Skip to content

Commit f3c176b

Browse files
vklohiyavklohiya
authored
2.3 Release Notes (#1722)
1 parent 09cb76c commit f3c176b

File tree

2 files changed

+72
-56
lines changed

2 files changed

+72
-56
lines changed

‎docs/RELEASE-NOTES.rst‎

Lines changed: 58 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,38 @@
11
Release Notes for Container Ingress Services for Kubernetes & OpenShift
22
=======================================================================
33

4-
Next Release
4+
2.3.0
55
-------------
66
Added Functionality
77
```````````````````
8-
* Added Passthrough TLS Termination Feature
9-
* Added support for AS3 schema versiion
8+
* CIS supports IP address assignment to Virtual Server CRD using `F5 IPAM Controller <https://github.com/f5devcentral/f5-ipam-controller/releases>`_. Refer for `Examples <https://github.com/f5devcentral/f5-ipam-controller/blob/main/README.md>`_.
9+
* CIS allows user to leverage Virtual IP address using either `F5 IPAM Controller <https://github.com/f5devcentral/f5-ipam-controller/releases>`_ or virtualServerAddress field in VirtualServer CRD
10+
* Support Passthrough termination for TLS CRD
11+
* Added support for AS3 schema minor versions
12+
* :issues:`1631` Support `caCertificate` for OpenShift Routes
13+
* :issues:`1571` iRule reference for VirtualServer CRDs
14+
* :issues:`1592` :issues:`1621` Enabling VLANS for VirtualServer and TransportServer CRDs
15+
* Updated CR Kind from `NginxCisConnector` to `IngressLink`
16+
* Helm Chart Enhancements:
17+
- Added Support for `livenessProbe <https://github.com/F5Networks/charts/issues/34>`_, `ReadinessProbe <https://github.com/F5Networks/charts/issues/34>`_, `nodeSelectors <https://github.com/F5Networks/charts/issues/38>`_, `tolerations <https://github.com/F5Networks/charts/issues/38>`_.
18+
- :issues:`1632` Added Support for skipping CRDs.
1019

1120
Bug Fixes
1221
`````````
13-
* :issues:`1457` Each Client request will be logged on BIG-IP when http2-profile is associated to VS
14-
* :issues:`1498` In iRule openshift_passthrough_irule the variable "$dflt_pool" could not be set correctly when http/2-profile is linked to VS
15-
* :issues:`1458` CISv2.1.0 does not delete LTM-Policy reset-rule when OpenShift-annotation for whitelist-source-range will be removed
22+
* :issues:`1457` Each Client request get logged on BIG-IP when http2-profile associated to VS
23+
* :issues:`1458` CISv2.1.0 does not delete LTM-Policy reset-rule when removed the whitelist-source-range OpenShift annotation
24+
* :issues:`1498` openshift_passthrough_irule could not set the variable "$dflt_pool" correctly when http/2-profile linked to VS
25+
* :issues:`1565` Logs should distinguish configmap and Ingress errors
26+
* :issues:`1641` Debug log sKey.ServiceName in syncVirtualServer
27+
* :issues:`1671` TransportServer assigns wrong pool/service
28+
* SR: CIS fail to update pod arp on BigIP,"Attempted to mutate read-only attribute(s)"
29+
* CIS allowing to access all non-belonging pool members from a single reachable VIP in CRD mode.
1630

1731
Limitations
1832
```````````
19-
* For AB routes HTTP2 traffic does not distribute properly when http2-profile is associated to VS
33+
* For AB routes HTTP2 traffic does not distribute properly when http2-profile associated to VS
34+
* Workaround for CIS in `IPAM mode <https://github.com/f5devcentral/f5-ipam-controller/blob/main/README.md>`_.
35+
* Removing virtualServerAddress field from VSCRD in non-IPAM mode may flush corresponding BIGIP configuration
2036

2137

2238
2.2.3
@@ -90,31 +106,31 @@ Added Functionality
90106
`````````````````````
91107
**Custom Resource Definition (CRD)**
92108

