🔴 F5 BIG-IP LTM iFile Terraform Module

terraform-bigip-ltm-ifile manages a single bigip_ltm_ifile object -- an LTM-namespace reference that binds a pre-uploaded system iFile into the LTM configuration -- on a BIG-IP TMOS >= v12.1.1 device, via the F5Networks/bigip Terraform provider ~> 1.28.

• 🔗 Creates one bigip_ltm_ifile -- the LTM-level record that makes a pre-uploaded system iFile addressable from iRules and local traffic policies.
• 📄 Owns no file content itself -- the referenced system iFile (var.file_name) must already exist, created by the sibling terraform-bigip-sys-ifile module or out of band.
• 🏷️ Emits a name output holding the full-path identity (/Partition/name) as the practical primary cross-reference key -- sourced from the provider's computed full_path attribute, since (unlike most resources in this catalog) the live schema keeps the resource's own name argument as a bare leaf identifier, separate from partition.
• 🧵 Renders all four provider arguments (name, file_name, partition, sub_path) directly -- the simplest possible thin renderer in the catalog, with no nested blocks and no dynamic.
• 🔓 partition defaults to "Common" only because that is the underlying resource's own provider default, not an invented one; sub_path defaults to null (no sub-path segment).

💡 Why it matters: BIG-IP iFiles are frequently used to back custom error pages, iRule-driven content templates, and policy-driven response bodies -- content that must be versioned and promoted consistently across environments. Splitting the system-level file upload (terraform-bigip-sys-ifile) from the LTM-level reference (this module) keeps the file's own lifecycle independent from how many LTM objects reference it, and lets Terraform's implicit dependency graph enforce that the file exists before anything tries to bind it.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

flowchart LR
 SYSIFILE["terraform-bigip-sys-ifile (sibling, upstream)"]:::sibling
 IFILE["terraform-bigip-ltm-ifile (this module)"]:::this
 IRULE["terraform-bigip-ltm-irule (sibling)"]:::sibling
 POLICY["terraform-bigip-ltm-policy (sibling)"]:::sibling
 VS["terraform-bigip-ltm-virtual-server (keystone)"]:::keystone

 SYSIFILE -->|"name (full-path sys iFile)"| IFILE
 IFILE -->|"name (full-path, referenced by TCL ifile command)"| IRULE
 IFILE -.->|"name (full-path, referenced by policy action, optional)"| POLICY
 IRULE -->|"irules list (full-path name)"| VS
 POLICY -.->|"policy attachment (full-path name)"| VS

 classDef this fill:#E4002B,color:#ffffff,stroke:#333333,stroke-width:1px;
 classDef keystone fill:#000000,color:#ffffff,stroke:#333333,stroke-width:1px;
 classDef sibling fill:#e8e8e8,color:#000000,stroke:#999999,stroke-width:1px;

This module sits between terraform-bigip-sys-ifile (the system-level file upload it consumes by name) and the LTM objects that actually invoke the iFile at runtime -- terraform-bigip-ltm-irule (via the TCL ifile command) and, less commonly, terraform-bigip-ltm-policy (via a policy action). Those, in turn, feed terraform-bigip-ltm-virtual-server, the family's ultimate keystone consumer. This module owns none of that downstream wiring -- it owns exactly the LTM iFile reference record.

flowchart LR
 INNAME["var.name"]:::input
 INFILE["var.file_name"]:::input
 INPART["var.partition"]:::input
 INSUB["var.sub_path"]:::input
 RES["bigip_ltm_ifile.this"]:::resource
 OUTNAME["output: name"]:::output
 OUTID["output: id"]:::output
 OUTFP["output: full_path"]:::output

 INNAME --> RES
 INFILE --> RES
 INPART --> RES
 INSUB --> RES
 RES --> OUTNAME
 RES --> OUTID
 RES --> OUTFP

 classDef input fill:#e8e8e8,color:#000000,stroke:#999999,stroke-width:1px;
 classDef resource fill:#E4002B,color:#ffffff,stroke:#333333,stroke-width:1px;
 classDef output fill:#000000,color:#ffffff,stroke:#333333,stroke-width:1px;

