search

PaloAltoNetworks / cn-series-helm

This repo is for deploying CN-series firewall using Helm Package Manager for Kubernetes
MIT License
13 stars 22 forks source link

FYI: A "global namespace" can be used in openshift for your net-attach-def #33

Open dougbtv opened 2 months ago

dougbtv commented 2 months ago

Regarding: https://github.com/PaloAltoNetworks/cn-series-helm/blob/master/helm_cnv2/pan-cni-net-attach-def.yaml#L1

Which reads:

For OpenShift deploy this with "-n " for every app pod's namespace

Instead, you can actually use a couple different namespaces which make the net-attach-def referenceable from any pod in any namespace.

This functionality is called global namespaces in Multus CNI, and is used in Openshift.

Personally I would recommend using...

The source of truth for which namespaces are globally available to be referenced for net-attach-defs can be found @ https://github.com/openshift/cluster-network-operator/blob/master/bindata/network/multus/multus.yaml#L137

So, for example, let's say we have pan-cni-net-attach-def.yaml, you would...

oc create -f pan-cni-net-attach-def.yaml -n openshift-multus

Then, when you create a pod, you would use the "slash notation", meaning using a format like namespace/network-attachment-definition-name, so, a pod might look like this, paying special attention to the k8s.v1.cni.cncf.io/networks annotation.

apiVersion: v1
kind: Pod
metadata:
  name: samplepod
  annotations:
    k8s.v1.cni.cncf.io/networks: openshift-multus/pan-cni
spec:
  [...snipped...]

This would save you from having to save the net-attach-def to every namespace.

dougbtv commented 2 months ago

(I didn't intend to add the bug label, but I clicked the bug template when I created the issue, sorry about that!)

dougbtv commented 2 months ago

Additionally it looks like there's a note that reads: https://github.com/PaloAltoNetworks/cn-series-helm/blob/82deebbad55a14e0e4e28bedcaa3a525e3152b82/helm_cnv1/templates/pan-cni.yaml#L94-L95

So it looks like you're using this kind of obscure feature of multus that if the net-attach-def spec.conf value is unset, then, we grab a file from disk. I'm not a huge fan of this feature, particularly because it's not often used (and I'm not sure where it's documented to be honest, I tried to look around), and because it makes it harder for admins and support to figure out the actual configuration that's being used.

By using the global namespaces, maybe it makes it easier to actually pack the configuration in the object.