kcW3pX2nZ~k(+&T{qQM@Zl}p=c)OE2sDt}kj&-cU?)T0ZkD|kuU*_50Hj2%j$te&fo$+K$Wd-zf3 zX-z0IBw|qyHa2`KpI_Ce_)fhmtt%6qTDeTBxkmNZvQ~>JREzDFS62<|3_`hzdzsNS z%BTTig)HWkb&W+PofdNGJmu*cC*Uj~0Xh?ZxtK||xEe7uj=YSeV1G@NN8t0GEF<`A z4&K+*6*vB7$KM?FO|ZWM6(5};-Ua4SW|H^*^IU#Plr75|kNlR<3#KAZHkY zvEYiH=Akm>wKk(5H`!D_YnEvEj;isvwN+8VGW;T>d2!9Met!k)>v9O!*NuaCwP^xJ zX2DFNyK#N?4jrKfoY`kuq{K|>LGq|gdNP~-1frK|vr-6C&Lp|KeBgx0{oW_8m~4Sd zS8=IC^HA_`0M3lLIg`8j+3A^_a4s`_Xh$?YMZQwv6t419;3A5HNzeLKUWd~j3W-i| zCVHbvDP!AN;(wrcCVu8K3ugB&G5=c6oWctPV0_HzNGu)5k|ZbUt|Cvol?<631s9l- zKr&0I?p$hPtUNPS_Zc8?1ZBkb$}R|%SM_HSBEc|}Lu*UphH`#g1FqEOMuMSAy(ht0 ziu5u~iuk7OAE}I_EO(XM*s|VS#cZ~lP!U&VPie9YiGQoP;#sclnV!IeGY`dnw{h0h zuXJ20{Z8O{HqN~4fe(RcOjDw)=A$w1-6a9z6ykt0uzI|^yO#4V(aIQ~A{LvJx_}Wm z(LTIN9Hin+E9v8NR??%y|JZb2K1pjAYA6#R46b5XJT*Z0h);`dxFy9 ztIcX#AY*W*R+U`w>1{401MsOLB&iG^?J;G7*N5p$@iIZll4<6T1y*HRBF$PpsW{Qc zGJhC!7o5b=q2m`y!RdmNx5tMnCUrMH2YZWy^R+HeQ5Pi|V5F|Q&?u0{A7`dp(3!eA zpeSBuiT@@V5;&fI+CMrz`0)Pq-yFly5wf> zo2|^ts*ElvrofXIRE3zL3@uQOpVE@#n12t|cCXYIOV-StW!U4yh)&_9ww?>=K+42I z8PDzuS;eyd?7M;LP2z|##*@?7jNVuD8&79?#uI-jNs!sQ@-@0E;3U1)hcfqsbo39y zkE<;wDq%N5(qYm+BQfA?rFC15wAW%Oe!gr|g@+aoB%8&OMuvtyif0Dl90 z|H!+Fla9H9Bc$@5lm+4=yKc!}qz`M#oEV-zN1C^*PZ}m<3S9C&;Q{frjU%kiT#gz5`aj2UQ{Z-2< z+O<*Z|FgNV{c^jQ|NZ60(*Nf^9#f1fORt;?bh{P1Nk+PB8)7Sag3=sZOMh_6+E7|~ zfa+~Fw?!|NQxj=(qQo%ciw?q~`k=a=5q;$Q(2FSa@(svOY)Yt%SEfM#V1o<&2?vwN zgEUu92)%+sn0KTt5Id)6Ft!G!J2uciB?Nu*J$}Urm0`Kecg_^~Fh&Rfp_1+#9(>w5 z&V2wtg?}V6jBDIxZ+OU85vi|it{q@!OV1HdVKCFG| zt*x(q-m(81O60y?8-J&N%3A4%wF>-qJPcXcSjOFel)|f$ub3mhw0~M-{~y^1C_QS? z1T&Ov%ZAtM8qRPAv3eJT$*OMM?w$VhRgG5lC~zL0P&gjr!a{7(Itn6x2tGq0c6Oz% z-31i6m?DRNEtD6s*IU8k?_k7#iaS}hSS52mA`wS>#D}Oeqn~-ku^fExdgJie$h&rgi)U(tK-L$hNK`fi7y8r2Q8w4|Z!LDT zl<1XoyW_fI1iQdRjN?Ea_ayHeLe4Qd2pFO~{&j>dDds5tc?g+0$WlN54%xIT6m=oe zL9Yv@@`VFws90{v64Skcds?!t?pNiYwHY`NiNx6&!S5-3%+fyu2BsZ&p=!QBh&5s=`)9g-Vn*D=KW?To=l( zmKS|_vvyte?bXfoaP4}Ge%=^n3v9>&;@|&LuO$cjK7Z)mTn~q<J68QK{6DU24_hRQx1j z)u66WlX#^bG9EMZ=&gz4_#3;$N%nI=%MWvwNJ1d9l*V?T`{q z9O4}WEL5uQ976vh=)@&89N=C#(TM6QcoTO{QA)-gh-S%;e)QIps zG)4h?