DOCSEARCHbyAlgolia
Submit Docs

F5 BIG-IP Application Services 3 Extension (AS3)

repository·main·Indexed 41 days ago

https://github.com/f5networks/f5-appsvcs-extension

A declarative configuration extension for F5 BIG-IP systems that uses JSON declarations to manage application services. It replaces traditional imperative command-line management with a desired-state mechanism. The extension includes JSON schema files for validation and supports advanced configurations for APM profiles, VDI profiles, SSL Orchestrator, and WAF security policies.

Tokens
84.7K
Snippets
291
Records
436
Agent score
50%

What's inside AS3

  1. Overview of F5 BIG-IP Application Services 3 Extension (AS3)

    main
    F5 BIG-IP AS3 is a declarative mechanism for managing application-specific configurations on F5 BIG-IP systems. Instead of using imperative commands, users provide a JSON declaration that describes the desired state of the application services. This approach allows for flexible, low-overhead configuration management.

  2. What is BIG-IP AS3?

    main

    BIG-IP AS3 is a JavaScript iControl LX plugin used for the declarative configuration of Layer 4-7 Application and Security Services on BIG-IP.

    Key Characteristics:

    • Declarative: You provide a JSON declaration representing the desired state, and AS3 handles the sequencing and order of operations.
    • Idempotent & Atomic: Declarations are applied atomically, ensuring the system reaches the desired state reliably.
    • Multi-tenant: It uses administrative partitions to enable multi-tenancy and prevent naming collisions.
    • Supported Modules: Supports LTM, GTM/DNS, APM, AFM, ASM, and PEM.

    What it is NOT:

    • It is not used for onboarding or licensing BIG-IP devices (use Declarative Onboarding instead).
    • It is not intended for Layer 2/3 objects like Route Domains, Routes, Self IPs, or VLANs.
    • It is not a replacement for iWorkflow or a graphical interface.

  3. Introduction to BIG-IP AS3

    main

    F5 BIG-IP Application Services 3 Extension (BIG-IP AS3) is a declarative mechanism for managing application-specific configurations on a BIG-IP system. Instead of using imperative commands, you provide a JSON declaration that represents the desired state of the configuration. BIG-IP AS3 is responsible for ensuring the system matches this declaration.

    Key characteristics:

    • Declarative Model: You define the end state via JSON.
    • Schema Validation: Declarations are well-defined according to JSON Schema rules.
    • Multiple Input Methods: AS3 accepts updates via:
      • REST (push): Sending declarations via API calls.
      • Reference (pull): Referencing external sources.
      • CLI (flat file editing): Editing files directly via the command line.

  4. What is Unchecked mode and when to use it

    main

    Unchecked mode is an optimization feature in BIG-IP AS3 (supported since version 3.31) that improves performance when updating large configurations.

    In this mode, BIG-IP AS3 skips checking the current BIG-IP state and instead assumes the device state matches the last successfully applied declaration. This reduces the number of iControl REST requests sent across the network, which is particularly beneficial when managing declarations containing hundreds or thousands of objects.

    When to use it: Use Unchecked mode when you have very large declarations and you are certain that no manual changes (via TMSH or the BIG-IP Configuration utility) have been made to the managed tenant outside of AS3.

  5. What is Service Discovery in AS3?

    main
    Service Discovery enables the BIG-IP system to automatically update members in a load balancing pool based on cloud application hosts. Instead of defining static IP addresses, you tag your cloud resources (AWS, Azure, or Google Cloud) with specific key-value pairs. In your AS3 declaration, you provide the cloud tag key and value, and the BIG-IP VE programmatically discovers and manages pool members based on those tags. If a resource loses its tags, the BIG-IP automatically removes it from the pool.

  6. What is burst handling in BIG-IP AS3?

    main

    Burst handling is a feature designed to manage scenarios where multiple declaration requests (such as DELETE, POST, or PATCH) are sent to BIG-IP AS3 simultaneously.

    Without burst handling, concurrent requests result in a 503 - Service Unavailable error with the message: "Error: Configuration operation in progress on device, please try again in 2 minutes."

    With burst handling enabled, AS3 queues these requests and processes them sequentially, one after another. Note that GET requests bypass the queue to provide the current state of the machine immediately.

