Deploy the CN-Series on OpenShift Operator Hub

Log in to the Redhat OpenShift container console.

Go to

Operators

, and then click

OperatorHub

.



Enter

Palo Alto

in the Operator search box.

Click

pan-cn-series-operator

.



The install window opens when you click the

pan-cn-series-operator

tile.

Click

Install

to install the pan-cn-series operator on your OpenShift cluster.



You should ensure that the pre-installation steps are completed before the next deployment steps given here.

If your service credential file is over 10KB, you must gzip the file and then, do a base64 encoding of the compressed file before you upload or paste the contents of the file into the Panorama CLI or API.

On the navigation menu, go to

Installed Operators

, and then click

pan-cn-series-operator

that you have installed.



Click

Create Instance

.



Enter a unique operand

Name

.



Enter the

vCPU Limit

for DP and MP pods. For information on vCPU limits, see CN-Series Key Performance Metrics.

Based on your PAN OS version, link to the appropriate images for DP, MP, and CNI in the CN-Series Container registry console.

Under the

CSP

section, enter the CSP CN-Series

Pin ID

and

Pin value

.

Under the

Failover Mode

section:

Select the preferred
failover mode
option.
Select
Deployment
as the operation mode for K8s-service deployments or the
Daemonset
as the operation mode for daemonset deployments
Select the
PanOS Version
.

Under the

Panorama

section:

Enter the CN-Series Panorama
Auth Key
.
Enter the
collector group(Cg) Name
Enter the
Device Group
Enter the
IP Address
Enter the
Template
name.



Click

Create

.

On the Navigation menu, go to

pods

.

Select project

OpenShift-operators

and then go to

kube-system

to view the name and status of the CNI, management, and data plane pods that were deployed as part of the operand.



You can check the firewall deployment status on Panorama. The

Device State

will change to Connected in less than five minutes after deployment.



Configure the PAN-CNI plugin to work with the Multus CNI plugin.

The Multus CNI on OpenShift functions as a

meta-plugin

that calls other CNI plugins. For each application you must:

Run the following command to deploy the pan-cni-net-attach-def.yaml in every pod namespace:

kubectl apply -f pan-cni-net-attach-def.yaml -n <target-namespace>

Modify the Application YAML.

After you deploy the pan-cni-net-attach-def.yaml, in the app pod yaml add the following annotation:

paloaltonetworks.com/firewall: pan-fw

k8s.v1.cni.cncf.io/networks: pan-cni

If you have other networks in the above annotation, add

pan-cni

after the networks that need to be inspected. The networks that follow

pan-cni

are not redirected and inspected.

If your pod has multiple network interfaces, you must specify the interface names for which you want the CN-NGFW pod to inspect traffic, under the

interfaces

section in the

pan-cni-configmap.yaml

file.

For example:

								template:
								    metadata:
								      annotations:
								         paloaltonetworks.com/firewall: pan-fw
								         k8s.v1.cni.cncf.io/networks: bridge-conf, macvlan-conf, sriov-conf, pan-cni