_^nKi&qJ7U(v~02j6;>~z7vK=gv@EjtC@?I7Mx2sesFToOE`eu6~_)cDHlf` z0Ht@4$8qSPZ;u3@9T$c*6mx3Db=BCv`0g$@U!`ACZXTV4|+OmFi*&$cPXR!JzORA4Rnq z&>f#X1|&f8e`YgPv#7Cj{BYly zk|rn(BEL4IEB~x+?2p^kSHSQEDmQflKz~WZ(T;l|dduX6-@C@73!uDR*99=R5j)hd+VL7?rdSUEn~IC;rMkKE9ljY$6EPr zry0URFc%noUHxopM+WH%p^Rg-Z66X^xdOh~sSlKm18x&)D{L}eKluj+S075HOMms) zEzOvAbN_W8Y6W{RGYQ;Mz!#54p!)`TFmP}%c{lHAVGgISKZ$=&ZS{Ytq9dMwxab}7 zM~GIsP~3VK5aq}0Ex;uKdsVo}ixSUKw^BF*OrEsk$y z1NJfC*!x(sAI$==!PUkn7N2wse%`1n$swH}UdItJUyWhkf-aAs(fBIjZufEcSg^O+gkqJ3^ao9UXt1w~F#H;K4WK7UsfDKYkh z)-b;|%b{_lwm6N{sP2)=U}rv?JmZjKN64aTqkIzk3#?Wf^X<(>oJ-f0rR&Plb){s9 zEKCq+>5Z68%Eq(X>3KA>S--bX3?#uQuQ>_stK@>V%5`@ zZq?ID?9AfPicB;vOEGjQhAzd>dLF2kN~1WMU4`wqp?X@1r%Ca4u7AT#;%fZZ@pe>E zY6h$N?S#gbmi5-Q^;?Us_ibNqbqsXtgP_Kvp!SDBt&W2dC#y#z$4?34M~lYkVQ)jL zr^0{iwu8JFi*|dV_FgqheTel$521{cr!L@5__U1r%k!|ZV$1Weisz2b!{k{@?ZSEd zXHU(C@sHE`(##QOQh!_H+7Q&h zFWYm>SrBdJnzuF2Es}G#=AE}$ZH@f1JqNx0SS^Z+DynZ}i~ zodsGEgdcev>o}8fw#BEl4eF4YRkyE-Ew@-8kMUq5Son!XD}M`#dTzaB)zi3e)zg0Y zX3Mwe>*GIdX=_n5=zT8RV_Yhst9H-?wN!DY_NPUUk&(1K54znhyF3G0o&hb-fJzt1 zLUoE6PJ9}qtqU_WW#i4Zmf=p9JYdNKmOMZ{&~>rOhxMssr9Es+-sLh~F4N^QEpCGk z6rnkT!{1L%4u7ju)+RZjRyLSL9uP1sNi-UubNWj;ie?g_cQBCG_l zGQ3{D2I4jG+~eGr|MP#qYRj&?ehrEM>N{1|A)mOa4}V|}c}QngPO?72zy%cPTtqTu zQGhPffvM^DUsscEWWy%NPX5*Gf9`ujC!S}EKR5aUT^G43T_EOh<{s!#1l=nTQp8Ze z>*h+~T!B`Cc3GcpkFzUBJ%e=%OcOkkNb8bBlGkNYeFKgN%baNmKtO1zav)RY$(*Yr zRJjBghkraOtk)V#MxFKIg56#(Ny4$eSLxxhPdS>ifIUPq;ZLE62O0k;^E=hVOQ`^l zC@uFkDXEo;mxolI1nv?q@=aE0>s%mH!puRhz(6IElo?A^l^|sGsfoKr{nt?AGzjx z2~#Oxb9}OM^6_{^G!#^ULNN1rO^#o@F(n(Um>g}BFJ;;t~3w!e4Z8T2+fUCVa43;(MmVv&S~x306PccrP&2OA_hD zp@?_E^lC)0+pww*A%)eW(!!;njXMEF0h$nwB@<~3de|=PAuzS;TAv#&KpnMlTYqfn z%}|J~BSyT&GuY)GyZ3$zDbhn98QPoPMcXn1e*I#-7vf^Irub}QGbVa^@Y`3*rSqp+ zI!!