...

• There are currently three Ubuntu 18.04 servers: node1-1, node2-1 and node2-2, which are managed by OpenStack.
  Node1-1 is the controller node, and node2-1 and node202 are compute nodes.
  We have installed ONAP using the OOM Rancher/Kubernetes instructions into five VMs.

Development

• There is a transition from http ports to https ports, so that communications are protected by TLS encryption.
• However the transition is piecemeal and spread over multiple ONAP releases, so individual projects still have vulnerabilities to due intra-ONAP dependencies, e.g.

  Jira
  server ONAP JIRA serverId 425b2b0a-557c-3c0c-b515-579789cceedb key OJSI-97

  out of a total of

  Jira
  server ONAP JIRA jqlQuery text ~ "plain text http" ORDER BY updated DESC count true serverId 425b2b0a-557c-3c0c-b515-579789cceedb

  .
• A node-to-node VPN (working at the level of the VM or physical servers that host the Kubernetes pods/docker containers of ONAP) would provide blanket coverage of all communications with encryption.
• A node-to-node VPN is both
  • an immediate stopgap solution in the short-term to cover the exposed plain text HTTP ports
  • an extra layer of security in the long-term to thwart unforeseen gaps in the use of HTTPS ports

Discussion

• There has already been discussion and recommendation for using Istio https://istio.io/
  • Istio Envoy is deployed within each pod using sidecar-injection, then stays in the configuration when the pods are restarted
  • Istio Envoy probably appears within each pod as a network bridge, such as Kubernetes cluster networking bridge cbr0, thereby controlling all network traffic within the pod
  • Istio Envoy provides full mesh routing but can also provides control of routing with traffic management and policies
  • Istio Envoy also provides telemetry in addition to the security of mutual TLS authentication
  • Istio Citadel is run in the environment as the certificate authority / PKI supporting the mutual TLS authentication
  • Istio appears to have only a single overall security domain (i.e. the environment that includes Mixer, Pilot, Citadel and Galley), though it does contain many options to distinguish different services, users, roles and authorities

...