CIS added irules cannot have "event disable all"

[alonsocamaro]

Setup Details

CIS Version : 2.16.0
Build: f5networks/k8s-bigip-ctlr:latest
AS3 Version: NA
Agent Mode: AS3

Description

Using the ab_deployment_path_irule (in my case multi-cluster) calls event disable all, this creates the following TCP reset connection when adding a oneconnect profile

Apr  9 06:22:33 bigip2.ocp.f5-udf.com info tmm[10372]: Rule /mc-onetier/Shared/mysite_com_80_ab_deployment_path_irule <HTTP_REQUEST>: pre: 41464
Apr  9 06:22:33 bigip2.ocp.f5-udf.com info tmm[10372]: Rule /mc-onetier/Shared/mysite_com_80_ab_deployment_path_irule <HTTP_REQUEST>: select_ab_pool: 41464 route_a_ocp2_8080_mc_onetier
Apr  9 06:22:33 bigip2.ocp.f5-udf.com info tmm[10372]: Rule /mc-onetier/Shared/mysite_com_80_ab_deployment_path_irule <LB_SELECTED>: 41464 /mc-onetier/Shared/route_a_ocp2_8080_mc_onetier 10.129.0.236 8080
Apr  9 06:22:33 bigip2.ocp.f5-udf.com info tmm[10372]: Rule /mc-onetier/Shared/mysite_com_80_ab_deployment_path_irule <LB_FAILED>: 41464 10.1.10.104 80
Apr  9 06:22:33 bigip2.ocp.f5-udf.com err tmm[10372]: 01230140:3: RST sent from 10.1.10.104:80 to 10.1.10.4:41464, [0x3056f2c:5263] No server selected

Please note that using a oneconnect profile is mandatory In BIG-IP in order to do per request HTTP routing decisions on keep-alive connections.

The "event disable" code should be eliminated:

• When not using oneconnect, the "event disable" code doesn´t provide any advantage
• When using oneconnect, the "event disable"· code disables the oneconnect feature and in fact it frequently triggers the TCP reset as shown above.

At present CIS doesn´t automatically add a default oneconnect profile and it should for any HTTP based configuration, otherwise it cannot appropriately do per-request routing on keep-alive connections.

Please consider applying a default oneconnect in upcoming CIS versions. This should have the following configuration as follows:

ltm profile one-connect oneconnect-32 {
    app-service none
    defaults-from oneconnect
    source-mask 255.255.255.255
}

Otherwise HTTP routing decisions cannot be done when using keep-alive.

See the section "content switching" in https://my.f5.com/manage/s/article/K7208 for more details

Expected Result

• Please eliminate "event disable all" in next patch release
• Please consider adding oneconnect profile configuration by default in upcoming major releases

[alonsocamaro]

So in short, oneconnect provides simultaneously:

• per request processing (content switching)
• connection pooling

and these cannot be independently enabled. Per request processing is required by modern apps IMHO.

[trinaths]

Created [CONTCNTR-4682] for internal tracking.

[trinaths]

Fixed in 2.17. ETA early June'24