@e3{mV)p^Z}*u#iwbZ^Gr17*I*d<$NR6%6UOI&(>Tj==$6Jrd?k8B`qBumJSd1 zsl$bY=H)-YF(AqS98+}kv)Wn&>`xsbYD5F$Dz)E81$ zN!IL&3$N`ONkdLEhnL>DOGRZTyeC`ZpTMm4!}aX03|K{y{L|&dU*-e_cXg5ZZjys8 z0=vhWnKDc>?k^~1?%eF>5oVTqJo!7{zIbRveuSKA51f*0{z*u@sqR4ZuYb+ODL3;Y z5^=Oge28nzK`r#gvP;E{;Qwpe?ap>3I=?a60on?FzQBhS$`M>M`=#$mf>ZV;bjUim*Hh9!pp=l zD{AA7lwvb;5RVx`oRngf**3~I=L}Aw{4KFDnu<}$>`u)CBKBp`cz*NEH!HyQvW3hR zOZr^bYTV^nS}o~oF@MlYbJN+FGRYO3d{mjHm@@SdWo9MBR%n!mlc@+M(~LnHNT%#| zQ+eZ=Kr&@vWK^@6ATkRKAp>sy1eexCcW3}TH(+xFk=fT!_TDR+h;OT9pvy01SJjXk z$VsQR#QHYc(chlKhT zKr{*vKa}>q3PrWv`NnWqt#RXN1!EVx^dP*b@u-~Fhiz-Kq3xG<*Y;rZ=fY>sy~A|; zZqv5BxWZ+LmoILO+l$R#Ui|X%)#fingQJix?!q&3F6TV4E7f0BGn=~q)Txc^;#TOD zunzUKVj#C0k$;);IeVjb#6`bD&l^GK{DF`l)UCU6(8dr*h1@kCh-H@AnOpzyv(&b8 zbrP^@3&j1aC%q?@2Vt_szX+*TRo) zu)x8DBE~!%oZsGFaiD;_#ld-{RRViCn}pGF#>in}v@}-eZ_B7Ut!h2elr2v^fXMO| zVOi}be>t>HAb&_JO1(4UL)lJRxE{`OPf^i!iQnupw#qWLih33pTct7JW?PTThvW;b zyenIbNq-AJ#uiW-eKT9YXz~zjr{&I)Ous7acC-H4>cAVg4)uuK zfxRFOt{37%O88a-t1+hN5_+E6 zMt|=Ev-nV^4l5iU1RQxDp2)DU_l8^BQIio!kENJ(1cOQCjLvWUZL%=e$3k5U4s8c; zJ$=#p!kV~JUC%u3-yvhb0Ygqi?_wP$7Wv^Usa#qfMFez7GHyt63$2)|A2g^Pl=%(piiaW3<$F7vD|^Q@LEk%b8Y4T)EcVohAIDKmMpLlnL*bJ&4D zUk3rwgAaxmfoAmH8QG?i|-qG<9iFosMf#%Bs zsV(ZRgnM~-b7r%-Cf-#4BprtFPIyn$R43qr2bCfHCgbjdIDeBR>c?Zk zN=)J|@k5Fj!z6fw7(Uk2>@ecwEoA)fb?A<8fbhTvjgxrjLwhg|;NL!n2m0G}f8`!;xw_$8s| z47@q`!#+3!yCmS0cpjo)OepwAG(t2$95Da`7kmg&a6H9h4pz^9W(JL|^(^cN=u^%^ ze>Uv*r^xerY}&{EME`v;u>$C$A;=J?brIva(c9>4{cJt-(ESikcKu&KFG6h544`5C zzuFvZ=GXtLSKG_=e;>~Z_?=JyT^EZr4?Tc`F`+&bzW@mU4j6}?hl7da1Lr>*tnWdN81F|6(Mg0|)IU!E^j93r zY~8lR#ac;O$}Pc@5Cu%sFN1Ea0O&Y~G0+DgqCRGV*N9(7Z+3RA6>vg;LlNW%K){eg z5eE?y!y>SDxF<%zTA9D&>44h;OCJUi^t>xe4*RJ`CO9}%?dSNTEx%d1pe|woe~tAJ zjG@Pn1%PN)vR4a$5Hfa2s5`VQI)aW_oYP2@UIG7{q5v?&0VnchHy#H8goV&SE;u3{ zVtw)N8yvVem@u$P0whK_ION7TN=E&{vie}_P!CxPw}Ua0SRp6hx`h7 zm~n6^I*S50(iD%GgeD;#ygU4Gbh7jQWT?g@3MUkb&Vn%|eij`;G+;FyAwB$SVi3)7 zD-;tWyw;WNU6Ba*5#u1H0pNHDigx8vB%W*bT8@_STTcX_h>?hju8+`|e^8X7t;XpX zDQxYJhkqRH?Cslsd_36O@A z$%--2)QXv=UZ?