add f5-bigip-ctlr-0.0.38 pack

packs/f5-bigip-ctlr-0.0.38/README.md

@@ -0,0 +1,161 @@
+# Helm Chart for the F5 Container Ingress Services
+
+This chart simplifies repeatable, versioned deployment of the [Container Ingress Services](https://clouddocs.f5.com/containers/latest/).
+
+### Prerequisites
+- Refer to [CIS Prerequisites](https://clouddocs.f5.com/containers/latest/userguide/cis-helm.html#prerequisites) to install Container Ingress Services on Kubernetes or Openshift
+- [Helm 3](https://helm.sh/docs/intro/) should be installed.
+
+
+## Installing CIS Using Helm Charts
+
+This is the simplest way to install the CIS on OpenShift/Kubernetes cluster. Helm is a package manager for Kubernetes. Helm is Kubernetes version of yum or apt. Helm deploys something called charts, which you can think of as a packaged application. It is a collection of all your versioned, pre-configured application resources which can be deployed as one unit. This chart creates a Deployment for one Pod containing the [k8s-bigip-ctlr](https://clouddocs.f5.com/containers/latest/), it's supporting RBAC, Service Account and Custom Resources Definition installations.
+
+## Installing the Chart
+
+- (Optional) Add BIG-IP credentials as K8S secrets.
+
+For Kubernetes, use the following command:
+
+```kubectl create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=<password>```
+
+For OpenShift, use the following command:
+
+```oc create secret generic f5-bigip-ctlr-login -n kube-system --from-literal=username=admin --from-literal=password=<password>```
+
+- Add the CIS chart repository in Helm using following command:
+
+```helm repo add f5-stable https://f5networks.github.io/charts/stable```
+
+- Create values.yaml as shown in [examples](https://github.com/F5Networks/charts/tree/master/example_values/f5-bigip-ctlr):
+
+- Install the Helm chart if BIGIP credential secrets created manually using the following command:
+
+```helm install -f values.yaml <new-chart-name> f5-stable/f5-bigip-ctlr```
+
+- Install the Helm chart with skip crds if BIGIP credential secrets created manually (without custom resource definitions installations)
+
+```helm install --skip-crds -f values.yaml <new-chart-name> f5-stable/f5-bigip-ctlr```
+
+- If you want to create the BIGIP credential secret with helm charts use the following command:
+
+```helm install --set bigip_secret.create="true" --set bigip_secret.username=$BIGIP_USERNAME --set bigip_secret.password=$BIGIP_PASSWORD -f values.yaml <new-chart-name> f5-stable/f5-bigip-ctlr```
+
+## Chart parameters:
+
+Parameter | Required | Description | Default    
+----------|-------------|-------------|--------
+bigip_login_secret | Optional |  Secret that contains BIG-IP login credentials | f5-bigip-ctlr-login
+args.bigip_url | Required | The management IP for your BIG-IP device | **Required**, no default
+args.bigip_partition | Required | BIG-IP partition the CIS Controller will manage | f5-bigip-ctlr
+args.namespaces | Optional | List of Kubernetes namespaces which CIS will monitor | empty
+bigip_secret.create | Optional | Create kubernetes secret using username and password | false
+bigip_secret.username | Optional | bigip username to create the kubernetes secret | empty
+bigip_secret.password | Optional | bigip password to create the kubernetes secret | empty
+rbac.create | Optional | Create ClusterRole and ClusterRoleBinding | true
+rbac.namespaced | Optional | Enable namespaced RBAC: per-namespace Roles plus a minimal cluster-scope Role (nodes, namespaces, ingressclasses) | false
+serviceAccount.name | Optional | name of the ServiceAccount for CIS controller | f5-bigip-ctlr-serviceaccount
+serviceAccount.create | Optional | Create service account for the CIS controller | true
+namespace | Optional | name of namespace CIS will use to create deployment and other resources | kube-system
+image.user | Optional | CIS Controller image repository username | f5networks
+image.repo | Optional | CIS Controller image repository name | k8s-bigip-ctlr
