Deploy the CN-Series on OpenShift Operator Hub

1. Log in to the Redhat OpenShift container console.
2. Go to Operators, and then click OperatorHub.

3. Enter Palo Alto in the Operator search box.
4. Click pan-cn-series-operator.

   The install window opens when you click the pan-cn-series-operator tile.
5. Click Install to install the pan-cn-series operator on your OpenShift cluster.

   Complete he pre-installation steps before the next deployment steps given here.
   If your service credential file is over 10KB, you must gzip the file and then do a base64 encoding of the compressed file before you upload or paste the contents of the file into the Panorama CLI or API.
6. On the navigation menu, go to Installed Operators, and then click pan-cn-series-operator that you have installed.

7. Click Create Instance.

8. Enter a unique operand Name.

9. Enter the Minimum Replicas for DP, Memory Unit, and vCPU Limit for DP and MP pods. For information on vCPU limits, see CN-Series Key Performance Metrics.
10. Enter the Panorama IP Address.

11. Optional Enter the Secondary Panorama IP Address for your HA deployment.
12. Enter the CN-Series Panorama Auth Key.
13. Enter the Panorama Device Group.
14. Enter the Panorama Template Stack.
15. Enter the Panorama Log Collector Group Name.
16. Optional Enter the Customer Support Portal (CSP) Pin ID, Pin value, and Alternate URL.
17. Based on your PAN-OS version, link to the appropriate images for DP, MP, and CNI in the CN-Series Container registry console.
18. Click Create.
19. On the Navigation menu, go to pods.
20. Select project OpenShift-operators and then go to kube-system to view the name and status of the CNI, management, and data plane pods that you deployed as part of the operand.

    You can check the firewall deployment status on Panorama. The Device State will change to Connected in less than 5 minutes after deployment.

21. Configure the PALO ALTO NETWORKS-CNI plugin to work with the Multus CNI plugin.
    The Multus CNI on OpenShift functions as a meta-plugin that calls other CNI plugins. For each application you must:

    1. Run the following command to deploy the pan-cni-net-attach-def.yaml in every pod namespace:
       kubectl apply -f pan-cni-net-attach-def.yaml -n <target-namespace>
    2. Modify the Application YAML.
       After you deploy the pan-cni-net-attach-def.yaml, in the app pod yaml add the following annotation:
       paloaltonetworks.com/firewall: pan-fw
       k8s.v1.cni.cncf.io/networks: pan-cni
       If you have other networks in the above annotation, add pan-cni after the networks that need inspection. The networks that follow pan-cni are not redirected and inspected.
       If your pod has multiple network interfaces, you must specify the interface names for which you want the CN-NGFW pod to inspect traffic, under the interfaces section in the pan-cni-configmap.yaml file.
       For example:

       
       								template:
       								    metadata:
       								      annotations:
       								         paloaltonetworks.com/firewall: pan-fw
       								         k8s.v1.cni.cncf.io/networks: pan-cni