=s5D3`~Od$g<9*?mTe|h{0Tw*>2N~q9d zd}g2hUvPGM2B08Ch7_3v(8s|<0uxgvzEKonQJ7sQg8uRfLF!o>&AkTR7kB@KmkKXT}>>taY zuA-1rO+u$QRK?`>CFfS-nefUX_}m#2(&>WE2-42i?B`Pte~ysRH}(6JArCp6P~96s zyi*_fBScU6Rj4r&EXlh-2`Un%{uBiP4ko8KIMw`Ay^k0=m95CZ3*x~OuhmYc>*IhS zC!!|na3aQuZ^wMl_K9nL_Q=GBY)gC(Nx;lc6YgtDiTBCe>xg>!H+pkb$b`@b20Zcm zv~uP9aH7ZOepbODOksvT22u4S^CKaKIG1H|63^Ne?x3J={NE999^l=Q$kY@lRl)* z)F=bQLZMI)BG~_i8E4iCI3%tuml}{ng87vgIrNR|1&zS&!7*@BX6;G^Sa5-!W$r88 zcr`IGKQsz<*hhxw>%qpxMpym*gOVuJFUH0%0VvnH>RSS32t>K`ovb?qTk*?r{AN?W zQKG4fe;FKksL(MKa7>YR1y&=5#*rsP`cySnJJj*+t`ITc1Th0S(N8WVIT&#w6aq)c zAZuN@vF6+11PFPLj8$hk0SS;`98xq8e*}_`Xf!)rAe4>(D9Ou*A^3h{t$_V+&<{PN zXFESkLRLfZ^sayl41uAq3W&B{g4=6RtsLO@f18wE3IIzc3TRLVW5xKPl04M9yh=r_ zuCaYcp@MiGxfDCx3h=OxIXiX2NKUk$zVeYz=+zKx4>sRnYegZo-@Tb^32fE1Y8y(Qwg&`ba4|9xIPw+rpyY~m?ar-fx zkm7)Y4h%!qzZe+(@fgY%Lf<$Fq$bqA7>p2ygJS=SW3f9$&bjQb;Dlg;FHm6EsEB%% z(L-BIqpX}6jwxjSKv(e$f=)>(e{*(K>vi2VFlyD$*f1Z{)j0CJEAa0KdU%YHD=0zs zyJ!6qDTsbe5K-G?^favXssRg5rkQ`iM&jTZE3zH^kfxO1HVK!o8Wo9zsf02$qCTl4_ z6@>z=7MnR+&txZtuiLL@1J7hU6qKxZk>HwnJ2QfkoW`K@U(Eh5*2zIr?asnss{c-j z(3oApEn`y+WNL;rxu{aoWY###vTUcaPv(%Tzhg#o9UDu-4wEys@86Si zx0)pl`Mq-kmI)59-bJ%673nF_1PD}5S) zgNdI1gNTbBLm3^;>q70X6cVh$eroK4W2sU^I>QV*ab32D;b(T^8ZNrmCd3CG|2yh?N>Sb@8;&K7cZ9b|9w1*m;bfn;eDwAhCfY%M6E57OZDL) z)CWuOjw3V{10L@aHFRMCP*f~uCl3~l#P-gHmaX9(C}-?9Z9taUtmdM`JXmlF8zP+ z<;d-DT1KGbX93eujaS89b-Z~P`U*GHbtHXCLS57P{cTxbcNgiIle$LdYADY2ClUN0yL2} zO0XJIG{)bMt0HRub*%?J1l|=OfvhP|lAit^4p7hP?H!*Ub3&2yjP`vJfKR)}z{QkV zy?+Vjefh6K-|CJ2L;LdI_{DV67yraR*+tM#0ga$@9)&=qds^?Y%g|cyjo`Vp-s65~ zt^cpJ0zN^CNyNax-afP9d!SYiy9oAGIZFQLDGD~(^?&qcXV?CC_{Y)C-oE|E$Ai87 zp6|}xM#KG|t%Ch;@M8Pr(*AcZ&kFb$PJbv=C-{{3@y!o)iALQ8B6*)r%UW3hA1;KX zk1j3ipMqUP37E3$LQ;famsl|a)sjvNR1)kDLfOu{R0%^DcSrN-9n6i9Gap2(4lL>Hzro+Xn3+$l@>VL`c z_~-NrypwH#UC~k$3K{80hdr>Yza!5FE z7mP!Wd=zk*MLL+E9*~1C`m08_WT1wYWrOwg51tv0Ar$H#y}L`oC#4UaD}vs=fA#L=-@W3sRL-Y33=nj`rW~?;P)+zTbJb|GJZ{ z-?6L}@D?