New iAppVariables are not submitted

[sfudeus]

Description

This describes an observed bug when using the iApp mechanism.

Observation:
Adding new iAppVariables to a configMap does not trigger an update at the BIG-IP-API. Changes to existing iAppVariables or removals are correctly handled.
When triggering an additional change (change or removal of iAppVariable or change of a different attribute of the configMap) the newly added iAppVariable is considered. But it does not trigger an update if its own.
The config.json within the k8s-bigip-ctrl is always updated correctly, it is just not submitted to the BIG-IP-API.
There are no specific error entries in the log of the k8s-bigip-ctrl.

Expectation:
Any change to the configMap should trigger a relevant update at the BIG-IP-API. The desired state in the configMap should be (eventually) reflected in the state if the iApp.

Kubernetes Version

1.15.3

Controller Version

1.9.2

BIG-IP Version

13.1.1.5

[mdditt2000]

hello @sfudeus - we are not going to add any more legacy iAppVariables to CC configmap. We have changed the BIG-IP-API to using AS3. In three months the BIG-IP-API CCCL based API will be removed from CIS and renamed to CIS 2.0.

We added AS3 configmaps to CIS 1.9 and will be adding CRDs to CIS 2.1 early next year. Please can you start migrating your services to AS3 JSON data in the configmaps. Here is some examples.

https://github.com/mdditt2000/kubernetes/blob/dev/cis-1-10/howto.md

Please let me know if you need additional assistance or some examples. Thanks Mark

[sfudeus]

Hi @mdditt2000,
thanks for the update on the timeline. This means that we need to expedite our efforts to migrate to AS3. I'm still quite unhappy that for AS3 the controller needs even more unnecessary privileges for our intended use-cases (see #695).

I was not aware that you need to "add" any iAppVariables, since in the configmap it is just an arbitrary dict which relayed to our own iApp implementation - this is at least how I understood the mechanism. If the variable was present in the initial add of the configmap or when a different field is changed, then it is submitted, only if the single update of a configmap is an additional iAppVariable then that update is not processed. I am a bit sad to hear that issue cannot be fixed.

Thanks for the offer for additional assistance, I'll come back to it as soon as we dive into it and see need then.

[mdditt2000]

@sfudeus AS3 requires admin creds. Here are some options that we are working on.

1. CIS uses Token based auth with BIG-IQ which manages your BIP-IPs. CIS sends the declaration/configmap via BIG-IQ. You could also use the BIG-IQ templating. I can provide you with a image if you want to test BIG-IQ integration.

2. Tenant filtering. We are filter the tenent that is allowed to make a API call to BIG-IP. There if you are using tenant AS3, CIS will only declare to that tenent. BIG-IP can had additional RBAC on the API call. Ultimately not anything other than CIS,AS3. I can also provide you with a build to test.

[juliantaylor]

the underlying issue is here f5devcentral/f5-cccl#248

[sfudeus]

@mdditt2000 We recently established that the AS3 integration in CIS is not yet sufficient to solve our cases currently solved with the iApp approach. It might well be that CRD support in CIS 2.1 will solve that, but that still is some months down the line, light?
@juliantaylor most likely discovered the issue about why the iAppVariables are not correctly synced, so it would be rather easy to release a fix, right? We could go with a patched fork ( in fact we do currently), but I suppose other users might suffer from the same problem, too.

[mdditt2000]

@sfudeus please looks at CIS 2.1 and the deployment of CRDs. https://github.com/F5Networks/k8s-bigip-ctlr/blob/master/docs/_static/config_examples/crd/CustomResource.md

[mdditt2000]

CRDs no GA with CIS 2.2. Closing this issue out.