F5 Distributed Cloud Example Scripts

Simple scripts to demonstrate API interactions with F5 Distributed Cloud for common maintenance tasks.

Scripts:

• all_ce_sites_update.sh: will query a list of all sites, then call ce_site_upgrade.sh to update SW and OS on every site.

• ce_site_upgrade.sh: can be used to upgrade individual sites SW and OS.

• api_cred_cleanup.sh: will query a list of expired API credentials and revoke / delete. Does not touch kube configs.

• service_cred_cleanup.sh: similiar to api credential cleanup, but for service credentials.

• cdn_cleanup.sh: cleans up / removes content distribution objects in all namespaces.

• orphaned_object_purge.sh: cleans up objects without any references.

• orphaned_object_audit.sh: audits objects without any references (without deleting). Supports filtering by object type.

• old_object_purge.sh: allows deletion of objects older than a specified date. [Default: 180 Days]

• all_ce_reboot_audit.sh: outputs a list of Custome Edge Sites/Nodes and their latest (re)boot date-time.

• user_audit.sh: audits all users showing roles, last login, and status. Supports filtering by inactive days and CSV export.

• lb_cert_conversion.sh: converts HTTP load balancers from manual certificate (https) to auto-certificate (https_auto_cert). LB will not maintain previous CNAME value if that is being used. Will potentially require manual DNS updates.

• service_policy_allowlist_update.sh: queries ipv4.icanhazip.com for your current public IP and creates or updates a specified service policy allow list with that IP. If the policy exists, the IP is appended (if not already present). If it doesn't exist, a new policy is created with default_action_deny.

• application_backup.sh: will back up all objects in Shared & Application Namespaces:

  • HTTP Load Balancers
  • TCP Load Balancers
  • HTTP Connect & DRP
  • Origin Pools
  • Health Checks
  • Service Policies
  • Application Firewalls
  • User Identifications
  • App Settings
  • API Definitions
  • Custom Routes
  • Certificates
  • Root CA Certificate/Bundles
  • Virtual Sites

To Run:

./scriptname.sh <API TOKEN> <TENANT Name> [OPTIONS]

Options (script-specific):

Script	Option	Description
old_object_purge.sh	--days=N	Delete objects older than N days (default: 180)
orphaned_object_audit.sh	--type=TYPE	Filter by object type: origin_pool, app_firewall, service_policy, app_setting, api_definition, http_loadbalancer
user_audit.sh	--inactive-days=N	Only show users inactive for more than N days
user_audit.sh	--format=FORMAT	Output format: table (default), csv
lb_cert_conversion.sh	--namespace=NS	Target namespace (required)
lb_cert_conversion.sh	--lb-name=NAME	Specific LB to convert
lb_cert_conversion.sh	--all	Convert all manual-cert LBs in namespace
lb_cert_conversion.sh	--dry-run	Show what would change without executing
lb_cert_conversion.sh	--yes	Skip per-LB confirmation prompts

| service_policy_allowlist_update.sh | | Note: uses <policy-name> <namespace> <tenant> <api-token> argument order |

Examples:

# Update all CE sites
./all_ce_sites_update.sh abcdefg8675309= customer-tenant

# Purge objects older than 90 days
./old_object_purge.sh abcdefg8675309= customer-tenant --days=90

# Audit all orphaned objects
./orphaned_object_audit.sh abcdefg8675309= customer-tenant

# Audit only orphaned service policies
./orphaned_object_audit.sh abcdefg8675309= customer-tenant --type=service_policy

# Audit all users
./user_audit.sh abcdefg8675309= customer-tenant

# Audit users inactive for more than 90 days
./user_audit.sh abcdefg8675309= customer-tenant --inactive-days=90

# Export user audit to CSV
./user_audit.sh abcdefg8675309= customer-tenant --format=csv > users.csv

# Dry-run: preview which LBs would be converted in a namespace
./lb_cert_conversion.sh abcdefg8675309= customer-tenant --namespace=my-app --all --dry-run

# Convert a single LB from manual-cert to auto-cert
./lb_cert_conversion.sh abcdefg8675309= customer-tenant --namespace=my-app --lb-name=my-https-lb

# Convert all manual-cert LBs in a namespace without prompting
./lb_cert_conversion.sh abcdefg8675309= customer-tenant --namespace=my-app --all --yes

# Add current public IP to a service policy allow list (creates if not found)
./service_policy_allowlist_update.sh my-allow-policy my-namespace customer-tenant abcdefg8675309=

Testing

The repo includes a BATS-based test suite with unit tests (mocked curl) and integration tests (live API).

Setup

# First run installs BATS automatically
cp tests/.env.test.example tests/.env.test
# Edit tests/.env.test with your tenant, token, and namespace

Running Tests

./tests/run_tests.sh              # Unit tests only (default, ~10 seconds)
./tests/run_tests.sh --integration # Integration tests (requires .env.test, ~12 minutes)
./tests/run_tests.sh --all        # Both

Test Coverage

• Unit tests (146 tests): All 16 scripts covered — argument validation, missing jq, API error handling, and script-specific logic. Uses a PATH-based curl mock with URL-pattern routing.
• Integration tests (10 tests): Live API tests for safe, non-destructive scripts — service_policy_allowlist_update.sh (create/idempotent/verify), orphaned_object_audit.sh, all_ce_reboot_audit.sh, and user_audit.sh. Skips gracefully when token lacks permissions.