Per F5’s knowledge base (K000139030), NTP keys do not survive a TMOS upgrade and must be reinstalled, with an ntpd restart, after every upgrade. For those of us where NTP authentication is a compliance requirement, this has become part of the standard upgrade process, but it is prone to human error and does not scale. With F5 publishing hardened releases on a faster schedule, I wanted to find s solution that removes needing to re-add the key and restart ntpd.
The F5 NTP Key Restore Script is a small bash script hooked into F5’s startup process through /config/startup, as outlined in K11948. Once the system has finished initializing, it checks /etc/ntp/keys for the configured key or keys; if any are missing, it reinstalls them and restarts ntpd. The script lives under /config, so it is carried in the UCS and survives the upgrade that wipes the keys file. It is not config-syncable, so it has to be installed on each unit, but NTP keys rotate rarely and the one-time setup is small compared with the loss of NTP authentication after every upgrade, which has to be remediated immediately in some environments.
https://github.com/hauptem/F5-NTP-Key-Restore-Script
References:
K000139030: Changes made to the /etc/ntp/keys file are lost after an upgrade
K11948: Configuring the BIG-IP system to run commands or scripts upon system startup