93-
* Multiple ports in a single service.
109+
* Multiple ports in a single service.
94110
* `TrasnsportServer` Custom Resource.
95111
* VirtualServer Custom Resource without Host Parameter.
96112
* Share Nodes implementation for CRD, Ingress and Routes.
97113
* WAF Integration.
98-
* SNAT in VirtualServer CRD.
99-
* Option to configure Virtual address port.
100-
* App-Root Rewrite and Path Rewrite.
101-
* Health Monitor for each pool member.
114+
* SNAT in VirtualServer CRD.
115+
* Option to configure Virtual address port.
116+
* App-Root Rewrite and Path Rewrite.
117+
* Health Monitor for each pool member.
102118
* Option to configure VirtualServer name.
103119
* Nginx CIS connector.
104120
* Namespace label.
105121
* CRD TEEMs Integration.
106122
* Support for AS3 3.23.
107123
* Upgraded AS3 Schema validation version from v3.11.0-3 to v3.18.0-4.
108-
* Schema - <https://github.com/F5Networks/k8s-bigip-ctlr/tree/master/docs/_static/config_examples/crd/Install/customresourcedefinitions.yml>`_.
109-
* Examples - <https://github.com/F5Networks/k8s-bigip-ctlr/tree/master/docs/_static/config_examples/crd>`_.
124+
* `CRD Schema <https://github.com/F5Networks/k8s-bigip-ctlr/tree/master/docs/_static/config_examples/crd/Install/customresourcedefinitions.yml>`_.
125+
* `CRD Examples <https://github.com/F5Networks/k8s-bigip-ctlr/tree/master/docs/_static/config_examples/crd>`_.
110126

111127
Bug Fixes
112128
`````````
113129
**Custom Resource Definition (CRD)**
114130

115131
* Verify the AS3 installation on BIGIP in CRD Mode.
116132
* Streamlined logs.
117-
* Fix unnecessary creation of HTTP VirtulServer when httpTraffic is None.
133+
* Fix unnecessary creation of HTTP VirtulServer when httpTraffic is None.
118134

119135
**Routes**
120136

@@ -124,7 +140,7 @@ Bug Fixes
124140
Limitations
125141
```````````
126142
* Modifying VirtualServer address leads to traffic loss intermittently. Delete and re-create the VirtualServer as an alternative.
127-
* VirtualServers with same host and virtualServerAddress should maintain same parameters except pool, tlsProfileName and monitors.
143+
* VirtualServers with same host and virtualServerAddress should maintain same parameters except pool, tlsProfileName and monitors.
128144

