...
| Jira No | Summary | Description | Status | Solution | Open items from 6/21
| ongoing | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Jakarta status | Release approval waiting for input from CLI about the failed nodeport test: port 30271 refusing a connection ( Waiver Analysis | Waiver analysis was reviewed.
| Pawel to check formatting for versions_xfail.txt and Jakarta - checked it is ok. Specific tickets to be opened for projects. | ||||||||||||||||||||||||||||||||||
| Next LFN events | ONE Summit NARegistration Open
LFN Developer & Testing Forum NARegistration Open
| Proposals to be submitted. David to be contacted and invited by Maggie to SECCOM meeting. | |||||||||||||||||||||||||||||||||||
Update on Jakarta release | TSC approved the sign off of the Jakarta release on June 30th Security tests results at 60%: https://logs.onap.org/onap-integration/daily/onap _daily_pod4_master-daily-dt-oom-jakarta/2022-06/ 2405-56/infrastructure-healthcheck/k8s/nodeport_check_certs/certificates.html) | ongoing | Kohn status | Package upgrade tickets created for each project and set to block REQ-1211 Infrastructure recommendations at Database, Java, Python, Docker, Kubernetes, and Image Versions | ongoing | MITRE FiGHT | Muddasar presented MITRE FiGHT framework | complete |
| SBOM | Ongoing issue with SBOM - Muddasar Muddasar contacted CPS, A&AI and SDNC to as them to try adding SBOM creation to their Jenkins jobs. Issue with the repo structure - LFIT/LFDEV has not yet delivered a solution. | ongoing | Governance board to be escalated to for SBOM and LF IT proper focus. Ranny was contatced by e-mail as a follow-up of DTF discussion. | Last TSC June 23rd | Sign-off pushed to 27th of June PTL call. CLI nodeport failure. Conditional approval of Kohn M1 Ongoing SBOM creation issue - Muddasar to follow up with PTLs, LFIT and Ranny Haiby Nominations for new LFNGB committer delegate underway. Candidate cannot be from ONAP this year. | Logging Global Requirement | Promoting Logging Best Practice to Global Requirement - Bob | Bob will follow process: present GR proposal to PTLs for feedback, then request approval to make it a CR for London. | Tata Communications production logging implementation | Overview of Tata Communications DTF presentation on their production logging implementation – Bob [move to 7/12] https://wiki.lfnetworking.org/display/LN/2022-06-DD+-+ONAP%3A+The+Path+to+a+Production-Grade+ONAP | Bob to present on 7/12 | Waivers review between releases | started | To be completed for remaining categories by Pawel - done Review on 7/1 | Synch with OOM: |
| Overview of Tata communication Logging solution | Older ONAP version used. https://lf-onap.atlassian.net/wiki/display/DW/Jakarta%3A++Lessons+Learned | |||||||||
| SBOM status update | Muddasar contacted with several PTLs and waiting for their feedback. | We need LF IT support, GB was informed by Amy. We ned to run SBOM in the pipeline. Amy to talk to Kenny, Muddasar and Ranny. | |||||||||||||||||||||||||||||||||||
| Technical debt | Muddasar reviewed Jira tickets recently. Some PTLs are using TechnicalDebt tagging and some not at all. Grooming the tickets would be helpful. Updating packages is technical debt for us. | ||||||||||||||||||||||||||||||||||||
| OSA branch | WE have not had any vulnerability raised within the process, so nothing to be added in OSA for Jakarta release. | Thomas to be contacted during unmaintained meeting on Monday. | |||||||||||||||||||||||||||||||||||
| Last SECCOM meeting link | 2022-06-28 Security Subcommittee Meeting Notes | ||||||||||||||||||||||||||||||||||||
| DevOPS Pipelines IRS presentation | Youtube link disappears ;-( | ||||||||||||||||||||||||||||||||||||
SECCOM MEETING CALL WILL BE HELD ON 12th OF July'22. | Potentially session with David Wheeler on SBOM. Overview of Tata Communications DTF presentation on their production logging implementation, https://wiki.lfnetworking.org/display/LN/2022-06-DD+-+ONAP%3A+The+Path+to+a+Production-Grade+ONAP | To be shared what we are doing with them. | Whitesource (mend.io) container scans | New ticket submitted to LFN IT: IT-24112 - Jess was asked for an update. | ongoing | Technical debt | PTLs to be consulted. to know how PTL thinks when looking at Jira tickets. Vijay will be on PTO for next 2 weeks, so it will not be DCAE, AAI under consideration. | ongoing | Ask at the next PTLs meeting for volunteering PTLs. Amy and Muddasar to synch each other on that. | Automation for dependency management | https://github.blog/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot/ | SECCOM MEETING CALL WILL BE HELD ON 5th OF July'22. | 15 minutes for Muddasar to present 5G security. - see the "Logs and Metrics: Architecture" and "Monitoring and Troubleshooting" sections |
Recording:
| View file | ||||
|---|---|---|---|---|
|
SECCOM presentation:
| View file | ||||
|---|---|---|---|---|
|