30 mins

Cross-project discussion

• This meeting is reduced to 30 minutes

• Rotating host

  • volunteer for this week: @Paweł Pawlak  / @Byung-Woo Jun 

RelEng/Infrastructure

@Jessica Gonzalez @Paweł Pawlak 

@Byung-Woo Jun 

Oslo Release update

@Byung-Woo Jun 

@Paweł Pawlak 

• Oslo related Wiki under creation by Byung, Release Planning: Oslo

• Project Status in Oslo Release

• Oslo Release Key Updates,  thanks PTL, consider it is done

• The Architecture diagram for Oslo, Oslo-R15 Architecture Diagram; new diagram

• Oslo Architecture main wiki pages, Oslo-R15 Architecture/ArchCom Wiki Page ; see its sub directories for project architecture pages

• O-parent removal from Oslo??

  • Ericsson presented their O-parent removal experience to the TSC meeting

  • See Adheli's Removal of O-Parent from Policy, Removal of O-Parent from Policy 

  • Each PTL needs to open a Jira ticket for O-Parent removal from their projects

  • This issue will be deferred to the next release

• @Thomas Kulik , any update ? @Fiete Ostkamp , worked on SDC for outdated Ruby - will update...

  • @Fiete Ostkamp , WIP; Is it done?

• @Dong Wang (China Telecom) presented the China Telecom's vision for Oslo to the TSC last Thursday, 

  • Recommendation for LFN,ONAP Evolution.pdf

  • @Keguang He , Large Model Capability Exposure and Application Development Based on MaaS (Model as a Service).pdf

Doc 

@Byung-Woo Jun 

• ONAP Streamlining Documentation Enhancements for Oslo:

  • Defining ONAP Core components and extensions (e.g., lightweight ONAP, optional components)

  • Core component functions

  • Installation guide, including ArgoCD-based deployment options

  • configuration guide

  • User guide 

  • Use cases by operators and vendors

  • reference architecture (component, interface, security, function...) for lightweight ONAP

• PTLs will be contacted for their help as needed.

• @Byung-Woo Jun , started the documentation for ONAP Streamlining here, ONAP Streamlining Evolution; WIP; target date: end of October

OOM 

@Andreas Geißler 

• An ArgoCD deployment to provide an alternative the helm deployment. @Marek Szwałkiewicz , @Andreas Geißler , DT is working on it.; will decide where DT applies..

• 2 images failing on smoke tests - Marek is working on it.  For TSC meeting voting for Python 2 dependencies removal.

  • Voting for Python 2 dependencies removal from ONAP. - not valid anymore

    
    
    

  • @Andreas Geißler , will check with Marek and let us know...

  • @Marek Szwałkiewicz , WIP; Matt needs a ticket for a check; update next week

Policy

@Ramesh Murugan Iyer 

• Any update on the Policy Framework Gold Badging process?

• Almost there; needs 90% code coverage, exception policy-apex-pdp 84.4%; needs merge to increase it to above 90%

• https://sonarcloud.io/organizations/onap/projects?search=policy 

Update Jiras

Oslo Package

@Amy Zwarico 

@Paweł Pawlak 

Oslo task: [REQ-1592] PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR OSLO RELEASE - ONAP JIRA

Epic: https://jira.onap.org/browse/REQ-439

AAI: [AAI-3941] AAI PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR NEW DELHI RELEASE - ONAP JIRA

CCSDK: [CCSDK-4042] CCSDK PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR NEW DELHI RELEASE - ONAP JIRA

CPS: [CPS-2342] CPS PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR NEW DELHI RELEASE - ONAP JIRA

DCAE: [DCAEGEN2-3414] DCAE PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR OSLO RELEASE - ONAP JIRA

Multicloud: [MULTICLOUD-1507] MULTICLOUD PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR OSLO RELEASE - ONAP JIRA

Network Controller: [SDNC-1844] NETWORK CONTROLLER PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR OSLO RELEASE - ONAP JIRA

Policy: [POLICY-5103] POLICY PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR NEW DELHI RELEASE - ONAP JIRA

PortalNG: [PORTALNG-114] PORTALNG PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR OSLO RELEASE - ONAP JIRA

SDC: [SDC-4690] SDC PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR OSLO RELEASE - ONAP JIRA

SO: [SO-4130] SO PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR OSLO RELEASE - ONAP JIRA

UsecaseUI: [USECASEUI-840] UUI PACKAGES UPGRADES IN DIRECT DEPENDENCIES FOR OSLO RELEASE - ONAP JIRA

@Matt Watkins , will update next week

@Fiete Ostkamp , is there any automated tool for dependency checking from Gerrit? Matthew will provide its update. Matt/kevin will check; may use portal-ng as a test project/candidate; Fieta will a LF IT ticket toward Matt/Kevin. 