+k;A7rpK95Go;U1Wv1WzjF@ES}g3c)iIavh+U&_ESLorA0#@Y&g!8uZN` zc%!!VUEPKpFLkpoqFN035Pzz*wPuc9T(3pvGK~Y90HGj*U(GVMk}#y|Y?VTfy$l-q z+oCO9G}B}1haJv(=78==?~1ZX9%IUQDJ0BTgjg~r%0Z)XSgg|4YJZ?qkd!G=+W9-Ovm9Rbe z@+wPhlBxee0%VTi@qd&=a);s(4M0EyUyD4>+AX}9R!)XRXavR9WzKNAGEx+Gr^q=^ zcBxFHqm&C*4Y6t1}K{=Dn*NG8r zQPo-j2jimWrz5+Nb3ZgT?ou=j56ZYP974Yiy{alElhia}h<~rYM}edE3CypGG-1dd zA#s6Dz-nR<5|@eQ|CSa_t*XCPj#L4>M<(jFxWOn@qOGJkS){tDG;cz`bX9;8N}`d6 z*pv`1HYGVKhiP+rD8R@C`>IvzV64PXWKNeYtpLc4lYqq{Q??^R%Nq2+`g)Fhna=;K z_h_*n?FTHP2!EXA_}p3S=E?x{yfns`ac6#0G@vI`QkOwf0`kFF`#g(}U4T?WIXav| z20}_gL<@e;)>hhsEKA5Wq;Y6qAK((D60aKiBjR}iK_NCI!yRik6kQ-H_s@c4I4s+u zgj`TsdcpgX3Yb{2eE=XxJ66X`wv`M69?LEwH@|Zid4IocaGVVPDXUt#Ayh+QxtoY}T?-b+58fmLnsmTJYB z!R5}@EIVF50_0hVSNfSs$R}EryM)vVRE|Dn!9z@a*gZJTE>6o<%GVUqyiyy71c9Mg zIut`*SbtY0e-{I}{|)*=$KEC4KaLWzJ*31zEVCOAdf*swZ~-Y6TL{Z3F8-B0-nLVQ z)3L<+!7vnp5e&mk_1{+K>vQYP!5;^Qryq~rzV1vp581HaAN;b}8@&9v zH|PyEHlzZSDi%U(P0R|!RInGOFWikvFso4AT7P`Di3FkhIloM(1fHFGVJzPGO%bPYw@=I|Z%}~7m@~`T8FNJA zqq%Y90UuAax?E{pI;^peiQUhTrDQ-IxufO+;G`_h;IYa=<3^%A$hp|QSVYIrkzn8F zc7L)wNS`onEJ^|F4dSAEj$knu1`5tTWEfGYhDI*t${d9dPjbh^vV}ChDPxy$7m0X@ zq$0L83PvOfTu85ESRz9>%<;P&<33fYaoFJV@7t2qN(FL{IFV>pHt}^e=1Y!8BG)BO zd}FkqChh6VGko5U7^0I1yQrUfpY&H8%ztd@?BXe`#s2X5A4vh#=o`d1IHb_w*g-69 zHS5MAn(s?HT*z5J9;?3e8JG~_+F=Z#FI$oOO3WN8`Xv}dk4+V9@k9P|s+UrK?J1tJ zJl-dF{O-G5_e zKBgnTDT$9^!9~Yd8pnm8EJU#`&?&o+Yi8*qV+s6oHRzd`+geX+rW8ru%rKW6{s@f~ zC;u!sXy)rJnWtcwk}FNQ@2!L;M0qf!nQ6_K0TKX%!x9QU#DNSFwzyTn0Nm;`}#q*aG{GCs0lkljl{Bm+}2V7)wjNg@%Q6H-cgb|M6s_|VtLS|vv2A3q<1 z`1+7#{hpzaE{K>?O2@?W$bY4r@;H;1kWgdERy!K&d^QslAc~!`YbJT|*S5!$__l{R zqR@LC-%)rCU0)Q=evL06y#8DK*RMiK1^@twc(N=S@g~kAK-reF5-)2-k`#r6VNU3k z(Dmi2QznXvj!f0@U`S*p*73H@B!>qvWu_`yZ-V(W8VRXTE!Vy(YJZ@kB5}sK|D~b| znc!=e@=WzJQrf@4rZr4K^1pAtkCj6WpHqbTJ`_x;udALa*je>)O<7qCHYfY71_Y0R zRR0XJjmb5!