129145
2.1.1
130146
-------------
@@ -166,7 +182,7 @@ Limitations
166182
Added Functionality
167183
```````````````````
168184
* CIS will not create `_AS3` partition anymore.
169-
- CIS uses single partition(i.e. `--bigip-partition`) to configure both LTM and NET configuration.
185+
- CIS uses single partition(i.e. `--bigip-partition`) to configure both LTM and NET configuration.
170186
- Removes Additional AS3 managed partition _AS3, if exists.
171187
* Enhanced performance for lower BIG-IP CPU Utilization with optimized CCCL calls.
172188
* CIS 2.x releases requires AS3 versions >= 3.18.
@@ -205,7 +221,7 @@ Bug Fixes
205221
Vulnerability Fixes
206222
```````````````````
207223
+------------------+------------------------------------------------------------------------------------+
208-
| CVE | Comments |
224+
| CVE | Comments |
209225
+==================+====================================================================================+
210226
| CVE-2018-5543 | CIS Operator uses --credentials-directory by default for BIG-IP credentials |
211227
+------------------+------------------------------------------------------------------------------------+
@@ -219,7 +235,7 @@ Archived CF and Mesos Github repos
219235
Guidelines for upgrading to CIS 2.1
220236
```````````````````````````````````
221237
* Those migrating from agent CCCL to agent AS3 :
222-
- User should clean up LTM resources in BIG-IP partition created by CCCL before migrating to CIS 2.1.
238+
- User should clean up LTM resources in BIG-IP partition created by CCCL before migrating to CIS 2.1.
223239
Steps to clean up LTM resources in BIG-IP partition using AS3
224240
* Use below POST call along with this `AS3 declaration <https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/master/docs/_static/config_examples/example-empty-AS3-declaration.yaml>`_.
225241
- mgmt/shared/appsvcs/declare
@@ -257,14 +273,14 @@ Bug Fixes
257273
* :issues:`1233` CIS handles ClientSSL annotation and cert/key logging issues.
258274
* :issues:`1145,1185,1295` CIS handles namespace isolation for AS3 configmaps.
259275
* :issues:`1241,1229` CIS fetches 3.18 AS3 schema locally.
260-
* :issues:`1191` CIS cleans AS3 managed partition when moved to CCCL as agent.
276+
* :issues:`1191` CIS cleans AS3 managed partition when moved to CCCL as agent.
261277
* :issues:`1162` CIS properly handles OpenShift Route admit status.
262278
* :issues:`1160` CIS handles https redirection for ingress which accepts all common names.
263279

264280
Vulnerability Fixes
265281
`````````````````````
266282
+------------------+----------------------------------------------------------------+
267-
| CVE | Comments |
283+
| CVE | Comments |
268284
+==================+================================================================+
269285
| CVE-2009-3555 | CIS disables renegotiation for all Custom ClientSSL |
270286
+------------------+----------------------------------------------------------------+
@@ -312,8 +328,8 @@ Added Functionality
312328
- `--manage-ingress-class-only` A flag whether to handle Ingresses that do not have the class annotation and with annotation `kubernetes.io/ingress.class` set to `f5`. When set `true`, process ingress resources with `kubernetes.io/ingress.class` set to `f5` or custom ingress class.
313329
- `--ingress-class` to define custom ingress class to watch.
314330
- `--filter-tenants` A flag whether to enable tenant filtering in BIG-IP.
315-
* CIS pushes AS3 Configuration after 3 seconds when encounters 503 HTTP response code from BIG-IP.
316-
* CIS does not push AS3 configuration when encounters 404 HTTP response code from BIG-IP.
331+
* CIS pushes AS3 Configuration after 3 seconds when encounters 503 HTTP response code from BIG-IP.
332+
* CIS does not push AS3 configuration when encounters 404 HTTP response code from BIG-IP.
317333

318334
Bug Fixes
319335
`````````
@@ -369,7 +385,7 @@ Added Functionality
369385
* Added support for OpenShift version 4.1.
370386
- | Controller service account needs ``cluster-admin`` role. Before upgrading controller to v1.11.0 and above, update cluster role as follows:
371387
| ``oc adm policy add-cluster-role-to-user cluster-admin -z <service-account-name> -n <namespace>``
372-
* Added support for Alternate Backend Deployment in OpenShift Routes while using as3 backend.
388+
* Added support for Alternate Backend Deployment in OpenShift Routes while using as3 backend.
373389
* Controller updates Route status in Openshift Web Console (OpenShift 3.11 and below).
374390
* Controller includes the body of AS3 API call error responses in Debug logs.
375391
* Added support for validating AS3 JSON against the latest schema. Controller downloads the latest schema during startup.
@@ -444,7 +460,7 @@ Added Functionality
444460

445461
Bug Fixes
446462
`````````
447-
* :issues:`736` - Added support for Google Container Engine (GKE) LoadBalancer service. Validated against Kubernetes 1.13.4.
463+
* :issues:736 - Added support for Google Container Engine (GKE) LoadBalancer service. Validated against Kubernetes 1.13.4.
448464

449465
Limitations
450466
```````````
@@ -474,8 +490,8 @@ Added Functionality
474490

475491
Bug Fixes
476492
`````````
477-
* :issues:`810` - Controller doesn't delete services and recreates during bigip-ctlr pod restart
478-
* :issues:`718` - Namespaces that start with a number does not cause errors
493+
* :issues:810 - Controller doesn't delete services and recreates during bigip-ctlr pod restart
494+
* :issues:718 - Namespaces that start with a number does not cause errors
479495

480496
Limitations
481497
```````````
@@ -494,7 +510,7 @@ Vulnerability Addresses
494510

495511
Bug fixes
496512
`````````
497-
* :issues:`789` - Controller properly creates https redirect for child paths in k8s Ingress.
513+
* :issues:789 - Controller properly creates https redirect for child paths in k8s Ingress.
498514
* Fixes an issue in openshift where communication breaks with clients with no SNI support.
499515