Resource inventory

Schema notes that bite

• name, partition, and sub_path are all part of the object's full-path identity -- changing any one of them forces destroy/recreate, not an in-place update. There is no in-place rename or "move between partitions" operation for an LTM iFile.
• file_name must already exist as a system iFile at that exact full path (e.g. /Common/my-sys-ifile) before this resource applies -- the provider raises a generic iControl REST error if it does not; this module performs no Terraform-level existence pre-check.
• partition defaults to "Common" because that is bigip_ltm_ifile's own provider default -- per this module suite's partition-scope rule, this is not an invented default.
• sub_path defaults to null, placing the object directly under partition with no hierarchical sub-path segment unless the caller opts in.
• The resource's own name argument is a bare leaf identifier (e.g. app-error-template), not a full path -- unlike most resources in this catalog. This module's name output is deliberately sourced from the provider-computed full_path attribute (partition + sub_path + name) rather than echoing the bare argument, so it still serves as the practical full-path cross-reference key sibling modules should consume, consistent with the rest of the catalog.
• The live schema documents no description for the resource's id attribute, so whether it echoes the bare name or the full path is unconfirmed -- consume this module's name output (not id) for cross-references.

Manager role scoped to the target partition is sufficient; Administrator is not required for this application-layer LTM object.

• iControl REST enabled and reachable on the target device.
• TMOS >= v12.1.1 (provider floor).
• Target partition must already exist.
• The system iFile named in file_name must already exist on the device (created out of band or via terraform-bigip-sys-ifile) before this module applies -- bigip_ltm_ifile references it by full path and does not create or upload file content itself.

# Caller's root module configures the provider once -- never inside this module.
# provider "bigip" {
# address = var.bigip_address
# username = var.bigip_username
# password = var.bigip_password
# }

module "app_error_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "app-error-template"            # bare leaf name -- partition defaults to "Common"
  file_name = module.app_error_sys_ifile.name # from terraform-bigip-sys-ifile
}

Consumes

Emits

module "app_error_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "app-error-template" # bare leaf name, no leading /Partition/
  file_name = "/Common/app-error-template-src"
}

module "app_error_sys_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-sys-ifile.git?ref=v1.0.0"

  #... sys iFile source-path arguments
}

module "app_error_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "app-error-template"
  file_name = module.app_error_sys_ifile.name
}

module "app_error_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "app-error-template"
  file_name = "/Common/app-error-template-src"
  partition = "Common"
}

module "tenant_a_error_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "tenant-a-error-template"
  file_name = "/Tenant-A/tenant-a-error-template-src"
  partition = "Tenant-A"
}

module "templates_error_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "ltm-error-template"
  file_name = "/Common/ltm-error-template-src"
  partition = "Common"
  sub_path  = "templates"
}

module "tenant_b_templates_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "tenant-b-welcome-page"
  file_name = "/Tenant-B/tenant-b-welcome-page-src"
  partition = "Tenant-B"
  sub_path  = "templates"
}

module "maintenance_page_sys_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-sys-ifile.git?ref=v1.0.0"

  #... sys iFile source-path arguments
}

module "maintenance_page_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "maintenance-page"
  file_name = module.maintenance_page_sys_ifile.id
}

module "http_503_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "http-503-response-body"
  file_name = "/Common/http-503-response-body-src"
}

module "maintenance_irule" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-irule.git?ref=v1.0.0"

  name  = "/Common/maintenance-503-irule"
  irule = file("${path.module}/irules/maintenance-503.tcl")
  # the TCL body invokes `ifile get "${module.http_503_ifile.name}"` at runtime
}

module "policy_response_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "policy-custom-response"
  file_name = "/Common/policy-custom-response-src"
}

module "custom_response_policy" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-policy.git?ref=v1.0.0"

  #... policy rule action referencing module.policy_response_ifile.name by full path
}

module "shared_banner_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "shared-banner"
  file_name = "/Common/shared-banner-src"
}

module "app1_banner_irule" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-irule.git?ref=v1.0.0"

  name  = "/Common/app1-banner-irule"
  irule = file("${path.module}/irules/app1-banner.tcl")
}

module "app2_banner_irule" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-irule.git?ref=v1.0.0"

  name  = "/Common/app2-banner-irule"
  irule = file("${path.module}/irules/app2-banner.tcl")
}

locals {
  error_templates = {
    "404" = { file_name = "/Common/error-404-src" }
    "500" = { file_name = "/Common/error-500-src" }
    "503" = { file_name = "/Common/error-503-src" }
  }
}

module "error_ifiles" {
  source   = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"
  for_each = local.error_templates

  name      = "error-${each.key}-template"
  file_name = each.value.file_name
}

module "app_error_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "app-error-template-v2" # was "app-error-template"
  file_name = "/Common/app-error-template-src"
}

module "lab_banner_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "lab-banner"
  file_name = "/Common/lab-banner-src"
}

module "maintenance_sys_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-sys-ifile.git?ref=v1.0.0"

