Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

iRules Change Management

I have several irules running on a single box. Each irules consist of nearly 500 line of code.

The development process of this irules was so rapidly changing, considering that our customer needs change the logic of irules until become stable and acceptable.

The problem is, sometimes we don't know which part have been changed and which part haven't. Can we get the information when a user/admin/engineer do a change to our irules, and which part of the irules they have change? Maybe it's like implementation of subversion in big-ip.

any idea would highly appreciated.

thanks!

0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

I personally do not think this has to be handled on the F5 itself. If you consider each iRule as a configuration file, you can manage each one like you would manage a system configuration file. We started using Git to manage our iRules, right now it's a manual process, but the F5 has APIs which will be used to implement automated processes. We started by adding headers to each file, so that people know not to modify the iRules directly on the box. Here's what we put at the beginning of each iRule:

# Managed by Git (git@your.git.machine/gitpath/conf.git)
# Version: $Id$
# $Format:Git ID: (%h) %ci/%cn$

And then you can add this to your .attributes file:

# Manage the Identity substitution
*.txt    ident
*_stash  ident

# Substitute information on export
*.txt    export-subst
*_stash  export-subst

We then use git archive to export the files, which will replace the variables with some information. I realize this solution is not perfect, we are in the early rounds.

The biggest challenge becomes the human factor, no iRules should be modified directly on the F5. BTW, the $Id$ variable can be used to verify that nobody touched the file.

Regards, Didier

5
Comments on this Answer
Comment made 07-Sep-2013 by Jason Rahm
interesting concept. If you tied this into an iApp to manage all the iRules, then the rules themselves couldn't be changed directly.
0
Comment made 08-Sep-2013 by Hamish 3249
I like it... Do you automate it as well so when a new version is checked into the git repository, the LTM's all get updated? H
0
Comment made 09-Sep-2013 by Didier Fort 71
OK, I need to look at iApps. No, it's not automated yet, we are in the early stages. BTW, I personally think that adding $Id$ and other variables is a temporary step. Once the iRule are automatically pushed either via iApp or other means, these variables won't be necessary.
0
Comment made 07-Jan-2015 by Saverio 3
Hello, I wrote some git hooks, so that you can manage iRules in git, and when you push to a remote repository the changes are pushed directly to the BIGIP device. you can find the code here: https://github.com/zioproto/f5-git-hooks if you make this code better please send me pull requests on github
1
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

We started using Git to manage our iRules, right now it's a manual process, but the F5 has APIs which will be used to implement automated processes. We started by adding headers to each file, so that people know not to modify the iRules directly on the box.

seems interesting didier!

thanks for the idea anyway.

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

iApps + tmsh::expand_macro (added in 11.4 - needs some documentation here on devcentral) provide a nice way to make sure iRules are not modified in place. The strictness of iApps protects the iRules from user error (note that strictness can be turned off but not without some intentional button pressing) and the templating can provide an escape-free 'string map'-free iRule editing environment plus variable substitution, complex macro conditionals, and fantastic debugging.

I would be interested in building an iRule/iApp/iControl/iCall development VM someday around the idea of simplifying this.

Personally I have solved this problem many times in the past primarily with svn/vim/.vimrc/ssh/scp and tmsh load sys config merge file </var/tmp/well-known-name> plus a script that I put on the dev F5 BIG-IP box called rerun-iapp. It's nice because you can run it with ssh and a key and with the '-d' flag it puts the lines of scriptd.out out to your terminal. Plus you can create several ASO instances of the template and it will rerun the template for all ASOs - allowing you to do potentially lots of testing quite quickly

0
Comments on this Answer
Comment made 10-Sep-2013 by Michael Earnhart 2
I have the rerun-iapp script and will post it to the code share world. Tried to do so here and it was not pretty
0