LF IT Support

@Paweł Pawlak @Jessica Gonzalez 

Open Source Security / SECCOM

@Byung-Woo Jun @Paweł Pawlak 

CISA report on memory safe code: 

• joint-guidance-exploring-memory-safety-in-critical-open-source-projects-508c.pdf, 

• The-Case-for-Memory-Safe-Roadmaps-508c.pdf
  
  

  
  
  

• Maggie (NSA; SECCOM) forwarded the NIST special publication on Service Mesh Proxy Models for Cloud-Native Applications. It is pretty good documentation on Service Mesh, Threat analysis and recommendations, https://csrc.nist.gov/pubs/sp/800/233/ipd , https://doi.org/10.6028/NIST.SP.800-233.ipd

• 2 actions:

  1. OpenSSF- add/update their guidelines; Tony - Tony will check with OpenSSF ; tony is waiting for their response

  2. Locally for ONAP: impact assessment and reviewing if there are opportunities to remove those languages.

• Added memory safe code guidance to the architecture security review template, ONAP Component Architecture Review Template. PTL, please take a look at it.

Istio Ambient Mode will be GAed in November 2024, according to Solo.io

Testing Environment

Testing Improvement

CSIT Review

ToolChain Improvement

Documentation

Other Improvement suggestion

@Andreas Geißler  @Dan Timoney 

Plan to migrate ONAP components to use RFC8040. and will Keep the New Delhi CCSDK/SDNC as LTS (long term support) for Biermann APIs. In Oslo, only RFC8040 will be supported.

@Dan Timoney, reviewed the above CCSDK/SDNC plan with ARCCOM and ARCCOM approved it.

• SDNC and SO decided to move it to Oslo.

----

According to Dan,

Our original plan had been to migrate to the OpenDaylight Potassium release in New Delhi and to retire the Biermann API at that time.  We were not able to complete those upgrades in time for the New Delhi release, so we ended up remaining on OpenDaylight Argon release with our Biermann adaptor.

For Oslo,  our plan is to:

1. Complete the upgrade to Potassium originally planned for New Delhi. This work is almost complete – I expect to finish within the next week or so.

2. Complete the work needed to migrate our internal interfaces from the Bierman format to RFC 8040.

3. If time permits,  upgrade to OpenDaylight Calcium release. 

We have been advised that the OpenDaylight Calcium release is a major upgrade, with a significant amount of breaking changes.  So, I would say there is significant risk that the Calcium upgrade might not complete in time for Oslo.  My plan would be that we would release an initial Oslo version of CCSDK and SDNC that is based on OpenDaylight Potassium release to OOM as soon as it is a available so that we avoid a last minute impact.  Once that is complete, I’ll create our oslo branches and use our master branch to begin work on the Calcium port. If that port is completed in time to make Oslo, great – we’ll cherry pick it to the oslo branch and include it.  If not, then our Oslo code base remains stable on Potassium and the Calcium port will complete in the Paris release.

One more word on releases: my plan going forward is that the New Delhi release will be considered a “long term support” (LTS) release for CCSDK and SDNC.  That is to say, we’ll provide security updates and other critical fixes as needed for that release so that any clients that find themselves unable to migrate to RFC 8040 for whatever reason will still have support, with the understanding that they will remain on the OpenDaylight Argon release.

@Dan Timoney , is working on this to remove Biermann API; he will update its status. Once it is done, please let the SO team (Sankar) know. Thanks.

• Potassium upgrade is almost completed by Dan to be followed by Calcium upgrade (current ODL version)

@Andreas Geißler wiil check with Sankar (SO) if he can use the client library. 

Subcommittee Updates for PTLs

@Paweł Pawlak 

@Amy Zwarico 

1. Recommended packages upgrades are available on the restricted Wiki. Jiras to be created per project. 

   Oslo Package Updates

   Need to check NG Portal status CLM jobs. Any update?

 - no solution for now:

List of the ONAP components to be disabled prepared by Andreas: 

OOM New Delhi Release

On April 18th, TSC approved the list.

Ticket opened by Fiete for UI CLM scan: https://jira.linuxfoundation.org/plugins/servlet/desk/portal/2/IT-26882 - not a maven based project - an issue? To be further elaborated with Jess.

@Fiete Ostkamp , SECCOM-276: Setup scanning jobs for portal-ng-uiClosedPreview.

