20 Automation and APIs
More and more F5 jobs ask for automation: deploying applications from code, keeping configuration in Git, and integrating BIG-IP with CI/CD pipelines. This note explains the F5 automation toolchain and the key idea interviewers look for: imperative vs declarative.
Contenido complementario
Not covered in my courses. Commands and examples are in Automatización y API (F5).
Pendiente: validar en el lab
Este contenido no salió de mis clases. Probar estos comandos y pasos en BIG-IP VE antes de usarlos en un trabajo real, y corregir lo que difiera en mi versión.
Imperative vs declarative
- Imperative — you send a sequence of commands describing how to get there (tmsh, individual iControl REST calls, the GUI). Order matters; running it twice can fail or duplicate objects.
- Declarative — you describe the desired end state and the tool works out the changes (AS3, DO). Idempotent, easy to store in Git, review and roll back.
The F5 toolchain
| Tool | What it is |
|---|---|
| iControl REST | BIG-IP’s REST API: https://<mgmt>/mgmt/tm/.... Anything you can do in tmsh can be done through the API. Authentication with basic auth or a token (X-F5-Auth-Token) |
| AS3 — Application Services 3 | Declarative JSON describing whole applications (VS, pools, monitors, profiles). Each tenant becomes its own partition. Endpoint /mgmt/shared/appsvcs/declare |
| DO — Declarative Onboarding | JSON for initial setup: hostname, DNS, NTP, VLANs, self IPs, HA, licensing |
| TS — Telemetry Streaming | Sends statistics and logs to Splunk, Elastic, Azure, etc. |
| FAST — F5 Application Services Templates | Templates on top of AS3; the replacement for iApps |
| Ansible | Collections f5networks.f5_modules (imperative modules) and f5networks.f5_bigip (declarative/AS3) |
| Terraform | F5Networks/bigip provider — infrastructure as code, usually with AS3 |
| Python | requests against iControl REST, or libraries such as bigrest |
- AS3, DO and TS are installed as RPM packages (iApps → Package Management LX).
- Objects created by AS3 must be changed only through AS3, like iApp objects — manual edits get overwritten.
iApps (legacy templates)
- Templates that create all the objects of an application. Objects created by an iApp show the iApp name in the Application column (e.g. “Exchange”).
- Change them only by reconfiguring the iApp, never directly on the object.
- iApps are deprecated → replaced by AS3/FAST.
Typical automation use cases
- Self-service app deployment from a pipeline (AS3 declaration per application).
- Draining and enabling pool members during server patching (Ansible).
- Certificate renewal at scale.
- Backups (UCS) and compliance checks on a schedule.
- Kubernetes integration with Container Ingress Services.
Self-check
Q1 — What's the difference between imperative and declarative automation?
Respuesta
Imperative sends step-by-step commands; declarative describes the desired end state and the tool computes the changes (idempotent).
Q2 — Which F5 tool describes a whole application in JSON?
Respuesta
AS3.
Q3 — Which tool handles initial onboarding (hostname, VLANs, self IPs, HA)?
Respuesta
DO (Declarative Onboarding).
Q4 — Should you edit objects created by AS3 or an iApp directly?
Respuesta
No. Change them through AS3 / the iApp, or your edits are overwritten.
Q5 — Are iApps still the recommended way to template applications?
Respuesta
No. They’re deprecated; use AS3/FAST.