2023-10-31 Security Subcommittee Meeting Notes

Muddasar Ahmed presented the draft deck about LFN AI/ML use cases.

Maggie shared link:

https://www.nist.gov/itl/ai-risk-management-framework 

We need to have Ops feedback (NOC manager) on AI, what pain point could  be solved by AI.

LFN AI-ML Use case formulation.pptx

Byung-Woo Jun informed SECCOM that the Nephio security WG is holding a joint meeting with the LF security SIG today at 11AM ET. Nephio plans to adopt 80% of OSSF passing badge.

Topic further discussed:

Tlhansen.us/onap

For Nephio, Tony recommends to sort by “Type+Section”

Panel, please change link from “tlhansen.us/onap” to “tlhansen.us/badging” and add to ‘Click on “Single Project…” then fill in a search string or badging ID’

Nephio SIG Security meeting:

By: Lucy Hyde When: Tuesday, October 31st, 2023 8:00am to 9:00am (UTC-07:00) Pacific Time - Los Angeles Repeats: Weekly on Tuesday Location: https://zoom.us/j/96025994457

OJSI distribution list participants were updated with Amy's and Jess's support.

2FA ongoing by Jess and Eric for CPS and OJSI distribution list. 

LFIT will implement 2FA for users across all ONAP Jiras.

Modeling team did not follow the unmaintained project process. Build failing for components reliant on the "etsi" components.

modeling/etsicatalog repo deprecation

• Email from Deng Hui
• repo is already archived
• Speak NZ making use of it - no contributions
• SO is also a downstream user
  • can move the repo under SO

Actions:

• AGREED: the TSC approved re-enabling the modeling/etsicatalog repo without anyone to currently maintain it
  • remove etsicatalog from archive status and restore Jenkins jobs
  • Tony Hansen  When a repo goes into unmaintained status, also need to change its badging status to indicate that it is unmaintained
• Move etsicatalog under SO by New Delhi release
• Jenkins jobs created

Kenny Paul following up to fix the build break.

AAF-1217 - Getting issue details... STATUS

Review work around proposed by Andreas Geißler - deferred until Andreas Geißler returns from holiday

Workaround

Some project containers still experiencing problems: clients using the cert-initializer (e.g. SO, SDC, CDS) still fail.

Need to document certificate management in user docs.

Louis Gamers' AAF cert wiki page: (1) Create AAF CA certificates - Developer Wiki - Confluence (onap.org)

• Components such as dcaegen2 have their own cert init container with the aaf certificate embedded in the container image. This might be the reason why SO, SDC, and CDS broke if they have their own cert init containers.
• Unclear why onap-aaf-sms-preload and onap-dmaap-bc-dmaap-provisioning jobs broke in Louis's environment.

Discussion with China Telecom done - they could check potentially next week and they worked independently on this issue, Aaarna Networks commited to check Andreas's patch.

Paweł Pawlak to send an e-mail notification to China Telecom about the script prepared by Andreas and associated Wiki documenting it.

Review next steps:

-select signing software (SECCOM + LFIT)

-perform POC with friendly projects (ONAP)

-integrate into build process (LFIT)

Looking for a volunteering project to work with us. raised at the 18th September PTL's call but no volunteer so far.

LF IT would have to prioritized topic. Prioritization is possible with LFN, Muddasar to update ticket. 

Muddasar Ahmed to analyze which ONAP project has the most frequent changes in its containers.

Muddasar reached out to LF-IT, Jess and her team are analyzing what enhancement has to be made with CI jobs to allow for Container signing.  Further updates will be provided when scope and efforts have been assessed.