None available

CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable

Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS

 Please add a statement about this to the end of your architecture document (or in another wiki page), with a heading such as "CPS Security Requirements."

Please refer to the latest ONAP architecture diagram.

London-R12 Architecture Diagram

Please elaborate this statement: "Usernames and passwords are configurable by the clients via configuring the application .yml file".

Expectation: passwords are not in yml file. The yml should point to user store (e.g. LDAP or K8s secrets). 

Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS

CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable.

CPS has no logging of sensitive information such as usernames and passwords in plain text. The log files are only accesible withing the  authorized users of the application deployment.

CPS is in the process (as part of ONAP service mesh implementation) of migrating to service mesh, currently CPS application is fully-compatible with all the requirements, to provide encryption in transit to avoid unauthorized accesses and data breaches.

CPS does not run docker containers or services as 'root'.

Please add a statement about this to the end of your security requirements section/document. At a minimum, it should these statements to a new Security Assurance section just after: Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS. 

Also add statements that indicate how you protect your username and password configurations. (See other questions on hashing of secrets and , use of crypto and permissions on files.)Please addd those descriptions to Security Assurance section just after: Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS

CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. 

CPS service port names has been changed to include http in name.

CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. 

CPS service port names has been changed to include http in name.