  #... sys iFile source-path arguments (uploaded maintenance-page content)
}

module "maintenance_ifile" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

  name      = "maintenance-page"
  file_name = module.maintenance_sys_ifile.name
}

module "maintenance_irule" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-irule.git?ref=v1.0.0"

  name  = "/Common/maintenance-irule"
  irule = file("${path.module}/irules/maintenance.tcl")
  # TCL body invokes `ifile get "${module.maintenance_ifile.name}"` when maintenance mode is active
}

module "app_pool" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-pool.git?ref=v1.0.0"

  #... pool + members, monitors consumed by name from terraform-bigip-ltm-monitor
}

module "app_virtual_server" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-virtual-server.git?ref=v1.0.0"

  name        = "/Common/app-vs"
  destination = "10.20.30.100:443" # caller supplies an explicit destination, never 0.0.0.0/0
  pool_name   = module.app_pool.name
  irules      = [module.maintenance_irule.name]
}

Summary

variable "name" {
  type = string
}

variable "file_name" {
  type = string
}

variable "partition" {
  type    = string
  default = "Common"
}

variable "sub_path" {
  type    = string
  default = null
}

• Total renderer, no nested blocks. All four arguments (name, file_name, partition, sub_path) map directly onto bigip_ltm_ifile.this with no dynamic blocks, no try, and no for_each inside the module -- the simplest thin-renderer shape in the catalog, since bigip_ltm_ifile's live schema exposes no nested or repeating structure.
• No owned children. Unlike terraform-bigip-ltm-node (a single-item fqdn dynamic block) or terraform-bigip-ltm-policy (a for_each-keyed rule collection), this resource has nothing to model beyond its own flat argument set.
• File content is out of scope. This module never creates, uploads, or owns iFile bytes -- that is terraform-bigip-sys-ifile's responsibility. This module only creates the LTM-namespace pointer to a file that must already exist.
• Full-path identity drives every immutability rule. name, partition, and sub_path together form the object's real key; changing any of them is destroy/recreate, never an in-place update -- consuming iRules/policies must be repointed at the new full path in the same change.
• id and full_path both surface alongside name. Per this module suite's design-decisions log, name remains the practical cross-reference key; full_path is retained mainly for diagnostics/reporting since it is computed identically to name for objects with no sub_path.

cd C:\GitHubCode\newf5modules\bigip\terraform-bigip-ltm-ifile
terraform init -backend=false
terraform validate
terraform fmt -check

Pin consuming module calls to ?ref=v1.0.0 (or the current tagged release) rather than an unpinned branch reference:

source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-ifile.git?ref=v1.0.0"

This module's offline proof gate is terraform init -backend=false && terraform validate && terraform fmt -check. That gate exercises:

• Type-correctness of all four variables (name, file_name, partition, sub_path) against their declared types.
• HCL formatting.

It does not exercise: whether the system iFile named in file_name actually exists on the target device, whether the target partition exists, or how BIG-IP itself resolves the object's full path at apply time. Only terraform plan/apply against a real, reachable BIG-IP device -- with the caller's root module supplying a configured bigip provider -- exercises that live-device validation.

$ terraform output

name = "/Common/app-error-template"
id = "app-error-template" # provider-internal id -- not confirmed to equal the full path
full_path = "/Common/app-error-template"

• bigip_ltm_ifile Argument Reference -- F5Networks/bigip provider docs
• terraform-bigip-sys-ifile -- owns the system iFile content this module references by name
• terraform-bigip-ltm-irule -- consumes this module's name output via the TCL ifile command
• terraform-bigip-ltm-policy -- consumes this module's name output via a policy action
• This module's SCOPE.md -- cross-module contract