Deploy the CN-Series on OpenShift

Deploy your cluster.
Refer to the cloud platform vendor’s documentation and verify that the OpenShift versions and CNI are supported for the CN-Series. Review Get the image file for CN-Series Firewall and Editable parameters in CN-Series yaml files.
Use the workflow included in Secure Kubernetes workloads with CN-Series.
You must create the service credentials, and deploy the firewall YAMLs.
Note: If your service credential file is over 10KB, you must gzip the file and then do a base64 encoding of the compressed file before you upload or paste the contents of the file into the Panorama CLI or API.
Configure the PAN-CNI plugin to work with the Multus CNI plugin.
The Multus CNI on OpenShift functions as a "meta-plugin" that calls other CNI plugins. For each application you must:
Deploy the PAN-CNI NetworkAttachmentDefinition in every pod namespace

kubectl apply -f pan-cni-net-attach-def.yaml -n <target-namespace>

Modify the Application YAML.

After you deploy the pan-cni-net-attach-def.yaml, in the app pod yaml add the annotation:

paloaltonetworks.com/firewall: pan-fw

k8s.v1.cni.cncf.io/networks: pan-cni

If you have other networks in the above annotation, add

pan-cni

after the networks that need to be inspected. The networks that follow

pan-cni

are not redirected and inspected.

If your pod has multiple network interfaces, you must specify the interface names for which you want the CN-NGFW pod to inspect traffic, under “interfaces” in the pan-cni-configmap.yaml.

For example:

								template:
								    metadata:
								      annotations:
								         paloaltonetworks.com/firewall: pan-fw
								         k8s.v1.cni.cncf.io/networks: bridge-conf, macvlan-conf, sriov-conf, pan-cni
CN-Series now supports OVN-Kubernetes Container Network Interface (CNI) plug-in on RedHat OpenShift version 4.13 and above, in the Kubernetes Service deployment mode and DaemonSet mode.