422 - declaration failed

[Yacho1998]

Setup Details
FIC Version : 0.1.11
CIS Version : 2.18
FIC Build: f5networks/f5-ipam-controller:latest
CIS Build: f5networks/k8s-bigip-ctlr:latest
BIGIP Version: Big IP 17.1.1.3
AS3 Version: 3.51
Orchestration: K8S/OSCP
Orchestration Version: 1.28
Additional Setup details: cilium

Description

When updating the serviceAddress in TransportServer, a 422 error occurs, but there is no error when the configuration is first applied.

Steps To Reproduce

1)Here's my CIS config

        - --ipam=true
        - --custom-resource-mode=true
        - --bigip-username=$(BIGIP_USERNAME)
        - --bigip-password=$(BIGIP_PASSWORD)
        - --bigip-url=10.9.89.236:443
        - --bigip-partition=kubernetes
        - --pool-member-type=cluster
        - --insecure
        - --log-level=DEBUG

2)Here's my TransportServer config

apiVersion: cis.f5.com/v1
kind: TransportServer
metadata:
  annotations:
  labels:
    f5cr: "true"
  name: ts-nginx-test1
  namespace: kube-system
spec:
  bigipRouteDomain: 0
  ipamLabel: Default
  mode: standard
  pool:
    monitor:
      interval: 20
      timeout: 10
      type: tcp
    service: nginx-test1
    serviceNamespace: default
    servicePort: 80
  snat: auto
  type: tcp
  virtualServerPort: 8081

3)I want to enable VIP(virtual address) route advertisement, so I updated the TransportServer configuration as follows:

apiVersion: cis.f5.com/v1
kind: TransportServer
metadata:
  annotations:
  labels:
    f5cr: "true"
  name: ts-nginx-test1
  namespace: kube-system
spec:
  bigipRouteDomain: 0
  ipamLabel: Default
  mode: standard
  serviceAddress：
  - routeAdvertisement: enable
  pool:
    monitor:
      interval: 20
      timeout: 10
      type: tcp
    service: nginx-test1
    serviceNamespace: default
    servicePort: 80
  snat: auto
  type: tcp
  virtualServerPort: 8081

Expected Result

virtual address route advertisement enabled

Actual Result

Response from BIG-IP: code: 422 --- tenant:kubernetes --- message: declaration failed

Diagnostic Information

When checking the logs in /var/log/ltm on the VE, I saw an error indicating that the virtual address already exists.

Observations (if any)

/var/log/ltm:
Dec 1 22:21:16 f5-test.cloud.onecloud.io err mcpd[6098]: 0107176c:3: Invalid Virtual Address, the IP address 10.9.249.100 already exists.

[trinaths]

@Yacho1998 - Configure CIS with log-level AS3DEBUG and share the logs to automation_toolchain_pm automation_toolchain_pm@f5.com

[Yacho1998]

Thank you for your reply.I have sent the debug logs to the email.Below are some parts of the log:

2024/12/04 09:26:21 [DEBUG] [AS3] Posting failed tenants configuration in 30s seconds
2024/12/04 09:26:31 [DEBUG] [2024-12-04 09:26:31,084 main DEBUG] config handler woken for reset
2024/12/04 09:26:31 [DEBUG] [2024-12-04 09:26:31,084 main DEBUG] loaded configuration file successfully
2024/12/04 09:26:31 [DEBUG] [2024-12-04 09:26:31,084 main DEBUG] NET Config: {}
2024/12/04 09:26:31 [DEBUG] [2024-12-04 09:26:31,084 main DEBUG] loaded configuration file successfully
2024/12/04 09:26:31 [DEBUG] [2024-12-04 09:26:31,084 main DEBUG] updating tasks finished, took 0.0004801750183105469 seconds
2024/12/04 09:26:51 [DEBUG] [AS3] Unified declaration: {"$schema":"[https://raw.githubusercontent.com/F5Networks/f5-appsvcs-extension/main/schema/3.52.0/as3-schema-3.52.0-5.json","class":"AS3","declaration":{"class":"ADC","controls":{"class":"Controls","userAgent":"CIS/v2.18.1](https://raw.githubusercontent.com/F5Networks/f5-appsvcs-extension/main/schema/3.52.0/as3-schema-3.52.0-5.json%22,%22class%22:%22AS3%22,%22declaration%22:%7B%22class%22:%22ADC%22,%22controls%22:%7B%22class%22:%22Controls%22,%22userAgent%22:%22CIS/v2.18.1) K8S/v1.28.9"},"id":"urn:uuid:85626792-9ee7-46bb-8fc8-4ba708cfdc1d","kubernetes":{"Shared":{"class":"Application","crd_10_9_249_100_8089":{"class":"Service_TCP","pool":{"use":"/kubernetes/Shared/nginx_test1_80_kube_system"},"profileL4":"basic","snat":"auto","virtualAddresses":[{"use":"crd_service_address_10_9_249_100"}],"virtualPort":8089},"crd_10_9_249_101_9090":{"class":"Service_TCP","pool":{"use":"/kubernetes/Shared/donyhuang_test_8080_kube_system"},"profileL4":"basic","snat":"auto","virtualAddresses":[{"use":"crd_service_address_10_9_249_101"}],"virtualPort":9090},"crd_service_address_10_9_249_100":{"arpEnabled":false,"class":"Service_Address","routeAdvertisement":"enable","spanningEnabled":false,"virtualAddress":"10.9.249.100"},"crd_service_address_10_9_249_101":{"arpEnabled":false,"class":"Service_Address","routeAdvertisement":"enable","spanningEnabled":false,"virtualAddress":"10.9.249.101"},"donyhuang_test_8080_kube_system":{"class":"Pool","members":[{"addressDiscovery":"static","serverAddresses":["10.9.250.220"],"servicePort":8080}],"minimumMonitors":1,"monitors":[{"use":"/kubernetes/Shared/donyhuang_test_kube_system_tcp_8080"}]},"donyhuang_test_kube_system_tcp_8080":{"adaptive":false,"class":"Monitor","interval":20,"monitorType":"tcp","receive":"","send":"","targetAddress":"","timeout":10},"nginx_test1_80_kube_system":{"class":"Pool","members":[{"addressDiscovery":"static","serverAddresses":["10.9.250.218"],"servicePort":80}],"minimumMonitors":1,"monitors":[{"use":"/kubernetes/Shared/nginx_test1_kube_system_tcp_80"}]},"nginx_test1_kube_system_tcp_80":{"adaptive":false,"class":"Monitor","interval":5,"monitorType":"tcp","receive":"","send":"","targetAddress":"","timeout":16},"template":"shared"},"class":"Tenant","defaultRouteDomain":0,"label":"kubernetes"},"label":"CIS Declaration","remark":"Auto-generated by CIS","schemaVersion":"3.52.0"}}
2024/12/04 09:26:51 [DEBUG] [AS3] posting request to [https://10.9.89.236:443/mgmt/shared/appsvcs/declare/kubernetes](https://10.9.89.236/mgmt/shared/appsvcs/declare/kubernetes)
2024/12/04 09:26:51 [INFO] [Retry][AS3] posting request to [https://10.9.89.236:443](https://10.9.89.236/) for kubernetes tenants
2024/12/04 09:26:56 [INFO] [Retry][AS3] post resulted in FAILURE
2024/12/04 09:26:56 [ERROR] [Retry][AS3] Response from BIG-IP: code: 422 --- tenant:kubernetes --- message: declaration failed
2024/12/04 09:26:56 [DEBUG] [AS3] Raw response from Big-IP: map[code:422 declaration:map[class:ADC controls:map[archiveTimestamp:2024-12-04T09:24:05.908Z class:Controls userAgent:CIS/v2.18.1 K8S/v1.28.9] id:urn:uuid:85626792-9ee7-46bb-8fc8-4ba708cfdc1d kubernetes:map[Shared:map[class:Application crd_10_9_249_100_8089:map[class:Service_TCP pool:map[use:/kubernetes/Shared/nginx_test1_80_kube_system] profileL4:basic snat:auto virtualAddresses:[map[use:crd_service_address_10_9_249_100]] virtualPort:8089] crd_10_9_249_101_9090:map[class:Service_TCP pool:map[use:/kubernetes/Shared/donyhuang_test_8080_kube_system] profileL4:basic snat:auto virtualAddresses:[10.9.249.101] virtualPort:9090] crd_service_address_10_9_249_100:map[arpEnabled:false class:Service_Address routeAdvertisement:enable spanningEnabled:false virtualAddress:10.9.249.100] donyhuang_test_8080_kube_system:map[class:Pool members:[map[addressDiscovery:static serverAddresses:[10.9.250.220] servicePort:8080]] minimumMonitors:1 monitors:[map[use:/kubernetes/Shared/donyhuang_test_kube_system_tcp_8080]]] donyhuang_test_kube_system_tcp_8080:map[adaptive:false class:Monitor interval:20 monitorType:tcp receive: send: targetAddress: timeout:10] nginx_test1_80_kube_system:map[class:Pool members:[map[addressDiscovery:static serverAddresses:[10.9.250.218] servicePort:80]] minimumMonitors:1 monitors:[map[use:/kubernetes/Shared/nginx_test1_kube_system_tcp_80]]] nginx_test1_kube_system_tcp_80:map[adaptive:false class:Monitor interval:5 monitorType:tcp receive: send: targetAddress: timeout:16] template:shared] class:Tenant defaultRouteDomain:0 label:kubernetes] label:CIS Declaration remark:Auto-generated by CIS schemaVersion:3.52.0 updateMode:selective] results:[map[code:422 declarationId:urn:uuid:85626792-9ee7-46bb-8fc8-4ba708cfdc1d host:localhost message:declaration failed response:0107176c:3: Invalid Virtual Address, the IP address 10.9.249.101 already exists. runTime:1273 tenant:kubernetes]]]