  7. Reuse nodes across tenants using shareNodes

    main

    The shareNodes property in a pool member declaration allows you to reuse an existing node from a previous declaration in a new declaration without causing a conflict error.

    By default, shareNodes is false. If you attempt to use a node IP that was already used in a previous declaration without setting shareNodes: true, you will receive a 422 error indicating a conflict.

    Requirements and Constraints

    • Original Declaration: You MUST have shareNodes set to true in the original declaration that first defines the node. If it wasn't set, you must update the original declaration and re-POST it before using the node in a new declaration.
    • Moving Nodes: To move a node between partitions, the new declaration must also have shareNodes set to true for that member.
    • Changing Behavior: If you set shareNodes: true in a declaration and later update that same declaration to shareNodes: false, the nodes are not moved; they remain in /Common. To change this behavior, you must DELETE the original declaration first, then re-POST the new declaration with shareNodes: false.
    • Manual Cleanup: Shared FQDN nodes must be deleted manually.
    // Example of a pool member with shareNodes enabled
"members": [
  {
    "address": "10.244.1.58",
    "shareNodes": true
  }
]

  8. Differentiate between polymorphic resource references and F5string properties

    main

    AS3 uses two distinct types of polymorphic properties:

    1. Resource Reference Polymorphism

    Used when choosing between a predefined resource, a declared resource, or an external BIG-IP resource.

    • When an object is used, it must have exactly one property: use (for AS3 pointers) or bigip (for external component pathnames).
    • When a string is used, it is either a predefined name or an AS3 pointer.

    2. F5string Polymorphism

    Used for properties representing distinct values rather than resource references. An F5string can be:

    • A standard string.
    • A Base64 encoded string (useful for binary data or avoiding JSON escaping issues).
    • A value retrieved from a URL at deployment time.
    • A BIG-IP AS3 pointer to a value elsewhere in the declaration.
    • A BIG-IP component pathname.

    Key Difference: When an F5string refers to a resource (via URL or pointer), the system copies the value before processing. This allows for context-dependent string expansion, whereas resource references point to the object itself.

  9. Note on AS3 3.20+ Template changes

    main

    In BIG-IP AS3 version 3.20 and later, the generic template is the default. This allows services to use any name.

    Breaking Changes for Older Declarations:

    • Many previous examples used a specific template and named virtual services serviceMain.
    • In 3.20+, these services should be renamed to service.
    • Declarations written for versions prior to 3.20 may fail on newer versions if a template is not explicitly specified.

  10. Important: Template requirements for BIG-IP AS3 versions prior to 3.20

    main
    In BIG-IP AS3 3.20 and later, the generic template is the default, allowing services to use any name. However, for versions prior to 3.20, many declarations will fail unless you explicitly specify a template. Additionally, in older versions, virtual services often used the name serviceMain, whereas newer versions (3.20+) use the name service.

  11. Share IP addresses between virtual servers using shareAddress

    main

    Use the shareAddress property in a BIG-IP AS3 Service class to share the same virtual IP address across multiple virtual servers. When shareAddress is set to true, AS3 creates virtual-address objects in the Common partition/tenant instead of the tenant specified in the declaration.

    Constraints:

    • Multiple virtual servers cannot share both the same IP address AND the same port.
    • shareAddress must be set to true for every service that uses the shared IP address.
    • If shareAddress is omitted or set to false, the virtual address is placed in the tenant/partition specified in the declaration.
    // Example snippet showing shareAddress usage
"service": {
    "serviceType": "http",
    "shareAddress": true,
    "address": "10.10.0.111",
    "port": 8080
}

  12. Understand the BIG-IP AS3 component hierarchy

    main

    BIG-IP AS3 uses a hierarchical model to describe Application Delivery Controller (ADC) configurations in a tenant- and application-oriented manner:

    1. Tenant: The top-level container. A tenant becomes a partition on the BIG-IP system and comprises a collection of applications and related resources. AS3 processes declarations on a tenant-by-tenant basis; changes to Tenant1 do not affect Tenant2.
    2. Application: Contained within a tenant, an application comprises a collection of ADC resources relating to a specific network-based business application or system.
    3. Resources: These include specific ADC configurations, resources shared by applications within a tenant, resources shared across all tenants, or auxiliary resources.

    This hierarchy allows you to manage configurations based on authority and business logic rather than individual device settings.