>
    Deploy the CN-Series Firewall on OKE
    Focus
    Download PDF
    Focus
    1. Home
    2. CN-Series
    3. Deploy the CN-Series Firewall on OKE
    Download PDF
    CN-Series

    Deploy the CN-Series Firewall on OKE

    Table of Contents

    Deploy the CN-Series Firewall on OKE

    Where Can I Use This?What Do I Need?
    • CN-Series deployment
    • CN-Series 10.1.x or above Container Images
    • Panorama running PAN-OS 10.1.x or above version
    • Helm 3.6 or above version client for CN-Series deployment using Helm
    Oracle Kubernetes Engine (OKE) is an OCI service that allows you to deploy kubernetes cluster. You can now deploy CN-Series firewall on OKE cluster as a daemonset and kubernetes as a service.
    After you review the CN-Series Building Blocks and the high-level overview of the workflow in Securing the Kubernetes Environments with CN-Series, you can start deploying the CN-Series firewall on OKE platform to secure traffic between containers within the same cluster, as well as between containers and other workload types such as virtual machines and bare-metal servers.
    You need standard Kubernetes tools such as kubectl or Helm to deploy and manage your Kubernetes clusters, apps, and firewall services.
    For more information, see deploy CN-Series Firewalls with Helm Charts and Templates. Panorama is not designed to be an orchestrator for Kubernetes cluster deployment and management. Templates for cluster management are provided by Managed Kubernetes providers. Palo Alto Networks provides community-supported templates for deploying CN-Series with Helm and Terraform.
    Before moving from deploying CN-Series as a DaemonSet to CN-Series as a Service or vice versa, you must delete and reapply plugin-serviceaccount.yaml. For more information, see Create Service Accounts for Cluster Authentication.
    • When you deploy CN-Series as a DaemonSet on OKE, the pan-plugin-cluster-mode-secret must not exist.
    • When you deploy CN-Series as a Kubernetes service on OKE, the pan-plugin-cluster-mode-secret must be present.

    © 2024 Palo Alto Networks, Inc. All rights reserved.