Can an F5 VIP and Pool have a container member?

The resolution to this turned out to be quite simple. The firewall setup to allow the F5 to access our servers was for a specific port range only. The Traefik ports (80,443,8080) were not included in this range. Once the rules were added in the pool member was able to pass the health monitor checks.

Since you mentioned Kubernetes, I'm assuming you're talking about Pods. Pods behind a Kubernetes cluster are not directly reachable and they're ephemeral, i.e. they can "die" and be replaced by another pod using a different IP address.

If you want to make your Pods reachable, you need to create an object called Service. The function of a Service is similar to a Load Balancer. You add a bunch of pods to a service and it load balances the requests to them. Services have a unique FQDN and IP address and this will solve the issue where pods are ephemeral. Up to now, this is all within your Kubernetes cluster. So you've got Service pointing to pods.

After that, you need to "expose" your service. Exposing just means "making it reachable" externally. There are a couple of options but you'd normally use "NodePort" option where each node in your Kubernetes cluster will be reachable via their EXTERNAL_IP:PORT.

You now add EXTERNAL_IP:PORT as pool members of your virtual server on BIG-IP and BIG-IP handles traffic for the Service at the specified virtual address and load balances to all nodes in the cluster. Within the cluster, the allocated NodePort load balances traffic to all pods.

However, this is not ideal because it doesn't track changes within your Kubernetes cluster and for that reason I'd recommend using kctlr-k8s-ingress-ctlr (https://clouddocs.f5.com/containers/v2/kubernetes/kctlr-k8s-ingress-ctlr.html)

If you're using just a container in a bare metal server, not behind Kubernetes, you just need to expose your container externally, i.e. make it reachable and BIG-IP should be able to monitor it.

Hope it helps.

Rodrigo