This page is mostly a wishful thinking. It does not reflect the current state of ONAP security. It's rather where we would like to be.

ONAP introduction

ONAP from the milky way point of view

From the very optimistic perspective ONAP is an independent system in the outer space that provides interfaces for User, Admin and OSS/BSS system in the North and xNF in the South and uses interfaces provided by NFVI and xNF.

ONAP deployed on kubernetes

ONAP has to be deployed on some infra. Currently it's kubernetes.

ONAP deployed on kubernetes with external databases

As most of applications ONAP requires some persistence layer in form of databases. As ONAP follows micro-service architecture principle in theory each component could ship its own database but in practice in commercial deployments its desired to configure ONAP to use external DB engines already existing in operators infrastructure.

ONAP deployed on kubernetes with external databases and external IAM

Obviously it's hard to imagine operator that would like to have one more identity DB to managed specifically for ONAP thus ONAP should have the ability to integrate with external IAM system.

ONAP deployed on kubernetes with external databases and external IAM and external CA

Most of the operators probably already have Certificate Authority server running in their network and a requirement that all services should present a valid certificate signed by this CA. This means that ONAP should provide the ability to integrate with external CA instead of shipping own one.

Defining system boundaries

Provided interfaces

1. Admin/User/OSS/BSS interfaces are REST.
2. xNF southbound interfaces are VES events (protocol depends on the collector used)

Used interfaces

1. Kubernetes interface is REST. Exact supported version of kubernetes has to be specified by every ONAP release
2. Database interface depends on DB type but only encrypted communication should be used
3. xNF interface depends on particular xNF but all xNFs should support secure protocols for communication
4. NFVI interface is REST (usually OpenStack or Kubernetes)
5. IAM interface is Open ID Connect
   1. if operator already has OIDC compatible solution ONAP should just use it
   2. if operator has Identity Provider (LDAP/Kerberos/etc) external OIDC solution should be deployed (ie keycloak) with operator IdP configured as backend
   3. In testing environment external OIDC solution should be deployed and bootstraped with test users
6. CA interface can be one of:
   1. Manual interaction by deployer that will retrieve certificates and the bootstrap ONAP instance with them
   2. One of automated certificate retrieval protocols (ACME, CMPv2 etc)
   3. In testing environment external CA (and ONAP should use automated certificate retrieval as described in b) solution should be deployed

Requirements towards used interfaces

Kubernetes

1. Cluster should be configured according to CIS guideline

Databases

1. Each DB should be configured according to corresponding CIS guideline
2. All DB should be already created or ONAP should be provided with user that is capable of creating DB
3. If ONAP creates a DB a dedicated user account with privileges limited to that DB should be created. Password used for this user cannot be hardcoded in ONAP source.

xNF

As defined in ONAP VNF security requirements

NFVI

As defined in CNTT Reference Architecture 1 & 2

IAM

1. IAM has to support OpenID connect standard

CA

1. If automated certificate retrieval is used one of .... has to be supported by the CA

Requirements towards exposed interfaces

1. North and south interfaces should be separated (ie different instance of ingress controller) to allow to configure operator network policy properly
2. All Northbound interfaces has to be protected using TLS
3. All Northbound interfaces has to support SSO
4. All Northbound interfaces has to support RBAC
5. All roles used in ONAP have to be documented
6. All forms should validate and sanitize their input provided by the user
7. Southbound interfaces has to fulfill VNF security requirements
8. ...