+image.pullPolicy | Optional | CIS Controller image pull policy | Always
+image.pullSecrets | Optional | List of secrets of container registry to pull image | empty
+version | Optional | CIS Controller image tag | latest
+nodeSelector | Optional | dictionary of Node selector labels | empty
+tolerations | Optional | Array of labels | empty
+limits_cpu | Optional | CPU limits for the pod | 100m
+limits_memory | Optional | Memory limits for the pod | 512Mi
+requests_cpu | Optional | CPU request for the pod | 100m
+requests_memory | Optional | Memory request for the pod | 512Mi
+affinity | Optional | Dictionary of affinity | empty
+securityContext | Optional | Dictionary of deployment pod securityContext. Set to `none` to disable (useful on OpenShift). See [Disabling securityContext](#disabling-securitycontext) | If not set, defaults to runAsUser=1000, runAsGroup=1000, fsGroup=1000
+podSecurityContext | Optional | Dictionary of container-level securityContext for Pod Security Admission and Pod Security Standards | empty
+ingressClass.ingressClassName | Optional | Name of ingress class | f5
+ingressClass.isDefaultIngressController | Optional | CIS will monitor all the ingresses resource if set true | false
+ingressClass.create | Optional | Create ingress class | true
+
+Note: bigip_login_secret and bigip_secret are mutually exclusive, if both are defined in values.yaml file bigip_secret will be given priority.
+
+
+See the CIS documentation for a full list of args supported for CIS [CIS Configuration Options](https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html)
+
+> **Note:** Helm value names cannot include the character `-` which is commonly used in the names of parameters passed to the controller. To accomodate Helm, the parameter names in `values.yaml` use `_` and then replace them with `-` when rendering.
+> e.g. `args.bigip_url` is rendered as `bigip-url` as required by the CIS Controller.
+
+
+If you have a specific use case for F5 products in the Kubernetes environment that would benefit from a curated chart, please [open an issue](https://github.com/F5Networks/charts/issues) describing your use case and providing example resources.
+
+## Disabling securityContext
+
+By default, the chart applies a pod-level `securityContext` with `runAsUser: 1000`, `runAsGroup: 1000`, and `fsGroup: 1000`. On OpenShift, the Security Context Constraints (SCC) automatically manage these values, so you may need to disable the chart's `securityContext` to avoid conflicts.
+
+To disable `securityContext`, use any of the following methods:
+
+**In values.yaml:**
+```yaml
+securityContext: none
+```
+
+**Via Helm CLI:**
+```shell
+helm install <release-name> f5-stable/f5-bigip-ctlr --set securityContext=none -f values.yaml
+```
+
+**Via OpenShift Operator CR:**
+```yaml
+apiVersion: cis.f5.com/v1
+kind: F5BigIpCtlr
+metadata:
+  name: f5bigipctlr-sample
+spec:
+  securityContext: none
+  # ... other spec fields
+```
+
+Accepted disable values: `none`, `false`, `no`, `disable`, or an empty map `{}`.
+
+To customize specific fields:
+```yaml
+securityContext:
+  runAsUser: 2000
+  runAsGroup: 3000
+  fsGroup: 4000
+```
+
+Any omitted fields will fall back to the default value of `1000`.
+
+## Upgrading CIS with Helm and CRDs
+
+For upgrades that use CIS Custom Resources (for example VirtualServer, TransportServer, Policy, TLSProfile, IngressLink), update CRDs before running `helm upgrade`.
+
+```shell
+    export CIS_VERSION=<cis-version>
+    # For example
+    # export CIS_VERSION=v2.12.0
+    # or
+    # export CIS_VERSION=2.x-master
+    #
+    # the latter if using a CIS image with :latest label
+
+    kubectl create -f https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/${CIS_VERSION}/docs/config_examples/customResourceDefinitions/customresourcedefinitions.yml
+
+    # Then upgrade Helm release
+    helm upgrade <release-name> f5-stable/f5-bigip-ctlr -f values.yaml
+```
+
+Notes:
+
+- The chart does not automatically manage CRD upgrades during `helm upgrade`.
