f5devcentral/ces-controller repository overview

Container Egress Service (CES) Controller. V0.5.3

⁠Publish date

1. Jan 4

⁠New

• Support running multi instances in the same cluster now.

⁠Enhancement

• Support multi clusters dock to one F5 better.

⁠Fix

• Fix the typo in install.sh

⁠Change

• Remove the initialized setting in the configmap
• Add CES_NAMESPACE env in the CES deployment. The install.sh use $CES_NAMESPACE variable for installation. NOTE: If you are upgrading the ces pod to this version by change the ces deployment directly, pls add below env under the spec.containers

        env:
        - name: CES_NAMESPACE
          value: kube-system <<<< change this to your real namespace which the ces pod running

You can also check the install.sh for the deployment setting.

The another upgrade way is uninstall the old ces first, and then run the install.sh then.

Thanks Yang Xiao Qun for the above change.

⁠Image

There are 2 options:

• Download the image on this page directly and load it manually
• Use f5devcentral/ces-controller:0.5.3 docker hub repo. Pls note the version number.

Please check Github Wiki for all documents.

⁠Early Release

Click Here⁠

Container Egress Service (CES) Controller. V0.5.1

⁠Publish date

2021.Dec 22

⁠New

No new feature in this minor release.

⁠Enhancement

• Allow to control the setting of Virtual Adress, like icmp, arp. Using template to overwrite the default setting is supported. Thanks @Jesonchen⁠ for this enhancement.
• Optimize the AS3 body for tenant use case

⁠Image

There are 2 options:

Download the image on this page directly and load it manually Use f5devcentral/ces-controller:0.5.1 docker hub repo. Pls note the version number. Please check Github Wiki for all documents.

⁠Early Release

Click Here⁠

Container Egress Service (CES) Controller. V0.5.0

⁠Publish date

2021.Dec 1

⁠New

In this release, include below features:

• Egress policy on cluster level
• Egress policy on per namespace level
• Egress policy on per k8s svc
• Egress policy for strict network isolation(tenant)
• Support dynamic bandwidth limit for each egress policy rule
• Support High speed log for events
• Support events/policy visualization and analytics
• Support traffic programming base on policy rule
• Support TCP, UDP or any IP protocol
• Support custom logging fields/formats

⁠Behavior

• It will be into explicit allow mode, once you set any policy.
• Rules changing trigger configurations into F5. The best practice is create create external service first, then create policy rule.
• Delete the associate externalservice will also delete the rule(only for 1:1 mapping between rule and externalservce CRD.see Known issues for detail).
• The externalservice will be splitted to serval objects name if it is referenced by muliti policy rules.
• The blank setting of namespaces in configmap's Common tenant means the controller will not monitor any namespaces.
• Delete externalservice and recreate again, will not trigger update to the F5. Pls delete the associate rule and recreate it.

⁠Known issues

• System will not log event into F5 local db if logging profile use both local and remote destion, and the remote destion is unable reached.
• When an externalservice is referenced by more than one rules. Delete the externalservice CRD first, will cause unexpected result. Pls delete the rule first.

Please check Github Wiki⁠ for all documents.