#UvgCYN#sa9e`xOVwP%;GoAfgfG%y>tUirR#xsksRLv?emUbj|jzi#3 zm(A9JRZ*El9H+DV9wZqb_^6bA0^I4@Z0RjFMbBD=S(+ zOO2>Q%Q}pIfa}D~1YCnX#2ktxXO_Q|AFNz~$#ZR+PsJ~*B!89IHHdjWxCZ(HAmCHT z+4+*kk|p( zgdal6u^tzr6%8u=8naBpW^suJR#ar4UhnjjZ^RDF?X#4V1vS8{0p?Q?1LtBSlBt*ROa~+Aus?0pnH733bvdJ>m zl1a(kuqsZ8e4|yV?ENaaIJAL2&0tk`kuTp`&A{rC0Dl^7C8CAdo*Y~=+)WAY>F0#> zB_B_Sz|b1SEUJT-R1Cj11t!bLD4oSTyM$#iQvfnZJ{4muBMtRT&@`l6ve`n;+Gd!d zFbLz)J2GmL0q0on?WJ5M-uSiEQ7NMoO)%qBDti*RYA0S&7s*AiCd@b#t4ApuRxWL) zQP;)lsDE5pKi?BqP>(LCuHYqYXH#+-Fm@<~vU;vUCeNyg@8L(Cr!}F>kcdS+*x2x` ze127<;yd-Ow608aYUMJi<{H&s%UUg_P%XAwUR^b;GYI7>?qx>TD5D056|$ID)-@KH zbXv%z^OUD+oPe`{1n5lsB$+% zjvG5c2)2~@bj)GkLLn2!Q_+;+&_L_GW{kQNklTXfOIG__g}LRMktkw4B8kVDivC!z z4Sz2AcCrhVrGYHl74rB>=5M_xJkFMzl^(^QnX-XA@%AIGloRw#?49@mbp=i%!l&}P zR87>0xG6-Bv4^t2WQRuxOz;H?Ku9qW6VtOSOHgLKS-Iw^gPdUq#)2z)nup4i*V>GN z++cIc%kYbk=EXJ3`hOLyugf7^UpEfo)uss?nFTY6?#A`mJ9LB| zaAu!rkrFeh2g##0>B(&R6Np}>%}OCmIg{k_@_`c~_j{kXVzLD;UB#sm%|pS%0XQ?} z=1lJ9XQyX!!nw@!p&ilq6!}VtQ@F}cfr}^(COzv{c^yuBC?q<;ndprwrHpN7iGPFQ znfRH{ESTN9#QbYLa|$mIfblV-Be8TKOOl+ZyNW#VRx)IE6kK3R0?90;x^t4y`SX8_M~04Y*R98wrLg^_~Q0DbmX{DdL;9f21;! zvfNd2W6OGT6|>oHLPcDeJ*CMqB!8~vif6gHXLHC+^xV~JJD`U^d`Sw>>5wxWu*WPQ0mpkjqBZxq4*}#V(IQxEcrY2t*$?$(r$}&`&!^&B- z05F!trVvR0FjvKvdX+4Q7vi_-f}kZIbGhlrX4H;07E>L&?FmYYuQsb~fsDbKT2*qz zr?;KTdZe{(Riwd(S#EVKfCPqEc+N-AD#_6D214PAiH>XMtiZ?-Zot1`Nzm;z5; zP!(c|GPFQBeo9M{V}CwW+r3g>ELk&mmSK+*BRYkb+IlXe11S>=WjwntWEIQ)v+o9~ zH;E(07*9@PGkRaqZ#@`0e=ki{Uh%xPCDiaj*!ZK zQWl7h^m?h$T8O5iz9Im*e2(^5S7Rp$U7r)Oa~y{9uvV#E=^3qc6b0pWY_aO2 zz&xbYn8eoY^kd$xoQ&^K-4ZNyo=YGOEgKx46jZHTSx2}*NtEq}o&YeQ+}0jjsz+!no5PEDlE zi4wz%FFFW|>VxWfM)Z;ILocGx%QqlDu_>W4UYP~~fDJD6Cmc*757JycA@m9kVcwCp zKnMo)A@~f1*x8l3b{A0OVu~F8wNPHj zUT+1Dzk?C~Deh$1VwKGOh(sLi5g+0j7J&nfCYnuWA1S1Y-fonAgx}Q1m)qN0+a(3G zM1NdXn+0%APV(&fUtjva8Pgw+%THf_`qCE!U=Gxm{%>n#gXEAPP+pGjFr`E^dwYt| zwD9%?D3Ss9nAY(ZNb{{}A=|o&1iGkYm*DWzFthH;@X#?