JLCode-tech · bonnyr-f5 · Apr 29, 2026
diff --git a/bnk/bnk-gatewayclass/module.json b/bnk/bnk-gatewayclass/module.json
@@ -38,7 +38,7 @@
         "source": "module",
         "from_module": "bnk/flo",
         "from_output": "flo_namespace",
-        "default": "f5-operator"
+        "default": "f5-cne-core"
       },
       {
         "name": "instance_ready",

diff --git a/bnk/bnk-vlans/module.json b/bnk/bnk-vlans/module.json
@@ -35,11 +35,11 @@
       {
         "name": "namespace",
         "type": "string",
-        "description": "Namespace where BNK components are deployed",
-        "default": "f5-operator",
+        "description": "Namespace where BNK instance components are deployed",
+        "default": "f5-bnk",
         "source": "module",
         "from_module": "k8s/bnk-prerequisites",
-        "from_output": "operator_namespace"
+        "from_output": "cne_instance_namespace"
       },
       {
         "name": "external_subnet_cidrs",

diff --git a/bnk/bnk-vlans/variables.tf b/bnk/bnk-vlans/variables.tf
@@ -25,7 +25,7 @@ variable "cluster_name" {
 variable "namespace" {
   description = "Namespace for VLAN CRs (must match CNEInstance namespace)"
   type        = string
-  default     = "f5-operator"
+  default     = "f5-bnk"
 }
 
 # =============================================================================

diff --git a/bnk/cneinstance/main.tf b/bnk/cneinstance/main.tf
@@ -68,12 +68,12 @@ locals {
   multus_networks_annotation = local.is_kernel_mode ? jsonencode([
     {
       name      = var.external_nad_name
-      namespace = var.instance_namespace
+      namespace = var.namespace
       interface = "eth1"
     },
     {
       name      = var.internal_nad_name
-      namespace = var.instance_namespace
+      namespace = var.namespace
       interface = "eth2"
     }
   ]) : ""
@@ -135,7 +135,7 @@ locals {
     kind       = "CNEInstance"
     metadata = {
       name      = var.instance_name
-      namespace = var.instance_namespace
+      namespace = var.namespace
       labels = {
         "app.kubernetes.io/name"       = var.instance_name
         "app.kubernetes.io/component"  = "cne-instance"
@@ -263,7 +263,7 @@ locals {
     kind       = "ConfigMap"
     metadata = {
       name      = "tmm-init"
-      namespace = var.instance_namespace
+      namespace = var.namespace
       labels = {
         "app.kubernetes.io/name"       = "tmm-init"
         "app.kubernetes.io/component"  = "tmm-config"
@@ -297,7 +297,7 @@ resource "null_resource" "tmm_init_apply" {
 
   triggers = {
     cm_hash    = sha256(yamlencode(local.tmm_init_configmap))
-    namespace  = var.instance_namespace
+    namespace  = var.namespace
     kubeconfig = local_file.kubeconfig.filename
     name       = "tmm-init"
   }
@@ -336,7 +336,7 @@ resource "null_resource" "cloud_network_mapping" {
 
   triggers = {
     mappings_hash = sha256(jsonencode(var.cloud_az_subnet_mappings))
-    namespace     = var.instance_namespace
+    namespace     = var.namespace
     kubeconfig    = local_file.kubeconfig.filename
   }
 
@@ -348,7 +348,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: cloud-network-mapping
-  namespace: ${var.instance_namespace}
+  namespace: ${var.namespace}
 data:
   config.yaml: |
     availability_zones:
@@ -393,7 +393,7 @@ resource "null_resource" "cneinstance" {
   triggers = {
     manifest_hash = sha256(yamlencode(local.cneinstance_manifest))
     name          = var.instance_name
-    namespace     = var.instance_namespace
+    namespace     = var.namespace
     kubeconfig    = local_file.kubeconfig.filename
     # Run every apply — if the CNEInstance CR is deleted out-of-band (cluster
     # disruption, manual cleanup, bnk_cleanup destroy), manifest_hash won't
@@ -465,11 +465,11 @@ resource "null_resource" "wait_for_available" {
       while [ $ELAPSED -lt $TIMEOUT ]; do
         # Get the Available condition
         STATUS=$(${local.kubectl} get cneinstance ${var.instance_name} \
-          -n ${var.instance_namespace} \
+          -n ${var.namespace} \
           -o jsonpath='{.status.conditions[?(@.type=="Available")].status}' 2>/dev/null)
 
