2023-09-12 Security Subcommittee Meeting Notes

Oparent

Update from 2023-08-21 PTL meeting

-CPS (@Toine Siebelink): will test building CPS without oparent/pom.xml (results 2023-10-01)

-Integration (@Marek Szwałkiewicz): will perform a test build with the profiles commented out

2023-08-15 SECCOM notes

-Only 2 PTLs responded to Amy’s e-mail

-No objections on Oparent retirement, we have no volunteer to maintain it up to date

-pom.xml contains more than cross project common package dependencies

2023-09-05 SECCOM notes

-Pawel to contact @Marek Szwałkiewicz 

-@Toine Siebelink will provide feedback in early October

-decision on path forward - potentially remove package info - deferred to October

Main problem with testing changes in Oparent it is not possible as it is imported and used in build time and not in run time.

We need to find someone who will upgrade versions in Oparent file. Liam to be contacted for that.

Recommendation:

-retain oparent/pom.xml

-Make Andreas Geissler a committer and ask the integration or OOM team to update the file per release

-Proposal:

• Option 1 (short term): ask the integration or OOM team to update the file per release

• Option 2 (long term): split into multiple pieces that could be independently maintained: dependencies, build directives, profiles

-Byung will discuss with Andreas and OOM team and report at 8/22 SECCOM (pushed to 8/29 SECCOM meeting)

-Amy will contact @Liam Fallon  and Pam for history

• Pawel to contact Liam and check if he could update Oparent.

AAF Certificate Expiration

AAF-1217: AAF cert service failed to start (expired certificate)In Progress

Review work around proposed by @Andreas Geißler - deferred until @Andreas Geißler returns from holiday

Louis Gamers' AAF cert wiki page: (1) Create AAF CA certificates - Developer Wiki - Confluence (onap.org)

• Components such as dcaegen2 have their own cert init container with the aaf certificate embedded in the container image. This might be the reason why SO, SDC, and CDS broke if they have their own cert init containers.

• Unclear why onap-aaf-sms-preload and onap-dmaap-bc-dmaap-provisioning jobs broke in Louis's environment.

Container Signing

Review next steps:

-select signing software (SECCOM + LFIT)

-perform POC with friendly projects (ONAP)

-integrate into build process (LFIT)

Looking for a volunteering project to work with us. Request raised at the last PTL's call but no volunteer so far.

No PTL for AAI, DCAE, OOF

-Andreas Geissler and Thomas Kulik made committers

-They will do the work necessary for the projects to participate in the release

-TSC approved streamlining process (7 September)

-SECCOM will create package upgrade recommendations

-TSC will recruit resources to perform upgrades for AAI, DCAE, OOF

-Byung will discuss with Andreas and Thomas to coordinate release tasks such as backlog prioritization

-Muddasar: someone needs to take backlog management role

-Muddasar: no mandated best practice to manage technical debt; call for a statement about code quality – all code will be secure

-Muddasar & Amy: bring mandate for code quality to LFN TAC 2023/8/16

• Pawel to raise a request to TSC with getting resources for upgrades for AAI, DCAE, OOF

ONAP Streamlining

-TSC approved streamlining (7 September)

-Prioritization of vulnerability fixes (see above)

-Prioritization of security enhancements

-Proposal: ONAP projects work with latest version of common components such as Istio, KeyCloak, Kafka

ONAP Streamlining - The Process (Link)

Deck shared with TSC: ONAP - Streamlining the process Report-2023-8-3-v2.pptx (live.com)

Byung shared latest deck presented at last TSC, proposal was approved by TSC.

TSC makes also decisions on resources. List of TSCroles is not exhaustive.

We need to start working on packages upgrade recommendations - Amy's team will support us.

Dan mentionned at the last PTL's meeting that ODL synch is already done for Montreal release. Soon expected some synch meeting with ODL.

TSC meeting (September 7th)

LFN-TAC (September 13th)

Any SECCOM recommendations for the TAC

NEXT SECCOM MEETING CALL WILL BE HELD ON 19th of September 2023.