Attendee-List:

• @Andreas Geißler 

• @Viresh Navalli

Agenda

Video:

Today's topic:

• Check Versions: https://lf-onap.atlassian.net/wiki/spaces/DW/pages/16415999/Database+Java+Python+Docker+Kubernetes+and+Image+Versions

• Testing environment disrupted by connection problems between DT and CogentCo

  • Found a temporary workarround for xtesting images

  • Ticket raised to LFN: https://jira.linuxfoundation.org/plugins/servlet/desk/portal/2/IT-27443

  •  

• PM usecases require DCAE components (@Viresh Navalli ):

  • datafile-collector

  • pm-mapper

  • DFC uses:

    • DMAAP message-router

    • DMAAP data-router

  • Problem:

    • DMAAP is deprecated and unmaintained and DCAE components are not deployed because of the DMaaP removal

  • possible solution

    • DFC uses Kafka-native connection (as e.g. VES-collector), example: https://git.onap.org/dcaegen2/collectors/ves/commit/?id=47195e4ac559963cd33dc155f219bd2b127ef025

    • data-router replacement or reactivation of DMaaP DR (or add DR to DCAE)

  • I take it to the TSC

• New SDNC patch (https://gerrit.onap.org/r/c/oom/+/139164) tests started, Sanket tests SO changes

  • Need a fix for the Java Memory (sdnc pod)

  • Need update of PythonSDK/Xtesting images for RFC8040 interface usage (ToDo Michal)

  • Update Robot testcases for Biermann interface removal - Ongoing

  • Test SO config changes - Ongoing

• @Marek Szwałkiewicz Try to establish an ArgoCD deployment to provide an alternative the helm deloyment

  • in oom chart provide directory for ArgoCD application definitions

  • Will be used in Gating/Daily Pipelines

  • Fixes needed for Docker image build jobs: →
    https://jenkins.onap.org/view/integration/job/integration-xtesting-smoke-usecases-robot-docker-merge-master/, https://jenkins.onap.org/view/integration/job/integration-xtesting-smoke-usecases-robot-py3-docker-merge-master/

• Update of Oslo Release info: Oslo Release Key Updates 

• Update Operators, Keycloak,…

  • Update component versions and documents

• Logging improvement proposal (TCL) @Mateusz Pilat 

  • All components have to log to STDOUT

  • They should use a common format (JSON struct) with defined attributes (example: https://git.onap.org/oom/tree/kubernetes/cps/components/cps-core/resources/config/logback-spring.xml)

  • A list will be provided for the required changes in components

  • Presentation next week in the TSC

• Hardening Istio with SPIRE/SPIFFE (https://blog.spiffe.io/hardening-istio-security-with-spire-d2f4f98f7a63) → need to check within DT
  Used in Nephio

  • see https://docs.google.com/presentation/d/1L79WrZ64Uar3IrH-jL_IeQTlPoLtXGZKHIIfVCXLoco/edit#slide=id.g2c18d699447_0_31

  • FYI, Service Mesh + SPIFFE infrastructure ongoing study in Nephio, Study: Nephio security collaboration study

  • There is a separate study in Nephio for workload registration and workload/node attestation, https://docs.google.com/presentation/d/1L79WrZ64Uar3IrH-jL_IeQTlPoLtXGZKHIIfVCXLoco/edit#slide=id.g2c18d699447_0_40

  • https://docs.google.com/document/d/1IwWVGASgdOuLHCHYg82WaZaHdOEXyOM1/edit?pli=1#heading=h.nzahaii2p80p

  • https://docs.google.com/presentation/d/1L79WrZ64Uar3IrH-jL_IeQTlPoLtXGZKHIIfVCXLoco/edit#slide=id.g2bd96dea01c_0_1

• Tata (@ematpil ) install ONAP Montreal/London and made improvements
  
  

  • will show improvements Tata did and might contribute to OOM

  • Presentation shown: (Platform Customization-oom v2.pptx) .

  • → Enhancements proposed:

    • Security enhancements (e.g. Keycloak/OAuthProxy, AuthorizationPolicy,...) eg: authentication.tar, oauth2 +KC research: rbac_research_wrap.pdf

    • Logging enhancements,...

Others:

• Change "bash" to "sh"

  • https://gerrit.onap.org/r/q/topic:bashisms

  • Started by Orange, but not finished

• Describe ONAP component deployment via ArgoCD

  • create "Application" config dir in oom repo ?

Open Jira issues:

Showing 20 out of 103 issues Refresh

Backlog from older meetings (to be cleaned up)

Pending component fixes:

(2023-05-03: No update)

• CDS-UI CCSDK-3814 - CDS-UI must be able to listen on HTTP Open → DT /TM has a look

  • maybe postpone to M

• SO Monitor SO-4027 - Make SO-Service-Monitor ServiceMesh compatible Open → Byung mentioned, that E/// team try to resolve the issue (Byung's note: It was assigned to Viresh Navalli, Capgemini. E/// plans to assist Viresh as needed.)
  → postpone to Montreal

• CLI will not work without fix... ( OOM-3096 - [CLI] Remove AAF dependency Delivered )

• UUI - not clear if working

  • MSB issue reported: MSB-755 - The route from the MSB module to the usecase-ui module does not support HTTP Closed (helong <hwx171157@163.com>)

Helm chart cleanup: OOM-2975 - Remove dependencies on AAF Open

(2023-05-10: No update)

• Common → Andreas

• Platform

• MSB

• VFC

Ingress enhancements for non-HTTP interfaces:

• External Kafka access → https://gerrit.onap.org/r/c/oom/+/133767

  • Doc: Test external Kafka access in London

• SDNC CallHome (SSH) → part of https://gerrit.onap.org/r/c/oom/+/133861

• Plan to update _ingress.tpl for Gateway-API support and AuthorizationPolicy

Oauth2-proxy setup (Andreas):

(2023-05-03: No update)

• Documentation: Oauth2-Proxy implementation and configuration

• Oauth2-Proxy: https://gerrit.onap.org/r/c/oom/+/130445

• Adding Oauth2-proxy client to ONAP realm: https://gerrit.onap.org/r/c/oom/+/133699

To be started:

(2023-05-03: No update)

• Ingress template improvements:

  • OOM-3108 - Investigate to change to K8S Gateway-API Open

  • OOM-3075 - Extend the Ingress template and add Component ingress configuration Open

• Remove unused components:

  • OOM-3074 - Remove components and options from charts Open

• MariaDB:

  • OOM-3072 - Resolve and improve the existing MariaDB-Galera templates Open → DT (with TM) to investigate

• Remove NodePort in Ingress environments:

  • OOM-3012 - Remove NodePort in Service definitions under ServiceMesh In Progress → will be automatically fixed with cleanups

• UDP Ingress support:

  • UDP Nodeport support in _service-tpl OOM-3107 - Allow NodePorts for UDP services Open → can be closed

  • Possible solution: UDPRoute support in Gatway-API

Others:

(2023-05-03: No update)

• SDC Listener HTTP issue SDC-4233 - SDC Distribution Client should work with lower-case Header entries Closed → Marek provided patch → merged, need to be released and can be used in the clients

  • When released, all clients need to be updated (CDS, AAI, Policy, SO, ...)

  • Create tickets for all clients....

2023-05-31:  Discussed presentation to TSC/PTL meeting proposing a new global requirement to rely (exclusively) on service mesh mechanisms for intra-ONAP authentication and authorization (get rid of HTTP basic auth).  To be presented to TSC on 2023-06-01.