Automation, APIs, and integration
Domain 4 tests declarative and API-driven operations: how to authenticate, how iControl REST and tmsh map to each other, and how AS3, Declarative Onboarding and Telemetry Streaming fit together.
Access methods
- iControl REST lives under /mgmt. Authenticate with POST /mgmt/shared/authn/login (username, password, loginProviderName) and send the returned token in the X-F5-Auth-Token header; tokens expire, so scripts must refresh them.
- REST paths mirror tmsh: /mgmt/tm/ltm/virtual corresponds to tmsh list ltm virtual. Anything you can configure in tmsh has a REST representation.
- iRules are TCL executed per connection inside TMM; iControl LX extensions run as node.js workers on the control plane and expose custom endpoints. They solve different problems.
Declarative tooling
- AS3 posts a JSON declaration to /mgmt/shared/appsvcs/declare describing tenants and application services (class ADC, Service_HTTPS, Pool, TLS_Server). It is idempotent and stateful: the declaration is the desired state for that tenant.
- Declarative Onboarding (/mgmt/shared/declarative-onboarding) handles base configuration such as licensing, VLANs, self IPs, DNS, NTP and clustering. AS3 does not create network objects.
- Telemetry Streaming (/mgmt/shared/telemetry) pushes statistics and events to consumers; Ansible, Terraform and CI pipelines typically wrap these endpoints.
Worked example
A pipeline POSTs an AS3 declaration for tenant web containing one Service_HTTPS and its pool. On a second run the same declaration is posted again: nothing changes, because AS3 converges to the declared state. If a virtual server in tenant web is removed from the declaration, AS3 deletes it on the next POST. Objects in tenant api are untouched, because the declaration only owns the tenants it names.
Traps that cost marks
- Omitting an object from a tenant declaration and being surprised when it is deleted.
- Calling /declare with the wrong Content-Type or with an expired token.
- Expecting AS3 to build VLANs and self IPs, which is DO's job.
- Treating iRules as a control-plane automation tool.