2023-09-26 Security Subcommittee Meeting Notes

Nephio SIG Security started discussing secure software supply chain and also showed a demo, leveraging Kubearmor for security access.

In the KubeConn, there were some discussions around amber service mesh (a.k.a. sidecarless service mesh).

For NF deployment and management, sidecarless service mesh could be a good option, I think. There were some use cases from MITRE.

ONAP SECCOM position for this to be further discussed.

Nephio SIG member made a demo with Kubearmor. No need to configure sidecar for each network function. Amber Service Mesh seems to be not yet production ready.

Kubearmor was DARPA project, it is used as part of superblueprint. It has policy building and administration function. Enforcement is done by using eBPF.

Presentation could be provided to SECCOM.

Muddasar Ahmed to check with MITRE colleagues on possible presentation for SECCOM on Kuberamor.

Update from 2023-08-21 PTL meeting

-CPS (Toine Siebelink): will test building CPS without oparent/pom.xml (results 2023-10-01)

-Integration (Marek Szwałkiewicz): will perform a test build with the profiles commented out

2023-08-15 SECCOM notes

-Only 2 PTLs responded to Amy’s e-mail

-No objections on Oparent retirement, we have no volunteer to maintain it up to date

-pom.xml contains more than cross project common package dependencies

2023-09-05 SECCOM notes

-Pawel to contact Marek Szwałkiewicz 

-Toine Siebelink will provide feedback in early October

-decision on path forward - potentially remove package info - deferred to October

Main problem with testing changes in Oparent it is not possible as it is imported and used in build time and not in run time.

We need to find someone who will upgrade versions in Oparent file. Liam to be contacted for that.

2023/09/26: Liam will update Oparent going forward. SECCOM will provide package update recommendation.

Recommendation:

-retain oparent/pom.xml

-Make Andreas Geissler a committer and ask the integration or OOM team to update the file per release

-Proposal:

• Option 1 (short term): ask the integration or OOM team to update the file per release
• Option 2 (long term): split into multiple pieces that could be independently maintained: dependencies, build directives, profiles

-Byung will discuss with Andreas and OOM team and report at 8/22 SECCOM (pushed to 8/29 SECCOM meeting)

-Amy will contact Liam Fallon  and Pam for history

• Pawel to contact Liam and check if he could update Oparent.

AAF-1217 - