Virtual server requires a profile of type http or http-connect for ltm policy

[kingb33]

Environment

• Application Services Version: 3.52.0
• BIG-IP Version: BIG-IP 16.1.4.3 Build 0.16.3 Engineering Hotfix

Summary

When Building a Virtual server that has an LTM policy, it is required that the VS has an HTTP or HTTP-CONNECT profile even when it is not a requirement. My existing VS is configured fior SSL Passthrough. I cannot apply an HTTP profile or it will break my VS.

Based on existing configuration that was completed via the GUI, I know that my Virtual Server can apply a LTM Policy that is looking for details at the "client-accepted" stage of the request.

Steps To Reproduce

Steps to reproduce the behavior:

1. Submit the following declaration:

{
  "class": "AS3",
  "action": "deploy",
  "persist": true,
  "declaration": {
    "class": "ADC",
    "schemaVersion": "3.52.0",
    "id": "id",
    "label": "WebApp",
    "OPENSHIFT": {
      "class": "Tenant",
      "Shared": {
        "class": "Application",
        "template":"shared"
      }, 
      "PREPROD": {
        "class": "Application",
        "api-int.ocpq1_vs": {
          "class": "Service_TCP", 
          "label": "****", 
          "persistenceMethods": [], 
          "policyEndpoint": "api-int.ocpq1_Policy", 
          "pool": "api-int.ocpq1_http_pool", 
          "profileTCP": {"egress": {"bigip": "/Common/f5-tcp-lan"}, "ingress": {"bigip": "/Common/f5-tcp-wan"}}, 
          "remark": "***", 
          "snat": "auto", 
          "virtualAddresses": ["***"], 
          "virtualPort": ****
        },  
        "api-int.ocpq1_http_pool": {
          "class": "Pool", 
          "label": "Pool for api-int.ocpq1_vs", 
          "members": [{"hostname": "***", "servicePort": ***, "addressDiscovery": "fqdn", "autoPopulate": true}, {"hostname": "***", "servicePort": ****, "addressDiscovery": "fqdn", "autoPopulate": true}, {"hostname": "***", "servicePort": ****, "addressDiscovery": "fqdn", "autoPopulate": true}, {"hostname": "***", "servicePort": ***, "addressDiscovery": "fqdn", "autoPopulate": true}], 
          "monitors": [{"bigip": "/Common/tcp_half_open"}], 
          "remark": "Pool for api-int.ocpq1_vs"
        },
        "api-int.ocpq1_allowList": {
          "class": "Data_Group", 
          "keyDataType": "ip", 
          "label": "Allow list for...", 
          "storageType": "internal", 
          "records": [{"key": "****"}, {"key": "****"}]
        }, 
        "api-int.ocpq1_Policy": {
          "class": "Endpoint_Policy", 
          "label": "Routing policy for...", 
          "remark": "Routing policy for...", 
          "rules": [{"name": "OpenshiftAllow", "remark": "Restrict access to ...", "actions": [{"type": "drop", "event": "client-accepted"}], "conditions": [{"type": "tcp", "event": "client-accepted", "address": {"operand": "does-not-match", "datagroup": {"use": "api-int.ocpq1_allowList"}}}]}], 
          "strategy": "all-match"
        }
      }
    }
  }
}

2. Observe the following error response:

"The operation for OPENSHIFT has returned code: 422 with the following message: 010716d9:3: Virtual server /OPENSHIFT/OCPQ/api-int.ocpq_VS requires a profile of type http or http-connect for ltm policy /OPENSHIFT/Shared/api-int_Policy."

Expected Behavior

This error message should not occur. It should build the Virtual server with the LTM policy applied. The LTM policy itself does not require any form of HTTP profile as its conditions/actions are all based on information/details that are available.

NOTE: If I remove the policy_endpoint from the Virtual Server config specified in the json and apply it manually in the GUI, it completes and works as intended.

Actual Behavior

The AS3 execution fails to create the specified config with the following error: "The operation for OPENSHIFT has returned code: 422 with the following message: 010716d9:3: Virtual server /OPENSHIFT/OCPQ/api-int.ocpq_VS requires a profile of type http or http-connect for ltm policy /OPENSHIFT/Shared/api-int_Policy."

[kingb33]

I have tried some work arounds to get past this problems but any applied HTTP profile breaks the traffic flow of the virtual server.