Forum Discussion

gorantornqvist-sr's avatar
gorantornqvist-sr
Icon for Altostratus rankAltostratus
Jun 30, 2023

Cannot create tcp-only VirtualServer with bigip-controller

Im running Rancher and ingress-nginx and would like a simple solution to manage VIPs and have automatic update of the pool members, e.g passthru/tcp-only loadbalancing with TLS termination in ingress...
devops
gorantornqvist-sr's avatar
gorantornqvist-sr
Icon for Altostratus rankAltostratus
Jun 30, 2023

Thanks for the quick reply.
There is some weird behavior, no its encrypted traffic on port 443 in ingress-nginx that I want to passthru to.

If I set virtualServerHTTPSPort: 443
I get a VIP on port 80 instead.

So the CIS controller doesnt seem to have a "Service Port" settings as the Web GUI has.
Using this reference: https://clouddocs.f5.com/containers/latest/userguide/crd/virtualserver.html#monitor-components.
And the docs lacks of any samples describing how a tcp-only VIP should be setup.

Im on the devops team and not the network team that has support info ...but I will probably contact them next week since Im stuck at the moment.

  • whisperer's avatar
    whisperer
    Icon for MVP rankMVP
    Jun 30, 2023

    You sound like the hell I was experiencing when the Ansible collections first came out from F5. I was also a power user in the beginning and finding bugs left and right. Heck, I still find bugs with just using TCL commands to re/deploy iApp templates in a special 'hacky' way where you modify the template and then redeploy, lol.

    I would suggest the network team just give you access to the F5 support account. They can set you up with your own login, so that you can submit support, request for enhancement, and potential bugs. If you formally submit this, F5 is quick to work on the issue. Certain API stuff, like Ansible, does have its own github where you can submit issues and actual F5 developers work on these. DOES looks like k8s-bigip-ctlr is one of those projects 😉 Take a look here:

    https://github.com/F5Networks

    Maybe submit the issue there, and if that has no movement, get Network team to put in a support ticket.