apiVersion: v1
kind: ConfigMap
metadata:
  name: pan-ngfw-config
  namespace: kube-system
data:
  PAN_SERVICE_NAME: pan-mgmt-svc    # should match the pan-cn-mgmt.yaml's Service name
  FAILOVER_MODE: failopen           # licensing failure behavior
  DP_RINGBUFFER: "60000"            # buffer count for memory/performance control

  # Comment out to use CERTs otherwise PSK for IPSec between pan-mgmt and pan-ngfw
  # Not using CERTs currently in openshift
  IPSEC_CERT_BYPASS: ""             # No values needed
  
  #IPSEC_NAT_PORT_RANGE: "4500-4500"    # port range to avoid stale connections

  # Enable/Disable cpu pinning of the forwarding processes (default physical
  # cpus) (different from K8S cpu pinning of the pods)
  PAN_CPU_PINNING_ENABLED: "false"

  # When doing cpu pinning of forwarding processes, use logical cpus as well
  #PAN_HYPERTHREADING_ENABLED: "true"
      
  # When doing cpu pinning of forwarding processes, skip the lower numbered cpus
  # and start from this cpu
  #PAN_CPU_PINNING_BASE: "1"
