Regarding: https://github.com/PaloAltoNetworks/cn-series-helm/blob/master/helm_cnv2/pan-cni-net-attach-def.yaml#L1
Which reads:
For OpenShift deploy this with "-n " for every app pod's namespace
Instead, you can actually use a couple different namespaces which make the net-attach-def referenceable from any pod in any namespace.
This functionality is called global namespaces in Multus CNI, and is used in Openshift.
Personally I would recommend using...
The source of truth for which namespaces are globally available to be referenced for net-attach-defs can be found @ https://github.com/openshift/cluster-network-operator/blob/master/bindata/network/multus/multus.yaml#L137
So, for example, let's say we have pan-cni-net-attach-def.yaml, you would...
oc create -f pan-cni-net-attach-def.yaml -n openshift-multus
Then, when you create a pod, you would use the "slash notation", meaning using a format like namespace/network-attachment-definition-name, so, a pod might look like this, paying special attention to the k8s.v1.cni.cncf.io/networks annotation.
apiVersion: v1
kind: Pod
metadata:
name: samplepod
annotations:
k8s.v1.cni.cncf.io/networks: openshift-multus/pan-cni
spec:
[...snipped...]
This would save you from having to save the net-attach-def to every namespace.
Regarding: https://github.com/PaloAltoNetworks/cn-series-helm/blob/master/helm_cnv2/pan-cni-net-attach-def.yaml#L1
Which reads:
Instead, you can actually use a couple different namespaces which make the net-attach-def referenceable from any pod in any namespace.
This functionality is called global namespaces in Multus CNI, and is used in Openshift.
Personally I would recommend using...
defaultopenshift-multusThe source of truth for which namespaces are globally available to be referenced for net-attach-defs can be found @ https://github.com/openshift/cluster-network-operator/blob/master/bindata/network/multus/multus.yaml#L137
So, for example, let's say we have
pan-cni-net-attach-def.yaml, you would...Then, when you create a pod, you would use the "slash notation", meaning using a format like
namespace/network-attachment-definition-name, so, a pod might look like this, paying special attention to thek8s.v1.cni.cncf.io/networksannotation.This would save you from having to save the net-attach-def to every namespace.