+- Helm hook-based CRD auto-upgrade is not currently provided or supported in this chart.
+- If you are not using CIS CRDs, CRD update can be skipped.
+
+## Uninstalling Helm Chart
+Run the following command to uninstall the chart.
+```helm uninstall <new-chart-name>```
+
+Note: When rbac.namespaced=true the chart:
+- Skips the default broad ClusterRole/Binding.
+- Creates a minimal cluster-scope ClusterRole granting get/list/watch on nodes, namespaces, ingressclasses (and CRDs if ipam enabled).
+- Creates a limited Role in the controller namespace (configmaps + secrets only).
+- Creates Roles/RoleBindings in each args.namespaces granting required namespace-scoped permissions.

packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+description: Deploy the F5 Networks BIG-IP Controller for Kubernetes and OpenShift (k8s-bigip-ctlr).
+icon: https://helm.sh/img/helm.svg
+name: f5-bigip-ctlr
+version: 0.0.38

packs/f5-bigip-ctlr-0.0.38/charts/f5-bigip-ctlr/RBAC-UPGRADE-GUIDE.md

@@ -0,0 +1,177 @@
+# Upgrading from Cluster-wide RBAC to Namespaced RBAC
+
+## Overview
+
+When upgrading F5 BIG-IP Controller and switching from cluster-wide RBAC (`rbac.namespaced: false`) to namespaced RBAC (`rbac.namespaced: true`), you need to manually clean up the old cluster-wide RBAC resources to maintain the principle of least privilege.
+
+## Why Manual Cleanup is Required
+
+Helm does not automatically remove resources when their conditional statements change. When you switch to namespaced RBAC:
+
+- **Old resources persist**: The original ClusterRole and ClusterRoleBinding remain in the cluster
+- **New resources are created**: Namespaced Roles/RoleBindings and minimal ClusterRole are created  
+- **Security concern**: The controller retains broader permissions than intended
+- **Resource clutter**: Unused RBAC resources remain in the cluster
+
+## Pre-Upgrade Cleanup Steps
+
+### 1. Identify Resources to Clean Up
+
+Before upgrading, identify the current cluster-wide RBAC resources:
+
+```bash
+# Replace <release-name> with your actual Helm release name
+RELEASE_NAME="<release-name>"
+
+# List current ClusterRole
+kubectl get clusterrole | grep $RELEASE_NAME
+
+# List current ClusterRoleBinding  
+kubectl get clusterrolebinding | grep $RELEASE_NAME
+```
+
+### 2. Backup Current RBAC Configuration (Optional)
+
+```bash
+# Backup ClusterRole
+kubectl get clusterrole $RELEASE_NAME -o yaml > clusterrole-backup.yaml
+
+# Backup ClusterRoleBinding
+kubectl get clusterrolebinding $RELEASE_NAME -o yaml > clusterrolebinding-backup.yaml
+```
+
+### 3. Clean Up Old Resources
+
+**Important**: Perform this cleanup BEFORE upgrading to avoid permission conflicts.
