sample_app.yaml

# create a namespace
apiVersion: v1
kind: Namespace
metadata:
    name: test
    # All pods in a namespace with annotation 
    #    "paloaltonetworks.com/firewall: pan-fw*" are secured
    #annotations:
    #  paloaltonetworks.com/firewall: pan-fw
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  labels:
    app: ubuntu-essentials
  name: ubuntu-essentials
  namespace: test
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: ubuntu-essentials
      # Pods with annotation "paloaltonetworks.com/firewall: pan-fw*" are secured
      annotations:
          paloaltonetworks.com/firewall: pan-fw
      name: ubuntu-essentials
    spec:
      #nodeSelector:
      #    firewall: pan-fw
      containers:
        - name: ubuntu-essentials
          image: gcr.io/vmseries-dev-242318/ubuntu:essentials
          command: ["sleep", "infinity"]
          resources:
            requests:
              memory: "100Mi"
              cpu: "100m"
            limits:
              memory: "0.2Gi"
              cpu: "200m"
          #securityContext:
          #  capabilities:
          #    add: ["ALL"]
      volumes:
      - name: pan-cni-ready
        hostPath:
          # block this pod scheduling till PAN CNI plugin insertion on the node
          path: /var/log/pan-appinfo/pan-cni-ready
          type: Directory