...
| Jira No | Summary | Description | Status | Solution | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Logging update based on Tata Communication | How ONAP is used in their production environment. They use logging aggregation (Logstash). There is collaboration oportunity for PoC. Byung presented differences between generic ONAP and Tata Communication. They use syslog for metrics and Logstash for logs aggregation. We are not using sidecar while Tata is using it. In our reference architecture we separate generation from aggregation. Removing Filebit implementation is for London release. Folo logging architecture there is no Best Practice yet. PoC shall be satisfying first. | ongoing | Bob to send information on Byung who are the key players. Details to be discussed next week. | |||||||||||||
| SBOM status update | Ongoing escalation with Ranny, Jess close to complete SBOM with CPS | ongoing | ||||||||||||||
| 5G security | Security was not explicitly stated in ONAP but some features are part of the implementation. | Waiver Analysis | Waiver analysis was reviewed.
| Pawel to check formatting for versions_xfail.txt and Jakarta - checked it is ok. Specific tickets to be opened for projectsManaging network function, policy to pickup a new version and automatically spin up new VNF or CNF this new version and get rid of old xNF that was running. At the design time we want to deploy 5G core, ONAP would have to create some artifacts in K8s, we shall confirm if ONAP could be used also as security orchestrator (policy language should be rich enough to do that). Shall we address it with Use Case Subcommittee? Helping implementing secure slices would be important in configuration examples, templates etc. | Try to follow up, as Muddasar partcipates in the 5G meetings. | |||||||||||
| Centos version | Was updated by Amy, thank you Maggie for sharing info and links. | CentoS 9-stream is not yet released. | ||||||||||||||
| Service Mesh | Byung is working on it - it is a prioritized topic for him. Andrew is working on it. Once deplouyed, we will move avway from AAF. then Authentication and Authorization policy. | |||||||||||||||
| OpenSSF recommedation | How to operationalize it? LF IT needs to make those capabilites available like in Marketplace. It is important to allign OpenSSF recommendations with the budget, resources and deployment activities on LF IT side. | |||||||||||||||
| Next LFN events | ONE Summit NARegistration Open
LFN Developer & Testing Forum NARegistration Open
| Proposals to be submitted. David to be was contacted and invited by Maggie to SECCOM meeting. | Update on Jakarta release | TSC approved the sign off of the Jakarta release on June 30th Security tests results at 60%: https://logs.onap.org/onap-integration/daily/onap-daily-dt-oom-jakarta/2022-06/30_04-01/ https://wiki.onap.org/display/DW/Jakarta%3A++Lessons+Learned | SBOM status update | Muddasar contacted with several PTLs and waiting for their feedback. | We need LF IT support, GB was informed by Amy. We ned to run SBOM in the pipeline. Amy to talk to Kenny, Muddasar and Ranny. | Technical debt | Muddasar reviewed Jira tickets recently. Some PTLs are using TechnicalDebt tagging and some not at all. Grooming the tickets would be helpful. Updating packages is technical debt for us. | OSA branch | WE have not had any vulnerability raised within the process, so nothing to be added in OSA for Jakarta release. | Thomas to be contacted during unmaintained meeting on Monday. | Last SECCOM meeting link | 2022-06-28 Security Subcommittee Meeting Notes | ||
| DevOPS Pipelines IRS presentation | Youtube link disappears ;-( | |||||||||||||||
SECCOM MEETING CALL WILL BE HELD ON 19th OF July'22. | Potentially session Session with David Wheeler on SBOM. logging implementation discussion continuation. |
...
| View file | ||||
|---|---|---|---|---|
|
SECCOM presentation:
| View file | ||||
|---|---|---|---|---|
|