...
There are currently three Ubuntu 18.04 servers: node1-1, node2-1 and node2-2, which are managed by OpenStack.
Node1-1 is the controller node, and node2-1 and node202 are compute nodes.
We have installed ONAP using the OOM Rancher/Kubernetes instructions into five VMs.
Development
- There is a transition from http ports to https ports, so that communications are protected by TLS encryption.
- However the transition is piecemeal and spread over multiple ONAP releases, so individual projects still have vulnerabilities to due intra-ONAP dependencies, e.g.
out of a total ofJira server ONAP JIRA serverId 425b2b0a-557c-3c0c-b515-579789cceedb key OJSI-97
.Jira server ONAP JIRA jqlQuery text ~ "plain text http" ORDER BY updated DESC count true serverId 425b2b0a-557c-3c0c-b515-579789cceedb - A node-to-node VPN (working at the level of the VM or physical servers that host the Kubernetes pods/docker containers of ONAP) would provide blanket coverage of all communications with encryption.
- A node-to-node VPN is both
- an immediate stopgap solution in the short-term to cover the exposed plain text HTTP ports
- an extra layer of security in the long-term to thwart unforeseen gaps in the use of HTTPS ports
Discussion
- There has already been discussion and recommendation for using Istio https://istio.io/
- Istio Envoy is deployed within each pod using sidecar-injection, then stays in the configuration when the pods are restarted
- Istio Envoy probably appears within each pod as a network bridge, such as Kubernetes cluster networking bridge cbr0, thereby controlling all network traffic within the pod
- Istio Envoy provides full mesh routing but can also provides control of routing with traffic management and policies
- Istio Envoy also provides telemetry in addition to the security of mutual TLS authentication
- Istio Citadel is run in the environment as the certificate authority / PKI supporting the mutual TLS authentication
- Istio appears to have only a single overall security domain (i.e. the environment that includes Mixer, Pilot, Citadel and Galley), though it does contain many options to distinguish different services, users, roles and authorities
...