2025-04-02 Policy Weekly Meeting

ONAP DTF DAYs 2025

murali parthasarathy k will be leading the presentation for opa-pdp.

Projects were asked to check vulnerabilities periodically and fix critical CVEs within a month by the TSC.

Nexus Iq access requested for Wayne. - Pending approval. – still pending

Wayne Dunican

https://gerrit.onap.org/r/admin/repos/policy/opa-pdp,general

opa-pdp wiki : OPA PDP

Kevin has raised a request for sonatype scanning support for golang project. 

Request for adding Sonarqube scanner for Golang for project opa-pdp(IT-27801) – Sonar cloud config for Git hub action didn't work. Further reviews to be pushed. – Latest update from kevin added in the ticket. – Completed. 

SECCOM's decision is to try to fix all the reported vulnerabilities for opa-pdp as the sonatype doesn't support differentiating direct and transitive dependencies at the moment. – Need to check if all the dependencies can be updated from Nexus Iq. - All the versions are already latest. --No actions needed if the versions are already latest

Start looking in to Gold badging criteria for opa-pdp. - coverage is being worked on.

NexusIq still not showing direct and transitive dependencies for golang. – Ticket is still open with Kevin.

Adam Kenihan

guru raja

In progress.

Reproduced the issue. But its not impacting the workflow/cause any failures.

opa-pdp has implemented a retry mechanism to retry registration if pap doesn't respond. 

Adam to retry the testing with manual deploy/undeploy after the error occurs.  – issue occurs if pdp is restarted.

Restart pdp

Check for no listener error

Trigger the workflow.

PAP removing registered pdps after a certain period – Adheli is investigating the issue. 

Tested with apex, xacml and opa pdps in docker and helm. PDP was removed after missed heartbeats. But added back in PAP after the next heartbeat, workflow is fine later on. – Not seeing the same issue. 

Needs further investigation. – Require logs from opa-pdp deployment.