Please find below the Minutes of Meetings and recording for the SECCOM meeting that was held on 18th of February 2020.
| Jira No | Summary | Description | Status | Solution |
|---|---|---|---|---|
| SECCOM chair and vice chair elections | Confirm that the correct voting member for your company is on the Security Sub-committee Members list | List of participants was updated | Amy will contact Kenny to get information about process scheduling - February time frame?. | |
| Secrets encryption | Krzysztof has a draft wiki page documenting the approach for ONAP secrets management and would like feedback. In general ONAP should not hardcode any secrets inside the HELM charts. For the solution first of all we should remove all default values for HELM chart external secrets. For example OpenStack password should be provided by user at the deployment time. We do not want to generate random values because this creates some issues during the upgrades. We would like to utilize well known master password algorythm (supported by spring library which is part of HELM). We also expect that the underlying Kubernetes cluster is configured properly which means taht it uses encryption and REST plugin - secrets are never written in plein text into etcd. It could be good if details (namespace, secret and key) would documented. Documentation is available here: | In Progress | ONAP secret management | |
| AAF client certificate | Feedback that Ramesh has putted few certificates to OOP repo resources. why not used aitomated certificates generation by AAF - feedback that those are not SSL certificates and automated certificates generation is only on server side and client side certificates have to be hardcoded in the repo!. | Jonathan to be addressed with Amy's support to clarify. | It looks veru weird - to be further investigated with AAF team. Mutual TLS = both sides can use the same certificate. | |
| MariaDB-Galera | Whole encryption is blocking and compromised in SO. | |||
| Description and examples of the CLAMP script Feedback from the PTLs\ meeting was to not run the script because the Jira tickets would create addtional work. They would prefer to track progress using gerrit reviews. SECCOM:
Actions: put ideas on onap-discuss and set up a separate meeting if there is enough interest | On Hold | ||
Automated K8S tests enabled for Frankfurt | Feedback from PTLs Propose enabling | Present to TSC | Docker and Kubernetes Security | |
| Secrets encryption | Krzysztof has a draft wiki page documenting the approach for ONAP secrets management and would like feedback Questions for Krzysztof:
| In Progress | ONAP secret management | |
| SECCOM chair and vice chair elections | Confirm that the correct voting member for your company is on the Security Sub-committee Members list | |||
| Java and the new model of licensing for Oracle JDK versus Open JDK – Natacha | Oracle JDK which is commercial - benefits updates Open JDK - like open source so free of charge but support for java 11 but not earlier versions. 2/11 update Docker images for both the Debian and Alpine releases of the Java 11 JDK will be available for all projects | Docker images for both the Debian and Alpine releases of the Java 11 JDK will be available for all projects | TSC wants to know which distribution of the OpenJDK is used – Integration team/OOM to be contacted - discussion planned for next status meeting on Wednesday. SECCOM cares Java 11 and not particular distribution - we appreciate common image from governance perspective and harmonization - coordination on release manager side. Next steps: E-mail to be sent to Morgan with Pawel B. in copy to confirm if image is already created. 2/11: Confirm documentation and location of Debian and Alpine images | |
| Upcoming F2F meetings | Decide which meeting(s) SECCOM wants to focus on Start collecting topics for the meeting(s) | In Progress | ||
| OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 25TH OF FEBRUARY'20 |