v2.4.1

gkebnkctl v2.4.1

Google Cloud GKE cloud-pinned CLI for deploying, operating, and benchmarking F5 BIG-IP Next for Kubernetes (BNK) and F5 BNK AI Service Plane.
(Tip: Use the unified multi-cloud bnkctl CLI as the preferred entry point across AWS, Azure, and GCP.)

Changelog

• 0400aef Merge branch 'main' into staging
• 67238f1 Merge branch 'main' into staging (resolve cspell.json)
• f7dd5b6 Merge origin/main into staging
• 38a1f5f chore(security): fix gosec G304 directive placement on os.ReadFile
• c59a04c chore(spell): add lookpath to dictionary
• 6c75e78 ci(release): fix govulncheck/lint gates and publish GHCR container packages
• 5468597 ci: add govulncheck-gate.sh and pin toolchain to align with peer bnkctl repos
• 968022f ci: ensure spellcheck workflow triggers on all PRs to satisfy branch protection
• 60ceabc feat(benchmark): benchmark engine, forge agent auth, and genai metrics parity (#60)
• 5d72615 feat(cli): add bnk resync, test traffic, and vertex demo hardening (#62)
• b99ac8d feat(cli): complete *bnkctl feature alignment and live GKE e2e verification (#54)
• 9b1323b feat(cli,ci,docs): add self update checksums, scenarios --all, and align CI/release/docs parity (#68)
• 4105402 feat(gcp): sync unified bnkctl 2.4.1 AI Gateway, Forge governance, and public-ready docs
• 02fd8d8 feat(self): support tar.gz/zip archive extraction and multi-fallback release download
• c4cdf0b feat: BNK 2.4 Gateway/GIE CRDs, JWKS rotation, VXLAN scenario namespaces & example parity
• 6b4d810 feat: Implement network resource ownership labeling via Description (#49)
• 3b0763d feat: align F5 BNK 2.4 namespaces and port status, logs, and topology CLI commands (#65)
• 38f751c feat: align documentation, install scripts, release pipeline, and GitHub metadata (#55)
• f02ca24 feat: backport P0/P1 cross-cloud parity fixes (BNK 2.4 CRDs, OCI FLO Helm SDK, in-process k8s, migrate/upgrade, aiperf, bnkscan, forge)
• 58677fe feat: dynamic ingress vxlan routing, 15 Gateway API scenarios, and BNK CLI parity
• 20d1649 fix(ci): format code and annotate gosec security rules for clean CI pass
• 2b5b295 fix(cli): include shared dataplane VPCs in down plan (GKE-07)
• bc29e3e fix(cli): qualify shared-VPC dry-run plan against other-tenants caveat (GKE-07)
• 278f2cd fix(down): match full Compute API network URLs in DiscoverDataplaneResources (#67)
• 3893048 fix(gcp): teardown shared dataplane resources if solely owned (GKE-05)
• 5f754bd fix(gke,forge,license,scenarios): wire Phase29 Forge lifecycle, fix CPCL license sync, and align BNK 2.4 CRDs/scenarios
• 46da6c2 fix(lint): resolve staticcheck unused symbols and ST1005 error capitalization
• 4505072 fix(parity): align FLO GatewayClass/CRDs/issuer, aiperf agentx-mvp, and self-update with awsbnkctl/azrbnkctl
• b1a2e28 fix(phases): add JWT preflight validation and License status visibility in TMMSettle
• db24f86 fix(self): guard decompression with max size limit and resolve security annotations
• 145d0e3 fix: apply P0/P1 runtime parity and scenario verification fixes
• 2983885 fix: untrack internal AI-tooling and add ignore stanza (GKE-01,02,03,04,18) (#48)

---

See CHANGELOG.md for the full per-version change log.

Verify the downloaded archive against checksums.txt:

sha256sum -c checksums.txt --ignore-missing

v1.0.1

Changelog

• db6d5cf feat(self): support tar.gz/zip archive extraction and multi-fallback release download (#59)

v1.0.0

Changelog

• 0c0cbdd Add cluster.yaml.example and README
• 7c41e1c Add config parsing + shell library (lib/)
• af10c2c Add manifest templates and static manifests (manifests/)
• ceb8e8b Add phase scripts (bin/)
• eb590cc Add reference recipe inputs (proven bnk-hostdev trial, 2026-07-20)
• dcadc4c Fix License CR to the live-proven schema
• 70bfbcb Redact secret material from reference/recon/flo-manifest.yaml
• cf808ad ci: local pre-push gate script + workflow manual-dispatch-only
• 446bb41 docs(adr): D-033 bidirectional dataplane ADR + ci-local phase51 assertion
• 8bcdbf9 docs(ci): CI workflow + ARCHITECTURE.md + README rewrite, fill test gaps (Task E)
• 53a195a feat(phases): BNK install phases 30-42 (Task C)
• 19d1d72 feat(phases): Phase51 ingress-vxlan-routes — fix ingress-to-egress-pod asymmetric routing
• 2f0d733 feat(phases): egress phase 50 — F5SPKEgress + route-setter + verification (Task D)
• 38bc39c feat(phases): make declared static routes authoritative (drift reconciliation)
• 7d5a282 feat(phases): real GCP infra phases 00/10/20/25 + down (Task B)
• b360b3f feat: add examples/host-device/cluster.yaml (bnk-hostdev trial values)
• 0d6c695 feat: gkebnkctl Go tracer scaffold — module, CLI, intent, state, netcalc
• 60bc0a2 fix(cneinstance): stop disabling envDiscovery/coreCollection (TMM crashagent)
• 63317ce fix(gcp/phases): address Task A+B review findings
• c78bf79 fix(intent): default kubernetesVersion to 1.35 (1.31 no longer exists)
• 16443cd fix(k8s): re-discover CRDs installed mid-run before REST mapping
• aa8ee17 fix(multus): point binDir at GKE's CNI path (/home/kubernetes/bin)
• c4a78e9 fix(phase10): resolve gRPC NotFound/PermissionDenied in hasHTTPStatus
• 84b1278 fix(phase25): resolve the real PCI BDF for virtio-net NICs
• d204dd1 fix(phase36): skip redacted Secrets in the vendored FLO manifest
• 6bf07bd fix(phase40): retry License apply through the ResourceQuota admission race
• 38e91ac fix(phase42): settle TMM to readiness and gate up on it
• ae64d2a fix(phases): wait for FLO-installed CRDs/Deployments where they can exist
• 88a11e3 fix(review): address 5 code-review findings in go-tracer
• 165b574 fix: migrate deprecated GKE SDK ID-based request fields (#45)
• fe9fcd6 release: sync staging to main (*bnkctl feature alignment, live GKE e2e verification, GKE-05/06/07 fixes) (#53)