+
+```bash
+# Delete ClusterRoleBinding first to avoid permission issues
+kubectl delete clusterrolebinding $RELEASE_NAME
+
+# Delete ClusterRole
+kubectl delete clusterrole $RELEASE_NAME
+```
+
+### 4. Upgrade with Namespaced RBAC
+
+```bash
+# Upgrade with namespaced RBAC enabled
+helm upgrade $RELEASE_NAME f5networks/f5-bigip-ctlr \
+  --set rbac.namespaced=true \
+  --set args.namespaces='["namespace1","namespace2"]' \
+  --set args.bigip_url=<your-bigip-url> \
+  [other-parameters]
+```
+
+## Post-Upgrade Verification
+
+### 1. Verify Old Resources are Gone
+
+```bash
+# Should return no results
+kubectl get clusterrole $RELEASE_NAME
+kubectl get clusterrolebinding $RELEASE_NAME
+```
+
+### 2. Verify New Namespaced Resources
+
+```bash
+# Check minimal cluster-scope resources
+kubectl get clusterrole ${RELEASE_NAME}-clusterscope
+kubectl get clusterrolebinding ${RELEASE_NAME}-clusterscope
+
+# Check namespaced roles (replace with your actual namespaces)
+kubectl get role -n namespace1 | grep $RELEASE_NAME
+kubectl get rolebinding -n namespace1 | grep $RELEASE_NAME
+
+# If IPAM is enabled, check IPAM namespace permissions
+kubectl get role -n kube-system | grep ipam
+kubectl get rolebinding -n kube-system | grep ipam
+```
+
+### 3. Verify Controller Functionality
+
+```bash
+# Check controller pod status
+kubectl get pods -n <controller-namespace> | grep $RELEASE_NAME
+
+# Check controller logs for permission errors
+kubectl logs -n <controller-namespace> deployment/$RELEASE_NAME
+```
+
+## Troubleshooting
+
+### Permission Denied Errors
+
+If you see permission-related errors in the controller logs:
+
+1. **Check namespaces configuration**: Ensure `args.namespaces` includes all required namespaces
+2. **Verify IPAM permissions**: If using IPAM, ensure IPAM namespace has proper Role/RoleBinding
+3. **Check cluster-scope permissions**: Verify minimal cluster-scope resources were created
+
+### Rolling Back
+
+If you need to revert to cluster-wide RBAC:
+
+```bash
+# Upgrade back to cluster-wide RBAC
+helm upgrade $RELEASE_NAME f5networks/f5-bigip-ctlr \
+  --set rbac.namespaced=false \
+  [other-parameters]
+
+# Clean up namespaced resources if needed
+kubectl delete role $RELEASE_NAME-namespace1 -n namespace1
+kubectl delete rolebinding $RELEASE_NAME-namespace1 -n namespace1
+# Repeat for other namespaces
+```
+
+## IPAM Considerations
+
+When using IPAM with namespaced RBAC:
+
+- IPAM CRs are created in the namespace specified by `--ipam-namespace` (defaults to `kube-system`)
+- Ensure the `args.ipam_namespace` value in your Helm values matches your CIS configuration
+- The chart automatically creates appropriate IPAM namespace permissions
+
+## Example Complete Upgrade Process
+
+```bash
+# 1. Set variables
+RELEASE_NAME="my-f5-controller"
+NAMESPACES='["app1","app2","app3"]'
+BIGIP_URL="https://192.168.1.100"
+
+# 2. Backup and clean up old resources
+kubectl get clusterrole $RELEASE_NAME -o yaml > clusterrole-backup.yaml
+kubectl get clusterrolebinding $RELEASE_NAME -o yaml > clusterrolebinding-backup.yaml
+kubectl delete clusterrolebinding $RELEASE_NAME
+kubectl delete clusterrole $RELEASE_NAME
+
+# 3. Upgrade to namespaced RBAC
+helm upgrade $RELEASE_NAME f5networks/f5-bigip-ctlr \
+  --set rbac.namespaced=true \
+  --set args.namespaces=$NAMESPACES \
+  --set args.bigip_url=$BIGIP_URL \
+  --set args.ipam=true \
+  --set args.ipam_namespace=kube-system
+
+# 4. Verify upgrade
+kubectl get clusterrole ${RELEASE_NAME}-clusterscope
+kubectl get role -A | grep $RELEASE_NAME
+kubectl logs -n kube-system deployment/$RELEASE_NAME
+```
+
+## Security Benefits
+
+After successful migration to namespaced RBAC:
+
+- **Principle of least privilege**: Controller only has permissions for specified namespaces
+- **Reduced attack surface**: No cluster-wide permissions for most resources
+- **Better compliance**: Easier to audit and meet security requirements
+- **Namespace isolation**: Clear boundary of controller permissions
+
+## Additional Resources
+
+- [F5 CIS RBAC Documentation](https://clouddocs.f5.com/containers/latest/userguide/kubernetes/#cis-installation)
+- [Kubernetes RBAC Best Practices](https://kubernetes.io/docs/concepts/security/rbac-good-practices/)
+- [Helm Upgrade Documentation](https://helm.sh/docs/helm/helm_upgrade/)