         REASON=$(${local.kubectl} get cneinstance ${var.instance_name} \
-          -n ${var.instance_namespace} \
+          -n ${var.namespace} \
           -o jsonpath='{.status.conditions[?(@.type=="Available")].reason}' 2>/dev/null)
 
         if [ "$STATUS" = "True" ]; then
@@ -486,10 +486,10 @@ resource "null_resource" "wait_for_available" {
         echo ""
         echo "WARNING: CNEInstance not yet Available after $${TIMEOUT}s"
         echo "This may be normal for first deployment. Check FLO logs:"
-        echo "  kubectl logs -n ${var.instance_namespace} -l app=flo --tail=50"
+        echo "  kubectl logs -n ${var.namespace} -l app=flo --tail=50"
         echo ""
         echo "Current CNEInstance status:"
-        ${local.kubectl} get cneinstance ${var.instance_name} -n ${var.instance_namespace} -o yaml 2>/dev/null | grep -A5 "conditions:" || true
+        ${local.kubectl} get cneinstance ${var.instance_name} -n ${var.namespace} -o yaml 2>/dev/null | grep -A5 "conditions:" || true
         # Don't fail — the instance may still be deploying
       fi
     EOT
@@ -510,19 +510,19 @@ resource "null_resource" "verify_pods" {
       KUBECTL="${local.kubectl}"
 
       echo ""
-      echo "--- Pods in ${var.instance_namespace} ---"
-      $KUBECTL get pods -n ${var.instance_namespace} -o wide 2>/dev/null
+      echo "--- Pods in ${var.namespace} ---"
+      $KUBECTL get pods -n ${var.namespace} -o wide 2>/dev/null
 
       echo ""
       echo "--- CNEInstance Status ---"
-      $KUBECTL get cneinstance ${var.instance_name} -n ${var.instance_namespace} 2>/dev/null
+      $KUBECTL get cneinstance ${var.instance_name} -n ${var.namespace} 2>/dev/null
 
       echo ""
       echo "--- Component Summary ---"
       # Count running pods
-      TOTAL=$($KUBECTL get pods -n ${var.instance_namespace} --no-headers 2>/dev/null | wc -l)
-      RUNNING=$($KUBECTL get pods -n ${var.instance_namespace} --no-headers 2>/dev/null | grep -c "Running" || true)
-      COMPLETED=$($KUBECTL get pods -n ${var.instance_namespace} --no-headers 2>/dev/null | grep -c "Completed" || true)
+      TOTAL=$($KUBECTL get pods -n ${var.namespace} --no-headers 2>/dev/null | wc -l)
+      RUNNING=$($KUBECTL get pods -n ${var.namespace} --no-headers 2>/dev/null | grep -c "Running" || true)
+      COMPLETED=$($KUBECTL get pods -n ${var.namespace} --no-headers 2>/dev/null | grep -c "Completed" || true)
 
       echo "Total pods: $TOTAL"
       echo "Running: $RUNNING"
@@ -532,7 +532,7 @@ resource "null_resource" "verify_pods" {
       echo ""
       echo "--- Key Components ---"
       for component in flo cne-controller tmm cwc dssm observer otel rabbit fluentd; do
-        COUNT=$($KUBECTL get pods -n ${var.instance_namespace} --no-headers 2>/dev/null | grep -c "$component" || true)
+        COUNT=$($KUBECTL get pods -n ${var.namespace} --no-headers 2>/dev/null | grep -c "$component" || true)
         if [ "$COUNT" -gt 0 ]; then
           echo "  OK: $component ($COUNT pods)"
         else

diff --git a/bnk/cneinstance/module.json b/bnk/cneinstance/module.json
@@ -40,13 +40,13 @@
   "inputs": {
     "required": [
       {
-        "name": "instance_namespace",
+        "name": "namespace",
         "type": "string",
-        "description": "Namespace for CNEInstance",
+        "description": "Namespace for CNEInstance and workloads",
         "source": "module",
-        "from_module": "bnk/flo",
-        "from_output": "flo_namespace",
-        "default": "f5-operator"
+        "from_module": "k8s/bnk-prerequisites",
+        "from_output": "cne_instance_namespace",
+        "default": "f5-bnk"
       },
       {
         "name": "manifest_version",
@@ -161,7 +161,7 @@
         "sensitive": false
       },
       {
-        "name": "instance_namespace",
+        "name": "namespace",
         "type": "string",
         "description": "Namespace of the CNEInstance",
         "used_by": ["bnk/bnk-gatewayclass"],

diff --git a/bnk/cneinstance/outputs.tf b/bnk/cneinstance/outputs.tf
@@ -5,9 +5,9 @@ output "instance_name" {
   value       = var.instance_name
 }
 
-output "instance_namespace" {
+output "namespace" {
   description = "Namespace of the CNEInstance"
-  value       = var.instance_namespace
+  value       = var.namespace
 }
 
 output "instance_ready" {

diff --git a/bnk/cneinstance/variables.tf b/bnk/cneinstance/variables.tf
@@ -33,10 +33,10 @@ variable "instance_name" {
   }
 }
 
-variable "instance_namespace" {
-  description = "Namespace for CNEInstance (wired from flo.flo_namespace)"
+variable "namespace" {
+  description = "Namespace for CNEInstance and workloads (wired from bnk-prerequisites.cne_instance_namespace)"
   type        = string
-  default     = "f5-operator"
+  default     = "f5-bnk"
 }
 
