Versions Compared

Old Version 1

changes.mady.by.user Paweł Pawlak

Saved on

compared with

New Version 2

changes.mady.by.user Paweł Pawlak

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Jira No
SummaryDescriptionStatusSolution

SECCOM requirements for Honolulu

Commitments are  expected from the companies to provide resources to support the requirement, otherwise all of the requirements are no go for the moment. Discussion with Andreas and commitment on Michal’s suport for Python upgrades.

For CII Badging work with the integration team to have scripts that would validate.

ongoing

Amy waiting for a feedback from Catherine on the actions on our side to perform packages upgrades.



Harbor update
  1. Harbor is a reference solution of a container registry for ONAP SW: Harbor is verified along with ONAP SW test cases, and ONAP also provides a reference configuration of Harbor.
    But Harbor itself is not part of ONAP release / deliverables.
  2. In addition to number 1 items: Harbor is part of ONAP release, it is packaged as one of the ONAP deliverables along with a reference configuration.

2 ways of Harbor onboarding: run and development. More information about the job and key requirement. In dev phase Nexu-IQ will be kept.

Signing of code releases by LFN. Fabian considers Notary for that. 

ongoing

Secrets management update

Different types of secrets exist in ONAP:

  1. Passwords to databases - they can not be replaced with teh service mesh
  2. Certificates - used to be hardcoded
  3. Passwords used for communication between ONAP services
  4. Passwords related to user management
  5. Passwords related to external systems (like for OpenStack)

For every cathegory above different solution should apply:

Ad 1: common secrets templates, 3-5 components still needs tobe updated like etcd, Cassandra.

Ad 2: Cert initializer for https as a starting point, new backend considered apart from Certman (from AAF) like Certificate Manager from upstream.

Fabian manages certificates with reverse proxy, as Bell Canada does.

ONAP components are not yet ready for Ingress.

Ad 3: service mesh solution with proper access rights or any other security framework.

Ad 4: authentication in ingress, passwords externalized to keycloak.

Ad 5: for now should be placed in secrets, in long future will needa secret store. Fabian proposed to keep secretes in Vault but outside of Kubernetes but then how to access it? secret zero problem exists.




Flow matrix

Fabian had a meeting with Sebatien..

ongoing

Guilin version highlights 
  1. Packages upgrades progress 
  2. Java (v8 → 11) and Python (v2.7 → v3.6) migrations
  3. Progress in packages not running as root - decrease
  4. Migrations to https as dafault best practice
ongoingInformation was shared with David and Catherine.

CII Badging requirementsDescription part was updated by Tony.done

CII Dashboard

3 projects that are silver now:, and even one of those projects is 65% of gold (VVP) and 2 other are at 57 % of gold (Policy) and AAF, CLAMP is 96% silver and over 40 % gold. 

Progress was shared with the next PTLs call.

ongoing


OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 24th OF NOVEMBER'20. 





Recording:

View file
name2020-11-17_SECCOM_week.mp4
height150


SECCOM presentation: