Last Modified: Jul 15, 2026
Affected Product(s):
BIG_IP_NEXT(BNK) BNK
Known Affected Versions:
2.1.0, 2.1.1
Fixed In:
2.2.1
Opened: Jan 05, 2026 Severity: 3-Major
A namespace that previously hosted one or more applications with ingress handled by BNK, but no longer does, would still have the egress path for applications in that namespace configured to route through TMM.
This behavior may cause unexpected routing behaviors and residual namespace associations even after the Gateway CRs are cleared.
When creating a Gateway Custom Resource (CR), the f5-cne-controller properly annotates the f5-tmm pod with the namespace in "k8s.ovn.org/routing-namespaces" to enable controlled cross-namespace traffic over the Kubernetes OVN network. However, when the Gateway CR is deleted, the "k8s.ovn.org/routing-namespaces" annotation is not removed from the f5-tmm pod.
Restart the CNE controller pod after deleting Gateway CR.
CNE Controller keeps track of all the namespaces in which Gateway API CRs are deployed and also the namespaces that are referred by Gateway API CRs. Based on that tracked list of namespaces, it updates the "k8s.ovn.org/routing-namespaces" annotations on TMM pods. When a namespace is no longer used by any Gateway API CRs, that namespace gets removed from the annotation.