-P~aeq&wOaiNCBmciSuxm z_@PjqFbNifR*@}ftbS^V6=D1^9jt0}N`FNL&>%L5N7-D^X>2sy{-AYh2{_}3A-q?n`l=OJY3AWQxHJ7m+YP}GG;2fZ$s$`=l#p<=lu zOHB6)?rF)ox?h!p)@I;9EK*i}Z8dxVoTIC`VFZZ#ke$yBCoiHXA!8uK3;E|j{(tv< z^X7W<^M?IGzunyaykT!k@#Oo~&8)SqRXflg@7TY8{XXcvxEZc}f7N|;lYf0(R&daL zbu+B^^73Zb62|t;YN4ojzgbn`MMZ_JstQ{b6)I8Mtf;Vkb6qIET3+qHi>TpAY+2{@gvf{thRXw5Ct7?|7 z2lBm~>^0+0NhM-9T9&VzfZ?4rStcwd>j?XZM5R(ocBxg1Q}L6CRfD=hP2!b$$au`q zqr=KW!GupA8&>FBi0S-HH^(f08?OE)7t+_C+_kmq?C;-J<&VMF-!$|4ynkVDeO(($ za+I%De;XRV)_z;7pu*TnT8_T0H}n$u#`hkHP!lI!y#r~6JEaeKgt^Rh>#M}^yZVBiGQuO>-5@h&+c(5=EX`cw?j%eafo*iuu!SGa|r#5 zpc9wWaDaQ|L_0EG!(%}v#D8L{s;B5)agweHhln02ciYD?QX|6m&=>{m;kPn5J`Z8a zNn3t6GY(a{`%V}h5i+M8uVyYTE9><}FzC99r zc3c?NP|U3bKz%J>QCr)*y;Uf&kW}!hhrmf5SbXweP&$MQI^JrDW`Ett)g8mhJ{(Jn z;}HxdrDJ>hp47E0B-?j%d_*FSgNeHCR;r6BAR|IN1cSnNd=%AcKzDrl7?1$TlaqOg zDZU4%OuV!A$A{kzWS2_y`o`YYC=tyn1f*fj{F%*E&7#KA@xy&*N}8ZFi2T}+uKcsQ zu|IBCUjf4xsNB>I0DmPBM?3C?=q-~Me(xHSE`aiOT^GRMO8oGuaAP5qeyR%@Xs*s` zD-W(`=;A^Y7hon{CN!CYYUb@j8Y z9T}u6gffoRwtYxw{p24QTzx2&E`QZyw=`qg&HdMXs1@wN z%p`D20be{Gf$kgV!N9@6kSL@ikypu0Aj4}%x7kBi}twzZKi7m7Zf=~-6Y~h`F~tdq{P@0TEqO>EQiLG+Tt`) zqq;{fgPr+o@{B`{9U+UVjq*wCFR)r|%(piiaV}j~maZ#H*OihbvM@oQrAI~!F4*MI zkn9jeTQVWuUD(j(vMSX}NV6Iz=1|-uoEqPo`Ryb#Z1atVftm4{)i?maCBlZjru``QDD>Biz zEXB~J7`hZg>v^DFDvjc3b``echU#f4o+icHxql8fiL3Er$JDxNz!50hstwF~F*pFK4n#y?K$OEX8D zNq=pPkI(XKvG%aD4QHGIi)QXP1F&`+auzPsic8K4uob7gYeP^2ziiJjXF;@?Yu?s8 zw@A*}ns?r2wKek3_8j!~W3?zQs;KT=BQt$MN>>Xffx9>{sIxw_b{1$w5Psxwtm90^ z*%qJHHmE~pR^7fTw%lTYJjR2KVBsekt$!>e>bdojRZru>RZsinn=Rj>uaEze*K-a}8AJ(UmmG-bPd6&y{xlEVKw73mEP=w|T4u3y6Ie)BD zS)1g9TG?P0c|ag>eE(Qv)bI=FVOJ&pEMj2;8hL04I)9x)w#twp67dLxw7miZ7>x+moJim(#I%J6#q8i?1#bB}Xh z{?Gpbt1Y|o`ZXv5sP9x+hkW9yK7W8c8EOVwM00E(;%7ILoCv&cjP~{R}9DnktuwH8{ z8Fki+3wC?GBnijTNGPJgo=%!tR|IS+xZ3QiF9b%5`>!6<1gM&#g76Y-2_92~|L zJ3z+S1zCeh*}^TLlq~fbQA%0FIOP$5HQ`ij&KR3_pN{WqeB_$%B}}D&&GE_3$;aav z(NItY3dJlyRVb+c3hnPqic3Z?l5$vaS|yc#8I#}y`-pMqhq^qAMt@1V*OV)0&Ii8V zSe9+u){mXwiF+)L!