500516
v1.7.0
@@ -504,24 +520,24 @@ Added Functionality
504520
```````````````````
505521
* Added `--manage-configmaps` argument to CC to prevent or allow CC to respond to ConfigMap events. Defaults to `true`.
506522
* Added `virtual-server.f5.com/whitelist-source-range` Ingress/Route annotation to support IP CIDR whitelisting.
507-
* :issues:`699` - Ability to configure health monitor type in Ingress/Route annotation. Http is the default.
523+
* :issues:699 - Ability to configure health monitor type in Ingress/Route annotation. Http is the default.
508524
* Changed container base image to use debian-slim.
509525

510526
Bug Fixes
511527
`````````
512-
* :issues:`735` - Deleted rules from routes and ingresses on the same service not cleaned up properly.
513-
* :issues:`753` - Controller doesn't delete and recreate annotation-based policy rules.
514-
* :issues:`755` - Controller implements best-match by setting first-match and sorting rules in reverse lexical order.
515-
* :issues:`765` - Controller properly sorts Route rules in reverse lexical order.
528+
* :issues:735 - Deleted rules from routes and ingresses on the same service not cleaned up properly.
529+
* :issues:753 - Controller doesn't delete and recreate annotation-based policy rules.
530+
* :issues:755 - Controller implements best-match by setting first-match and sorting rules in reverse lexical order.
531+
* :issues:765 - Controller properly sorts Route rules in reverse lexical order.
516532

517533
v1.6.1
518534
------
519535

520536
Bug Fixes
521537
`````````
522-
* :issues:`486` - User cannot configure the controller to manage the Common partition.
523-
* :issues:`743` - Controller doesn't temporarily remove entire BIG-IP configs after deleting a single service.
524-
* :issues:`746` - Log messages and documentation added to ensure Route profile configuration is clear.
538+
* :issues:486 - User cannot configure the controller to manage the Common partition.
539+
* :issues:743 - Controller doesn't temporarily remove entire BIG-IP configs after deleting a single service.
540+
* :issues:746 - Log messages and documentation added to ensure Route profile configuration is clear.
525541

526542
v1.6.0
527543
------
@@ -548,8 +564,8 @@ v1.5.1
548564

549565
Bug Fixes
550566
`````````
551-
* :issues:`683` - Controller upgrades properly with new metadata field.
552-
* :issues:`686` - Controller in cluster mode does not rely on vxlan name to configure pool members.
567+
* :issues:683 - Controller upgrades properly with new metadata field.
568+
* :issues:686 - Controller in cluster mode does not rely on vxlan name to configure pool members.
553569