@Matt Watkins , will follow up. Please let us know the outcome. 

• This is the Nexus IQ/Sonartype Lifecycle ticket Ref: https://jira.linuxfoundation.org/plugins/servlet/desk/portal/2/IT-27251

• Here is the scan result: https://nexus-iq.wl.linuxfoundation.org/assets/index.html#/applicationReport/onap-portal-ng-ui/28f50ec63db94687a0556a343940e14f/policy

• WIP; Fiete has scans, Matthew is working on; maybe in 2 weeks, the issue can be resolved.

Sharing Best Practices

Technical debt

@Fiete Ostkamp 

Chef dependency in SDC related to Ruby conflict (2.0 is pretty old)  SDC-4691: catalog-be docker build is failing due to ruby dependency conflictOpenPreview

• WIP

IaC scans

@Paweł Pawlak 

@Byung-Woo Jun 

Reference: https://www.checkov.io/1.Welcome/What%20is%20Checkov.html

• @Jessica Gonzalez , started the IaC scan with CPS, https://github.com/onap/cps/actions/runs/11040721512/job/30669364326

• SECCOM and Nephio SIG Security teams plan to discuss the basseline and/or best practices

Others

@Paweł Pawlak 

ONAP Licensing scans: https://lfscanning.org/reports/onap/onap-2024-06-0592bdfc-78a5-4fa8-a9fd-a7de581457ec.html

ARCCOM review

@Byung-Woo Jun 

@Dan Timoney 

• Done; ARCCOM approved it

• ARCCOM review tomorrow (October 1st) for CCSDK/SDN. Please join us.

  • Briefly, the issue is that there are differences between the version of the RESTCONF interface that was originally defined in the Internet Draft written by Biermann et al, and the version that was officially defined in RFC 8040.  These differences, unfortunately, are not backwards compatible.  For a while, OpenDaylight supported both versions, but at this point OpenDaylight no longer supports the Biermann variant. 

    We mitigated that issue within ONAP by taking a copy of the OpenDaylight code for the Biermann version and maintaining it ourselves.  The agreement was that this was a temporary solution only, which would be phased out. 

    
    
    

    Our  plan in CCSDK/SDN is as follows:

    
    
    

    1. New Delhi will be the last release in which both versions of the RESTCONF interface (Biermann and RFC 8040) are supported.  We plan to treat New Delhi as a Long Term Support (LTS) release, and will provide security patches as needed so that users that are unable to migrate to RFC 8040 are not left without a supported release.

    2. Starting with Oslo, only the RFC 8040 version of RESTCONF will be included in our CCSDK and SDNC packages.

    
    
    

    Since the removal of the Biermann interface is a fairly significant, breaking change, I am proposing that – consistent with semantic versioning – both CCSDK and SDNC will change major versions in Oslo.  CCSDK artifacts for Oslo will be numbered 2.0.x, and SDNC artifacts will be numbered 3.0.x.

IF TIME ALLOWS ....

15 mins

Release status

5 mins

Upcoming Events

• No LFN DTF this year

• Open Source Summit Europe, 16-18 September, Vienna, Austria,  

  • @Byung-Woo Jun: : Open Source Summit Europe 2024, Sylva, SOSS and CD event summary, https://lf-onap.atlassian.net/wiki/download/attachments/16220162/OpenSourceSummitOthersReport-2024.pdf?version=1&modificationDate=1727820665375&cacheVersion=1&api=v2

• Kubecon and CloudNativeCon North America 2024 (November 12-15), https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/?utm_source=google&utm_medium=paid-search&utm_campaign=kubecon-na-2024&utm_term=events-kubecon-na-2024-cncf&utm_content=kubecon-na_rsa&campaignid=21541954784&adgroupid=166431838780&creative=708046449585&matchtype=e&network=g&device=c&keyword=kubecon%202024&utm_term=kubecon%202024&utm_campaign=Events+-+KubeCon+NA+2024+-+CNCF&utm_source=google&utm_medium=ppc&hsa_acc=8666746580&hsa_cam=21541954784&hsa_grp=166431838780&hsa_ad=708046449585&hsa_src=g&hsa_tgt=aud-2235032889006:kwd-2276042045987&hsa_kw=kubecon%202024&hsa_mt=e&hsa_net=adwords&hsa_ver=3&gad_source=1&gclid=Cj0KCQjww5u2BhDeARIsALBuLnO86USewI8c0_a4uKus91l491oBwGC-cQoGruwKx3Sz5WUeGTuCFa0aAj_3EALw_wcB 

10 mins

Remaining Action Items