Attendee-List:

• @Andreas Geißler 

• @Jack Lucas 

• @Byung-Woo Jun 

• @Andrew Lamb 

• ccteng

• Louis Li

• @N.K. Shankaranarayanan 

Agenda

Video:

Open

Today's topic:

• Currently problems in Gating (Azure cluster) → manually started in DT lab

• DB Updates:

  • Fixes for Cassandra Operator

  • Fixes for MariaDB Operator (new version)

  • New support for Postgres (https://gerrit.onap.org/r/c/oom/+/136179)

  • B&R for MDB, Cassandra

• @Byung-Woo Jun presents his draft presentation for the DDF in Budapest:
  
  

  • https://wiki.lfnetworking.org/display/LN/2023-11+-+ONAP%3A+ONAP+Streamlining+Evolution+-+Security+Enhancements+and+Strategy+for+NF+Security

  • https://wiki.lfnetworking.org/display/LN/2023-11+-+ONAP%3A+ONAP+Streamlining+Evolution+-+for+individual+ONAP+component+build+and+deployment+thru+CD 

  • Recording of SECCOM presentation: https://lf-onap.atlassian.net/wiki/download/attachments/16524308/2023-10-03_SECCOM_week.mp4?version=1&modificationDate=1696955536000&api=v2

• @Jack Lucas Looking into the SNMP trap collector

  • Remove MR dependency

  • UDP support requires the activation of the Gateway-API and UDPRoute creation

  • Gateway-API UPD support might require Update of Istio and K8S version

Current activities:

• @vladimir turok Patch for CPU limits:

  • https://gerrit.onap.org/r/c/oom/+/135863 → need to check the gating results

• AAF Certificate Fix (< London)

  •  Notes: Create AAF CA certificates

  • 1st patch: https://gerrit.onap.org/r/c/oom/+/135975?usp=search
    
    

    • asked stakeholders to check the results in their labs → If OK, we try to merge it for Kohn

• DB Update (Cassandra, MariaDB,...) OOM-3183: Update the Cassandra, MariaDB, Postgres chartsClosed

  • MariaDB-Operator in progress (https://gerrit.onap.org/r/c/oom/+/135759)

    • Merged

  • Issues found in Daily:

    • Maybe problems with Istio 1.18 (Peer Authentication for port 3306)

• Reminder: DCAE SNMP trap collector patch for Ingress route !

• Reminder: contact InfoSys !!

• SDNC:

  • https://gerrit.onap.org/r/c/oom/+/135308 [SDNC] Change SDNR DB from elasticsearch to maria DB → need to be checked

  • @alexander.dehn Question if cmpV2 support is discontinued ?

Old activities:

• Request to add RAN simulator chart to OOM (@Vishal Varvate )

  • Question: 

    • Should we separate the ONAP testing component charts ? (OOM-3085: [TEST] Move test components out of main chartReopened)

    • → Proposed to add the charts to Integration repo → reply from Vishal

      • Thank you Marek and Andreas for your reply.
        Yes, I see integration repo is having all the simulator charts ,so for consistency purpose,  we can add the ran sim chart on  the integration repo ,that’s also ok for us.
        @N. K. Shankar,  Any comment if you want to add.

• S2S Authorization (OOM-3191: Service 2 Service Authorization with Service MeshOpen):

  • InfoSys support (check with @Girish Kumar )

  • SO, AAI analyzed and discussions will be started

  • Presentation: https://lf-onap.atlassian.net/wiki/download/attachments/16521422/Service_Mesh_Basic_Auth_Elimination_Analysis.pdf?api=v2 

  • Seshu will be contacted to discuss the SO changes (roles/users,,...)

  • SDC will be contacted by @Andreas Geißler and Portal Team

  • Jira tasks are created under OOM-3191: Service 2 Service Authorization with Service MeshOpen

• Urgent issue with AAF certificate expire:
  
  

  • AAF-1217: AAF cert service failed to start (expired certificate)In Progress

  • https://lists.onap.org/g/onap-discuss/topic/certificates_retrieval/100888379?p=,,,20,0,0,0::recentpostdate/sticky,,,20,2,0,100888379,previd%3D9223372036854775807,nextid%3D1688663764978684781&previd=9223372036854775807&nextid=1688663764978684781

  • Problem: 

    • no description available to re-generate the CA certitficate or how to extend its expiry date

    • Files:

      • https://git.onap.org/oom/tree/kubernetes/common/cert-wrapper/resources?h=kohn

      • https://git.onap.org/oom/tree/kubernetes/aaf/components/aaf-sms/resources/certs?h=kohn