554570
v1.5.0
555571
------
@@ -559,7 +575,7 @@ Added Functionality
559575
* Support for virtual server source address translation configuration.
560576
* Support for app-root and url-rewrite annotations.
561577
* Added controller name and version to the metadata of certain BIG-IP LTM resources managed by the controller.
562-
* :issues:`433` - Support for pre-existing server ssl profiles for Ingresses.
578+
* :issues:433 - Support for pre-existing server ssl profiles for Ingresses.
563579
* Added support for attaching OpenShift Routes to existing BIG-IP virtual servers.
564580
* Added support for Kubernetes version 1.8.
565581
* Added support for OpenShift Origin version 3.7.
@@ -585,8 +601,8 @@ Limitations
585601
```````````
586602
* Cannot apply app-root and url-rewrite annotations to the same resource; see: :issues:675
587603
* If an older controller created resources, upgrading to the new version could
588-
result in a python exception when adding metadata to virtuals: :issues:`683`
589-
* If running the controller in cluster mode without a vxlan name, pool members are not created: :issues:`686`
604+
result in a python exception when adding metadata to virtuals: :issues:683
605+
* If running the controller in cluster mode without a vxlan name, pool members are not created: :issues:686
590606

591607
v1.4.2
592608
------
@@ -776,4 +792,4 @@ Limitations
776792

777793

778794
.. _Download and install the latest iApps templates: https://support.f5.com/csp/article/K13422
779-
.. _Set the service to use the newer iApp template: https://support.f5.com/csp/article/K17001
795+
.. _Set the service to use the newer iApp template: https://support.f5.com/csp/article/K17001

‎docs/_static/config_examples/crd/IngressLink/README.md‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,44 +12,44 @@ Minimum version to use IngressLink:
1212
| 2.3+ | v13.1+ | 1.10+ | 3.18+ |
1313

1414

15-
## Configuration
15+
## Configuration
1616

17-
### 1. Create IngressLink Custom Resource Definition
17+
### 1. Create IngressLink Custom Resource Definition
1818

1919
Create IngressLink Custom Resource definition as follows:
20-
20+
2121
kubectl apply -f https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/master/docs/_static/config_examples/crd/IngressLink/ingresslink-customresourcedefinition.yaml
22-
22+
2323

2424
### 2. Create the Proxy iRule on Bigip
2525

26-
* Login to BigIp GUI
26+
* Login to BigIp GUI
2727
* On the Main tab, click Local Traffic > iRules.
2828
* Click Create.
2929
* In the Name field, type name as "Proxy_Protocol_iRule".
30-
* In the Definition field, Copy the definition from [Proxy_Protocol_iRule](https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/doc/docs/_static/config_examples/crd/IngressLink/Proxy_Protocol_iRule) file.
30+
* In the Definition field, Copy the definition from [Proxy_Protocol_iRule](https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/master/docs/_static/config_examples/crd/IngressLink/Proxy_Protocol_iRule) file.
3131
* Click Finished.
3232

33-
### 3. Install the CIS Controller
33+
### 3. Install the CIS Controller
3434

3535
* Refer to [CIS Installation guide](https://clouddocs.f5.com/containers/latest/userguide/cis-helm.html) to install Container Ingress Services on Kubernetes or Openshift
3636
* Make sure that you deployed CIS in CRD mode (use "--custom-resource-mode=true" and "--ingress-link-mode=true" in your CIS Configuration. This is specific to this preview)
3737

3838
### 4. Install the Nginx Ingress Controller
3939

40-
* Refer to [Integration with F5 Container Ingress Services](https://github.com/nginxinc/kubernetes-ingress/blob/master/docs-web/integration-with-cis.md#1-install-the-ingress-controller-with-the-integration-enabled) to deploy NGINX Ingress Controller
40+
* Refer to [Integration with F5 Container Ingress Services](https://github.com/nginxinc/kubernetes-ingress/blob/master/docs-web/integration-with-cis.md) to deploy NGINX Ingress Controller
4141

4242
### 5. Create an IngressLink Resource
43-
43+
4444
* Download the sample IngressLink Resource:
45-
46-
```curl -OL https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/doc/docs/_static/config_examples/crd/IngressLink/ingresslink.yaml```
45+
46+
```curl -OL https://raw.githubusercontent.com/F5Networks/k8s-bigip-ctlr/doc/docs/_static/config_examples/crd/IngressLink/ingresslink.yaml```
4747

4848
* Update the "virtualServerAddress" parameter in the ingresslink.yaml resource. This IP address will be used to configure the BIG-IP device. It will be used to accept traffic and load balance it among the NGINX Ingress Controller pods.
4949

50-
```kubectl apply -f ingresslink.yaml```
50+
```kubectl apply -f ingresslink.yaml```
5151

52-
##### Note:
52+
##### Note:
5353
1. The name of the app label selector in IngressLink resource should match the labels of the service which exposes the NGINX Ingress Controller.
5454
2. The service which exposes the NGINX Ingress Controller should be of type nodeport.
5555

@@ -69,7 +69,7 @@ Let's test the traffic (in this example we used 192.168.10.5 as our VirtualServe
6969
Server address: 10.12.0.18:80
7070
Server name: coffee-7586895968-r26zn
7171
...
72-
72+
7373
Also, if you check the status of the cafe-ingress, you will see the IP of the VirtualServerAddress (in this example we used 192.168.10.5 as our VirtualServerAddress):
7474
```
7575
$ kubectl get ing cafe-ingress

0 commit comments

Comments
 (0)