Versions Compared

Old Version 2

changes.mady.by.user Paweł Pawlak

Saved on

compared with

New Version Current

changes.mady.by.user Paweł Pawlak

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Master branch content only is analyzed only by SonarCloud.

WikiMedia solution was tested and is based on Sonar Webhook and small web service hosted on Toolforge. Developer proposes a patch on Gerrit, Jenkins job is triggered with patch set event, in the Jenkins job the analysis of the proposed code is launched in SonarCloud, Jenkins job goes to the end if Maven build is ok, we have a very at +1, if failed: verify at -1. after in the endof analysis of the code in SonarCloud, Webhook posts a request with the result of the scan to the web service which gets the request and if the name of the branch is Master, does nothing, if the name of the brach is short life branches, sends +1 in the verify parameter if the scan is OK, and 0 if the scan is NOK - in this case parameter in the gerrit is removed and developer has to correct his/her code before proposing this patch. Patch can not be merged into the branch. When gerrit receives the post request sent by the web service (containing verify parameter + which conditions are OK and which are NOK).  

Webservice developped by Wikimedia can be adapted (some URL hardcoded) and to be tested with SonarCloud.io. Estimated LoE (Level of Effort) is very small.

For ONAP quality gate is very low: https://sonarcloud.io/organizations/onap/quality_gates/show/6826

E-mail to be sent to Seshu to try to move forward merge (Pawel).

Meeting to be organized with Jess and LFN on plugin deployment possibility (Fabian)

Jira No
SummaryDescriptionStatusSolution

Jenkins, Gerrit and Sonar – Thierry Aleno

ongoing

Meeting to be organized by Pawel with LFN (Jess, Kenny) and friendly project (CPS) for a PoC later this week. If result of the PoC is positive, it could be generalized to whole ONAP.

We should present the solution to PTLs.

Use cases for a PoC to be defined.


PTLs meting update
  • What do we do with repos that are not part of the release? PTL has to define a ticket to LFN – 2 steps process. 
  • Integration status by Morgan for base images – at least 1 project needs an another base image.
  • Critical Jira issue – TSC to be addressed on Thursday ().
ongoing

PTLs shall be encouraged to take their actions to deprecate their relevant repos.

TSC meeting update

TSC approved SonarCloud profile management model.

Invitation received from Bengt to ONAP GitHub

ongoing

GitHub IDs to be collected from PTLs - to be checked with David by Pawel.

Amy to follow-up with Bengt directly on being added to ONAP GitHub.

(IT-22048) for direct vs. indirect dependencies with container scansFeedback from Bengt to move on with ticket at Sonatype by opening a feature request - Amy opened a feature request (IT-22175) - no updateongoingFabian's update - quality of a code

DMaaP only 16 minor security issues, with SO pending merge (e-mail was sent to Seshu - no response so far, but Fabian reports merge)

ongoingSoftware BOM and point upgrade discussion – atomic level of ONAP.

How detailed BOM shall be.

Release Management of a different ONAP components - way to collect information ( ajor ONAP modules, OSes, DBs etc.). Software Bill of Materials - we do not crreate today but we have Nexus-IQ from which information can be retrieved. Contractural aspects to be checked.

How to upgrade vulnerable module?

startedAmy to organize with Muddasar a meeting on Software BOM.

DCAE plans for Istanbul with regards to Security/global requirements – Vijay

Firstfeedback from SECCOM: 

org.apache.tomcat.embed : tomcat-embed-core : although the latest from 9.x train is 9.0.48, there might be some issue with licensing there, so please consider 9.0.46

Slide deck presented by Vijay:

View file
nameONAP_DCAE_Istanbul_Security_plan.pptx
height150

Regular exception process will be used, Vijay provided detailed explaination on the scans findings for it.

For: dcaegen2-platform-inventory-api and dcaegen2-platform-servicechange-handler with architecture change with deployment via HELM,  those components from Honolulu version will be used in Istanbul to be finally retired in Jakarta. 

We are not scanning containers but repos in the SCA.

For Java and Python we run container scans.

In Orange labs (but not for other labs like Windriver) one component is failing with resource limit - exception might be required. https://gerrit.onap.org/r/c/oom/+/122079/9/kubernetes/dcaegen2/components/dcae-dashboard/values.yaml

Internal ONAP HELM registry with fine grained authorization supported by Chartmuseum. It will be explored for next release based on other projects integration scope:

https://gerrit.onap.org/r/c/oom/+/121693

ongoing

Vijay to update Jira tickets with comments on exception request justifications.

SECCOM:  to include 2 additional repos with microservices in the SCA analysis output- done. 












To be further discussed:


Software BOMs - Muddasar

Atomic level to be explored for ONAP  - major ONAP modules, OSes, DBs etc. And how to move on with the upgrade. What should be the smalled unit of tracking for software upgrade. Track it to the level where operator may take actions.

Source of details:

https://logs.onap.org/onap-integration/weekly/onap_weekly_pod4_master/2021-06/28_21-34/security/tern/index.html

We should be able to look into the individual software components which form the package.

Tony will search for a reference from CI Badging for SBOM format.

ongoingTo be further discussed.

Jenkins, Gerrit and Sonar

Following the meeting held last week 2 tickets were opened to LFN IT support:

  • IT-22333 for using Confluence as a web server.
  • IT-22334 to describe sonar Jenkins template improvement.
ongoing

Last TSC meeting update

Critical Jira issue - explained to TSC by Tony

ongoing

PTLs meting updateongoing



OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 6th OF JULY'21. Continuation on atomic level of ONAP discussion.
  • Feedback on Byung's AAF Service Mesh proposal - Al Laing
  • Next steps for Infrastructure Logging Requirements – Bob
  • Software BOMs - Muddasar


Recording:

View file
name2021-06-29_SECCOM_week.mp4
height150

SECCOM presentation:

View file
name2021-06-29 ONAP Security Meeting - AgendaAndMinutes.pptx
height150