Page Comparison

...

1. Kubernetes interface is REST. Exact supported version of kubernetes has to be specified by every ONAP release
2. Database interface depends on DB type but only encrypted communication should be used
3. xNF interface depends on particular xNF but all xNFs should support secure protocols for communication
4. NFVI interface is REST (usually OpenStack or Kubernetes)
5. IAM interface is Open ID Connect
   1. if operator already has OIDC compatible solution ONAP should just use it
   2. if operator has Identity Provider (LDAP/Kerberos/etc) external OIDC solution should be deployed (ie keycloak) with operator IdP configured as backend
   3. In testing environment external OIDC solution should be deployed and bootstraped with test users
6. CA interface can be one of:
   1. Manual interaction by deployer that will retrieve certificates and the bootstrap ONAP instance with them
   2. One of automated certificate retrieval protocols (ACME, CMPv2 etc)
   3. In testing environment external CA (and ONAP should use automated certificate retrieval as described in b) solution should be deployed

Requirements towards used interfaces

Kubernetes

1. Cluster should be configured according to CIS guideline

Databases

1. Each DB should be configured according to corresponding CIS guideline
2. All DB should be already created or ONAP should be provided with user that is capable of creating DB
3. If ONAP creates a DB a dedicated user account with privileges limited to that DB should be created. Password used for this user cannot be hardcoded in ONAP source.

xNF

As defined in ONAP VNF security requirements

NFVI

As defined in CNTT Reference Architecture 1 & 2

IAM

1. IAM has to support OpenID connect standard

CA

1. If automated certificate retrieval is used on of .... has to be supported by the CA