None available

CPS don’t have security requirements apart from the authentication on our rest API wherein username and passwords are configurable

Configuration Persistence Service Project#CPSSECURITYREQUIREMENTS

 Please add a statement about this to the end of your architecture document (or in another wiki page), with a heading such as "CPS Security Requirements."

Please refer to the latest ONAP architecture diagram.

London-R12 Architecture Diagram

Please elaborate this statement: "Usernames and passwords are configurable by the clients via configuring the application .yml file".

Expectation: passwords are not in yml file. The yml should point to user store (e.g. LDAP or K8s secrets). 

+1

CPS does not have a UI and does not use javascript

The application uses Swagger for RESTful API, wherein it is set that Authorization headers are required for accessing API documentation.

When CPS is run with docker, the services use usernames and passwords that are stored as environment variables.

While for testing purposes, all credentials are hard-coded, for deployments, CPS uses K8s secrets which are generated and stored as the application is deployed.

How are usernames and passwords stored?

Are passwords stored hashed where CPS acts as an authenticator?

Please refer to comment above in Documentation security.

As it is not part of the production: +1

CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. 

CPS service port names has been changed to include http in name.

CPS is compliant and compatible with the ongoing service mesh implementation (see https://gerrit.onap.org/r/c/oom/+/124287) for ONAP. 

CPS service port names has been changed to include http in name.