FYI: A "global namespace" can be used in openshift for your net-attach-def

[dougbtv]

Regarding: https://github.com/PaloAltoNetworks/cn-series-helm/blob/master/helm_cnv2/pan-cni-net-attach-def.yaml#L1

Which reads:

For OpenShift deploy this with "-n " for every app pod's namespace

Instead, you can actually use a couple different namespaces which make the net-attach-def referenceable from any pod in any namespace.

This functionality is called global namespaces in Multus CNI, and is used in Openshift.

Personally I would recommend using...

• default
• openshift-multus

The source of truth for which namespaces are globally available to be referenced for net-attach-defs can be found @ https://github.com/openshift/cluster-network-operator/blob/master/bindata/network/multus/multus.yaml#L137

So, for example, let's say we have pan-cni-net-attach-def.yaml, you would...

oc create -f pan-cni-net-attach-def.yaml -n openshift-multus

Then, when you create a pod, you would use the "slash notation", meaning using a format like namespace/network-attachment-definition-name, so, a pod might look like this, paying special attention to the k8s.v1.cni.cncf.io/networks annotation.

apiVersion: v1
kind: Pod
metadata:
  name: samplepod
  annotations:
    k8s.v1.cni.cncf.io/networks: openshift-multus/pan-cni
spec:
  [...snipped...]

This would save you from having to save the net-attach-def to every namespace.

[dougbtv]

(I didn't intend to add the bug label, but I clicked the bug template when I created the issue, sorry about that!)

[dougbtv]

Additionally it looks like there's a note that reads:

cn-series-helm/helm_cnv1/templates/pan-cni.yaml

Lines 94 to 95 in 82deebb

	# Whether to deploy the configuration file as a plugin chain or as
	# a standalone file (for multus) in cni-conf-dir

So it looks like you're using this kind of obscure feature of multus that if the net-attach-def spec.conf value is unset, then, we grab a file from disk. I'm not a huge fan of this feature, particularly because it's not often used (and I'm not sure where it's documented to be honest, I tried to look around), and because it makes it harder for admins and support to figure out the actual configuration that's being used.

By using the global namespaces, maybe it makes it easier to actually pack the configuration in the object.