Deploy the CN-Series on OpenShift Operator Hub

Log in to the Redhat OpenShift container console.

Go to

Operators

, and then click

OperatorHub

.



Enter

Palo Alto

in the Operator search box.

Click

pan-cn-series-operator

.



The install window opens when you click the

pan-cn-series-operator

tile.

Click

Install

to install the pan-cn-series operator on your OpenShift cluster.



Complete he pre-installation steps before the next deployment steps given here.

If your service credential file is over 10KB, you must gzip the file and then do a base64 encoding of the compressed file before you upload or paste the contents of the file into the Panorama CLI or API.

On the navigation menu, go to

Installed Operators

, and then click

pan-cn-series-operator

that you have installed.



Click

Create Instance

.



Enter a unique operand

Name

.



Enter the

Minimum Replicas for DP

,

Memory Unit

, and

vCPU Limit

for DP and MP pods. For information on vCPU limits, see CN-Series Key Performance Metrics.

Enter the

Panorama IP Address

.



Optional

Enter the

Secondary Panorama IP Address

for your HA deployment.

Enter the CN-Series Panorama

Auth Key

.

Enter the

Panorama Device Group

.

Enter the

Panorama Template Stack

.

Enter the

Panorama Log Collector Group Name

.

Optional

Enter the Customer Support Portal (CSP)

Pin ID

,

Pin value

, and

Alternate URL

.

Based on your PAN-OS version, link to the appropriate images for DP, MP, and CNI in the CN-Series Container registry console.

Click

Create

.

On the Navigation menu, go to

pods

.

Select project

OpenShift-operators

and then go to

kube-system

to view the name and status of the CNI, management, and data plane pods that you deployed as part of the operand.



You can check the firewall deployment status on Panorama. The

Device State

will change to Connected in less than 5 minutes after deployment.



Configure the PALO ALTO NETWORKS-CNI plugin to work with the Multus CNI plugin.

The Multus CNI on OpenShift functions as a

meta-plugin

that calls other CNI plugins. For each application you must:

Run the following command to deploy the pan-cni-net-attach-def.yaml in every pod namespace:

kubectl apply -f pan-cni-net-attach-def.yaml -n <target-namespace>

Modify the Application YAML.

After you deploy the pan-cni-net-attach-def.yaml, in the app pod yaml add the following annotation:

paloaltonetworks.com/firewall: pan-fw

k8s.v1.cni.cncf.io/networks: pan-cni

If you have other networks in the above annotation, add

pan-cni

after the networks that need inspection. The networks that follow

pan-cni

are not redirected and inspected.

If your pod has multiple network interfaces, you must specify the interface names for which you want the CN-NGFW pod to inspect traffic, under the

interfaces

section in the

pan-cni-configmap.yaml

file.

For example:

								template:
								    metadata:
								      annotations:
								         paloaltonetworks.com/firewall: pan-fw
								         k8s.v1.cni.cncf.io/networks: pan-cni