 # =============================================================================

diff --git a/bnk/flo/module.json b/bnk/flo/module.json
@@ -41,8 +41,8 @@
         "description": "Namespace for FLO deployment",
         "source": "module",
         "from_module": "k8s/bnk-prerequisites",
-        "from_output": "operator_namespace",
-        "default": "f5-operator"
+        "from_output": "cne_core_namespace",
+        "default": "f5-cne-core"
       },
       {
         "name": "flo_version",

diff --git a/k8s/bnk-prerequisites/README.md b/k8s/bnk-prerequisites/README.md
@@ -6,15 +6,22 @@ The first module in the BNK stack. Creates required namespaces, distributes FAR
 
 ## What It Does
 
-1. **Creates namespaces**: `f5-operator` (BNK components), `f5-utils` (IPAM), `gateway-ns` (Gateway resources)
-2. **Creates FAR secrets**: Image pull secrets in all namespaces for `repo.f5.com` access
+1. **Creates namespaces**: `f5-cne-core` (FLO, CWC, IPAM, Observer, OTEL) and `f5-bnk` (CNEInstance workloads — TMM, controller, VLANs, NADs)
+2. **Creates FAR secrets**: Image pull secrets in both namespaces for `repo.f5.com` access
 3. **Downloads BNK manifest**: From F5 Artifact Registry using the service account key
 4. **Parses versions**: Extracts FLO Helm chart version and component versions from manifest
 5. **Destroy cleanup**: Strips F5 finalizers and webhooks to prevent stuck resources
 
+### Namespace Model (F5 BNK 2.2)
+
+Per F5 BNK 2.2 documentation, the two-namespace model is:
+
+- **`f5-cne-core`**: FLO operator and CNE core components (CWC, IPAM, RabbitMQ, Observer, OTEL)
+- **`f5-bnk`** (configurable): CNEInstance workloads (TMM, CNE controller, VLANs, NADs)
+
 ## Dependencies
 
-- **EKS Cluster**: Running Kubernetes cluster with valid credentials
+- **Kubernetes Cluster**: Running cluster with valid credentials
 - No other BNK modules — this is the entry point
 
 ## Usage
@@ -27,12 +34,11 @@ module "bnk_prerequisites" {
   cne_pull_secret = var.cne_pull_secret  # base64-encoded JSON
 
   # BNK manifest version
-  bnk_manifest_version = "2.2.0-3.2226.0-0.0.385"
+  bnk_manifest_version = "2.2.1-3.2226.0-0.0.511"
 
-  # Namespace configuration (defaults are standard)
-  operator_namespace = "f5-operator"
-  utils_namespace    = "f5-utils"
-  gateway_namespace  = "gateway-ns"
+  # Namespace configuration (defaults match F5 BNK 2.2 docs)
+  cne_core_namespace     = "f5-cne-core"
+  cne_instance_namespace = "f5-bnk"
 
   # Cluster (auto-wired)
   cluster_name = module.eks.cluster_name
@@ -44,19 +50,17 @@ module "bnk_prerequisites" {
 | Name | Description | Type | Required | Default |
 |------|-------------|------|----------|---------|
 | cne_pull_secret | Base64-encoded F5 FAR service account key | string (sensitive) | yes | - |
-| bnk_manifest_version | BNK manifest version to download | string | no | "2.2.0-3.2226.0-0.0.385" |
-| operator_namespace | Namespace for FLO + BNK components | string | no | "f5-operator" |
-| utils_namespace | Namespace for utility components | string | no | "f5-utils" |
-| gateway_namespace | Namespace for Gateway API resources | string | no | "gateway-ns" |
+| bnk_manifest_version | BNK manifest version to download | string | no | "2.2.1-3.2226.0-0.0.511" |
+| cne_core_namespace | Namespace for FLO + CNE core components | string | no | "f5-cne-core" |
+| cne_instance_namespace | Namespace for CNEInstance workloads | string | no | "f5-bnk" |
 | cluster_name | Kubernetes cluster name | string | no | "" |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| operator_namespace | Operator namespace name |
-| utils_namespace | Utils namespace name |
-| gateway_namespace | Gateway namespace name |
+| cne_core_namespace | CNE core namespace name |
+| cne_instance_namespace | CNE instance namespace name |
 | far_secret_name | FAR image pull secret name (always "far-secret") |
 | flo_version | FLO Helm chart version (parsed from manifest) |
 | manifest_version | BNK manifest version used |
@@ -68,12 +72,11 @@ module "bnk_prerequisites" {
 
 ```bash
 # Check namespaces
-kubectl get ns | grep -E "f5-operator|f5-utils|gateway-ns"
+kubectl get ns | grep -E "f5-cne-core|f5-bnk"
 
-# Check FAR secrets exist in all namespaces
-kubectl get secret far-secret -n f5-operator
-kubectl get secret far-secret -n f5-utils
-kubectl get secret far-secret -n gateway-ns
+# Check FAR secrets exist in both namespaces
+kubectl get secret far-secret -n f5-cne-core
+kubectl get secret far-secret -n f5-bnk
 ```
 
 ## References
@@ -85,4 +88,4 @@ kubectl get secret far-secret -n gateway-ns
 - **Category**: k8s
 - **Workflow Compatibility**: Greenfield, Partial
 - **Version**: 2.2.0
-- **Last Updated**: 2026-03-04
+- **Last Updated**: 2026-04-29