This document discusses F5's automation toolchain for application services, including the AS3 declarative API. It provides an overview of tools like the App Services extension for deploying application services on BIG-IP using declarative REST APIs, the Declarative Onboarding extension for initial BIG-IP configuration, and templates for starting BIG-IP instances in public and private clouds. It also discusses the AS3 API for a single declarative endpoint to interface with common L4-L7 application services using a JSON document. Examples are provided of AS3 declarations for basic HTTP applications and firewall policies. Links are included to documentation, examples on GitHub, and resources for learning more.

4. ACCESS
CONTROL
DNSWAF
SECURITY
POLICIES
LOAD
BALANCING

5. AUTOMATION
TOOLKITS
PUBLIC
CLOUD
PROVIDERS
PRIVATE
CLOUD AND
OPEN-SOURCE
PLATFORMS
MICROSERVICES
IN CONTAINER
ENVIRONMENTS

7. It’s Important Because…
That’s 100% of people I speak to.

8. Imperative vs Declarative
F5 iControl REST (Imperative API)
Management & Ecosystem Solutions
Imperative – Tell the system HOW to do
something, and as a result WHAT you want
to happen
Declarative – Tell the system WHAT you
would like to happen, and let it figure out
HOW to do it

9. F5 AUTOMATION TOOLCHAIN
APP SERVICES 3
EXTENSION
Deploy Classic and Advanced
Application Services on
BIG-IP using Declarative
REST APIs
DECLARATIVE
ONBOARDING
EXTENSION
Initial Config of
BIG-IP
Instances
CLOUD
TEMPLATES
Start BIG-IP
Instances in
Public &
Private
Clouds
TELEMETRY STREAMING
EXTENSION
Stream Telemetry, Events &
Logs from BIG-IP to various
Analytics and Logging
solutions
API SERVICES GATEWAY
Container / VM platform for running F5 & Custom iControl LX Extensions

12. • Provides a single declarative REST API endpoint…
https://big-ip/mgmt/shared/appsvcs/declare
• Interface for common L4-7 app service use cases
• Atomic and idempotent
• Multi-tenant
• Accepts a single JSON document
• Omitted values assume defaults
• Guaranteed to be backward compatible
https://github.com/F5Networks/f5-appsvcs-extension
• Free & supported by F5

13. AS3 Everywhere – Consistent API
AS3
Q1 2019
On BIG-IP In Container On BIG-IQIn Cloud w/Service Discovery
BIG-IP SSG
BIG-IP
Platform
BIG-IP
Virtual Edition BIG-IP
Platform
BIG-IP
Virtual Edition
AS3
AS3
AS3 AS3

15. •
•
•
•
{
"class": "AS3",
"action": "deploy",
"persist": true,
"declaration": {
"class": "ADC",
"schemaVersion": "3.0.0",
"id": "example-declaration-01",
"label": "Sample 1",
"remark": "Simple HTTP application with round robin pool",
"updateMode": "selective",
"Sample_01": {
"class": "Tenant",
"defaultRouteDomain": 0,
"Application_1": {
"class": "Application",
"template": "http",
"serviceMain": {
"class": "Service_HTTP",
"virtualAddresses": [
"10.0.1.10"
],
"pool": "web_pool"
},
"web_pool": {
"class": "Pool",
"monitors": [
"http"
],
"members": [
{
"servicePort": 80,
"serverAddresses": [
"192.0.1.10",
"192.0.1.11"
]
}
]
}
}
}
}
}

16. •
•
{
"firewallPolicy": {
"class": "Firewall_Policy",
"remark": "A firewall policy",
"rules": [{
"use": "ruleList"
}]
},
"ruleList": {
"class": "Firewall_Rule_List",
"remark": "A firewall rule list",
"rules": [
{
"name": "rule",
"remark": "A firewall rule list rule",
"action": "drop",
"protocol": "tcp",
"source": {
"addressLists": [
{
"use": "addressList"
}
]
},
"loggingEnabled": true
},
"addressList":{
"class":"Firewall_Address_List",
"remark":"A firewall address list",
"addresses": [
"10.128.0.4",
{
"servicePort": 80,
"addressDiscovery": "aws",
"updateInterval": 10,
"tagKey": “application",
"tagValue": “prod",
"addressRealm": "private",
"region": "ap-southeast-2",
"accessKeyId": “XXXXX",
"secretAccessKey": “XXXXXX",
"credentialUpdate": false

17. ---
- name: Create VS
hosts: bigip
gather_facts: false
connection: local
tasks:
- name: URI POST Tenant
uri:
url: "https://{{ inventory_hostname }}/mgmt/shared/appsvcs/declare"
method: POST
user: "admin"
password: “XXXX"
validate_certs: no
body: {
*** AS3 DECLARATION ***
}
body_format: json

18. As a
developer I
can run at
speed and
use tags in
my pipeline.
As an architect
/ sre / ops
person I can
deploy once
and let the
devs run at
their own pace

20. https://clouddocs.f5.com

21. Scott’s examples:
https://github.com/codecowboydotio/ansible
https://github.com/codecowboydotio/ansible-AS3
https://github.com/codecowboydotio/ansible-AFM
Official F5 Networks Examples:
https://github.com/F5Networks/f5-ansible