# How can k8s CIS CRD VirtualServer reference existing APM Access profile? **URL:** \ **Category:** Technical Forums\ **Tags:** cis, k8s, devops, security, apm\ **Created:** [November 7, 2025, 10:10am UTC](https://community.f5.com/t/how-can-k8s-cis-crd-virtualserver-reference-existing-apm-access-profile/76652 "2025-11-07T10:10:13Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\ **Post date:** [November 7, 2025, 10:10am UTC](https://community.f5.com/t/how-can-k8s-cis-crd-virtualserver-reference-existing-apm-access-profile/76652/1 "2025-11-07T10:10:13Z")
Hey Everyone, How can k8s Container Ingress Services (CIS) CRD VirtualServer reference existing APM Acess profile? I know that this is in as3 ( [Access-Related declarations](https://clouddocs.f5.com/products/extensions/f5-appsvcs-extension/3.32/declarations/access-related.html) ) but I don’t see such options in the virtualserver ( [https://clouddocs.f5.com/containers/latest/userguide/crd/virtualserver.html](https://clouddocs.f5.com/containers/latest/userguide/crd/virtualserver.html)  ) or policy ( [https://clouddocs.f5.com/containers/latest/userguide/crd/virtualserver.html](https://clouddocs.f5.com/containers/latest/userguide/crd/virtualserver.html)  ) crd and I don’t want to use old way with config maps. Edit: A not great workaround I found is attaching an access profile by using an irule ([APM access-profile can be assigned from iRule only](https://my.f5.com/manage/s/article/K55471934)) as the F5 CRD supports attaching configured existing irules. apiVersion: “[cis.f5.com/v1](http://cis.f5.com/v1)” kind: VirtualServer metadata:   name: vs-test   namespace: xxxx   labels:     f5cr: “true” spec:   virtualServerAddress: “xxxx”   virtualServerHTTPPort: xxx   snat: auto   iRules:   - “/Common/test-irule”   pools:   - monitor:       interval: 10       recv: “”       send: “GET /”       timeout: 31       type: http     path: /     service: XXX     servicePort: 80 ---
**Author:** ![MichaelOLeary](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/michaeloleary/32/14931_2.png) [@MichaelOLeary](https://community.f5.com/u/MichaelOLeary)\ **Post date:** [November 8, 2025, 5:40pm UTC](https://community.f5.com/t/how-can-k8s-cis-crd-virtualserver-reference-existing-apm-access-profile/76652/2 "2025-11-08T17:40:52Z")
Hi @Nikoolayy1 Judging from the docs, it looks like the answer is no. [Policy](https://clouddocs.f5.com/containers/latest/userguide/crd/policy.html) However, the best way to let F5 PM know you want this is currently to sumbit a Github issue here: [Issues · F5Networks/k8s-bigip-ctlr · GitHub](https://github.com/F5Networks/k8s-bigip-ctlr/issues) You can message me directly or email me if you want to discuss more. I’d be more than happy to help out personally. Mike. ---
**Author:** ![MichaelOLeary](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/michaeloleary/32/14931_2.png) [@MichaelOLeary](https://community.f5.com/u/MichaelOLeary)\ **Post date:** [November 8, 2025, 5:43pm UTC](https://community.f5.com/t/how-can-k8s-cis-crd-virtualserver-reference-existing-apm-access-profile/76652/3 "2025-11-08T17:43:26Z")
Hi @Nikoolayy1 , Update: I looked through some example Policy CRD’s and this one looks like it might be what you are after? [k8s-bigip-ctlr/docs/config\_examples/customResource/Policy/policy-with-profileAccess.yaml at master · F5Networks/k8s-bigip-ctlr · GitHub](https://github.com/F5Networks/k8s-bigip-ctlr/blob/master/docs/config_examples/customResource/Policy/policy-with-profileAccess.yaml) apiVersion: [cis.f5.com/v1](http://cis.f5.com/v1) kind: Policy metadata:   labels:     f5cr: “true”   name: cr-policy1   namespace: default spec:   l7Policies:     profileAccess: /Common/prof-access     policyPerRequestAccess: /Common/per-req-pol     waf: /Common/WAF\_Policy1 I will assume you know how to add a policy and link to it? Can you shoot me a message if this works for you? ---
**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\ **Post date:** [November 10, 2025, 1:02pm UTC](https://community.f5.com/t/how-can-k8s-cis-crd-virtualserver-reference-existing-apm-access-profile/76652/4 "2025-11-10T13:02:59Z")
Hey @MichaelOLeary   will test it with APM access as I have enough resources just for f5 asm/awaf at the moment but I did test it with waf and it worked. If I see issues I will open a case under git. Just to ask if APM/Access api-protection profile can be applied the same way? Other interesting question is if there is F5 AS3 declaration called “policy” as I think the CIS CRD  should match 1 to 1 with AS3 declarations in the backend but I could not find it.