• ONAP streamlining 

  • new charts: https://jira.onap.org/secure/attachment/18969/ONAP%20-%20Streamlining%20the%20process%20Report-2023-9-7-v1.pptx 

  • Jira tickets will be added to the different components

  • need to check with @Thomas Kulik about documentation versioning

• External ONAP Access using Authentication OOM-3192: External ONAP Access using AuthenticationClosed

  • Patch for _ingress.tpl to add "AuthorizationPolicy"

  • Test it with SDC FE

• Adding charts for portal-ng

  • Planned for the next week (@Fiete Ostkamp )

• Helm Chart Updates OOM-3082: Helmchart updatesOpen

  • Added some tasks 

    • OOM-3208: Improve Helm Chart VerifiicationOpen Improve Helm Chart Verification

    • OOM-3227: Make charts ready for a Namespace changeOpen Make charts ready for a Namespace change

• Others:

  • Should we separate the ONAP testing component charts ?

  • Resource Limits correction @vladimir turok 

    • to be checked, whether CPU limits should be used again (https://gerrit.onap.org/r/c/oom/+/135433)

  • MessageRouter removal (to be checked with @Fiachra Corcoran 
    
    
    

  • Should we add charts for ONAP-Base (strimzi, keycloak,...) ?

Open Jira issues:

Showing 20 out of 103 issues Refresh

Backlog from older meetings (to be cleaned up)

Pending component fixes:

(2023-05-03: No update)

• CDS-UI CCSDK-3814 - CDS-UI must be able to listen on HTTP Open → DT /TM has a look

  • maybe postpone to M

• SO Monitor SO-4027 - Make SO-Service-Monitor ServiceMesh compatible Open → Byung mentioned, that E/// team try to resolve the issue (Byung's note: It was assigned to Viresh Navalli, Capgemini. E/// plans to assist Viresh as needed.)
  → postpone to Montreal

• CLI will not work without fix... ( OOM-3096 - [CLI] Remove AAF dependency Delivered )

• UUI - not clear if working

  • MSB issue reported: MSB-755 - The route from the MSB module to the usecase-ui module does not support HTTP Closed (helong <hwx171157@163.com>)

Helm chart cleanup: OOM-2975 - Remove dependencies on AAF Open

(2023-05-10: No update)

• Common → Andreas

• Platform

• MSB

• VFC

Ingress enhancements for non-HTTP interfaces:

• External Kafka access → https://gerrit.onap.org/r/c/oom/+/133767

  • Doc: Test external Kafka access in London

• SDNC CallHome (SSH) → part of https://gerrit.onap.org/r/c/oom/+/133861

• Plan to update _ingress.tpl for Gateway-API support and AuthorizationPolicy

Oauth2-proxy setup (Andreas):

(2023-05-03: No update)

• Documentation: Oauth2-Proxy implementation and configuration

• Oauth2-Proxy: https://gerrit.onap.org/r/c/oom/+/130445

• Adding Oauth2-proxy client to ONAP realm: https://gerrit.onap.org/r/c/oom/+/133699

To be started:

(2023-05-03: No update)

• Ingress template improvements:

  • OOM-3108 - Investigate to change to K8S Gateway-API Open

  • OOM-3075 - Extend the Ingress template and add Component ingress configuration Open

• Remove unused components:

  • OOM-3074 - Remove components and options from charts Open

• MariaDB:

  • OOM-3072 - Resolve and improve the existing MariaDB-Galera templates Open → DT (with TM) to investigate

• Remove NodePort in Ingress environments:

  • OOM-3012 - Remove NodePort in Service definitions under ServiceMesh In Progress → will be automatically fixed with cleanups

• UDP Ingress support:

  • UDP Nodeport support in _service-tpl OOM-3107 - Allow NodePorts for UDP services Open → can be closed

  • Possible solution: UDPRoute support in Gatway-API

Others:

(2023-05-03: No update)

• SDC Listener HTTP issue SDC-4233 - SDC Distribution Client should work with lower-case Header entries Closed → Marek provided patch → merged, need to be released and can be used in the clients

  • When released, all clients need to be updated (CDS, AAI, Policy, SO, ...)

  • Create tickets for all clients....

2023-05-31:  Discussed presentation to TSC/PTL meeting proposing a new global requirement to rely (exclusively) on service mesh mechanisms for intra-ONAP authentication and authorization (get rid of HTTP basic auth).  To be presented to TSC on 2023-06-01.