Page History

1. Harbor is a reference solution of a container registry for ONAP SW: Harbor is verified along with ONAP SW test cases, and ONAP also provides a reference configuration of Harbor.
   But Harbor itself is not part of ONAP release / deliverables.
2. In addition to number 1 items: Harbor is part of ONAP release, it is packaged as one of the ONAP deliverables along with a reference configuration.

2 ways of Harbor onboarding: run and development. More information about the job and key requirement. In dev phase Nexu-IQ will be kept.

Signing of code releases by LFN. Fabian considers Notary for that. 

Different types of secrets exist in ONAP:

1. Passwords to databases - they can not be replaced with teh service mesh
2. Certificates - used to be hardcoded
3. Passwords used for communication between ONAP services
4. Passwords related to user management
5. Passwords related to external systems (like for OpenStack)

For every cathegory above different solution should apply:

Ad 1: common secrets templates, 3-5 components still needs tobe updated like etcd, Cassandra.

Ad 2: Cert initializer for https as a starting point, new backend considered apart from Certman (from AAF) like Certificate Manager from upstream.

Fabian manages certificates with reverse proxy, as Bell Canada does.

ONAP components are not yet ready for Ingress.

Ad 3: service mesh solution with proper access rights or any other security framework.

Ad 4: authentication in ingress, passwords externalized to keycloak.

Ad 5: for now should be placed in secrets, in long future will needa secret store. Fabian proposed to keep secretes in Vault but outside of Kubernetes but then how to access it? secret zero problem exists.

Change in Consul recently submitted. There are 2 ways to ensure that process is not running as root in the container:

• Docker deamon switch the user (no need to trust the content of the container) – preferred option
• Docker deamon starts as root and then change (need to trust that container content is valid)

Preferred option to be vlidated by Krzysztof and confirmed by e-mail. After to be presented to TSC to become a best practice.

To be further elaborated.

Item solved by e-mail exchange.

No feedback yet from Natacha for different types of secrets existing in ONAP discussed on 10th of November.

Fabian had a meeting with Sebatien..

Fabian explores Celium.

Progress was shared with the last PTLs call.

5 types of findings, 2 of them serious:

130+ projects disabled validation of server certificate or validating host name in the certificate- ignoring part of basic TLS protocol.

38 projects have problem with the way how they use encryption algorythms - broken ones used (MD5 or SHA-1). 

Poor practices in identity management.

SSL selected instead of TLS - easy to fix.

Fabian had a meeting with Sebatien..

1. Packages upgrades progress 
2. Java (v8 → 11) and Python (v2.7 → v3.6) migrations
3. Progress in packages not running as root - decrease
4. Migrations to https as dafault best practice

3 projects that are silver now:, and even one of those projects is 65% of gold (VVP) and 2 other are at 57 % of gold (Policy) and AAF, CLAMP is 96% silver and over 40 % gold. 

Progress was shared with the next PTLs call.