+Y!OPHDnQ`7%!JWPq0M%knyLFQ3>ct+mYRq^o&s7l+gGXtHxg z7vdg^iMzsB+Wy{sXVBZ|bU|m(8>s&_)qh)^a{mS$PwM3D@u$p`R^c%BUG;Y1u4e6q zBj=_8_nM|v{n}twwSO>#obhMPU&ZV0{oa02q$17ys{*+bnGgyE4!sI_S7wXnQ%a)A zw1S{yKF+{OHg*HxM zz(PX#ya|_2Vn8J+m-CHOE9V8>JX>?ApzCkP+v%0C0Vm8F1)sDBn>&u z9A0|oE)|uX@Sbdqe*&}G57)E1GGG-+@=uo+f0+{$+|@szkfCtr`*hsNW{?|@gc4;2er@} z%Pti+h6hLl*kbKvhPGvfwkMyVZT>vHk32`)9MSle8Q12^xKD<^M`(K6N;q$h4+~wBi01^Y7>H_KCH+xZ(+&v z1LiHfV}Dahm8Exvp#o)=Un90*wF5?*xPk4~XN!1&?E$rj6WEq(wBi}55W6j-xWV@&}y8-YBfJf+Qi1I)7L&y%fm8GUpaee}nOKKkgw z`~IMrJ7)>R`Iwk)>+qW`spN5~lP!a8&epePK7Te>xXo6d-J%N8)Aepk;P34Ve0?Cwxkx|WN zg2*f|gbcX(6I@yo-Jt>W+ER9s$E)5}S^ zB`x4?!h>Gza07OP975fb+g%4pJF-&*o_`(}qUyuK*__B)91`kV0MRHw{7~BaDiqav z=NrRewZ@I76^vc%(u44##-nmxAGWQ{hPGecUE71rp9`Nk_YTwXyG`5j;tH1~UcR_B zZZ9@}dGX83SDU{S4UR&(xC_tBxt#OFu2g?j&1~xaQ>Qkvi(8>r!aCH`ihNK^sFL6>`^nAeLEbXKww+&r;jY)k(mrEfDvwp7fqr zBBZ-HMW2O`ALF@W{5<-D{kA6^4aD6@-c9Y;IoZH!TirG^75%Y&H0MH9P(8UB`+~Z( zA)y%7Ep6aPEb~U~yve1cn-Z%HQT?;?H!2$;piWu{7aDIDx z#eo9y76<2*RtfCoY!XJx86$^@(b8CO(f&3w@ zDD}>W4`n-P;d(gBJw-*^C4RHZ*ec7|D(YEaY?a1; zpScEduKm0WKd=lx@Z`e}+)9>O`qVyspW3C@XBK9~qM6^TGkoM;osTs$+x=!n`%}2J z$*8J$4v)4&8J1PPC^HU+o_|V(m|BO!v_fncj*(azh1KJ|I@BX_2lj$ExL$}4DdCF^ zLAVHe%q6V6)%6hQ#KYw{6??^lAtu++A)-g<-w|T`5n`x^&V^w^#GwUbB9dd!>^<;M zVHH?N0`};_K6qPq$Y?4;X146>!slT`_#PUgnpt=Vtj3t4OXzuO8-KkI%;H0tI;?Pb z5OCyqcp}5X-WzUhM@>c`J(gnD5ez1kGdjQZx5>g>9}9IcIJ6zW_4GyW3v1#^bv^UA ze}{|#2Mjq8y^D32SmcMZkozM;C#0BA%;#Bg+GgdE%PyGWvK*XEXPl2@b^{V18Qpym zY~#@)wzwGw$&{BI1%Jsoe~ar}7Vh|HdtsxdZ7GM3J=E!H3%8Q%vf=2}jmO$DIBN1N zFgWTmtYgXZ1BP{c5)p?Mf5+k$0p1?%#fBNey0!OEpE(dueL%Oi;oRCH*c{5OHAUP} z7`K)|+-4@+Dvzr4d3<+*81riKsmu)S$+#iOEwo~;e$b$HjDJIp9U+UVjq*wCFR=Rf zGvD59#JS9~y3Dh>%(GguL>49pG$dX%iZyY;rp)BY4pI2N%wY%qd^zkQw_#@P_ZUFv zFOLnM!~#=XZOfg=EbUA?#Y&z zEnYurnTPT=_%OmKAC%DOXWl_EQrQ-Bc-Z(!bq$$!USlmY8Hw2+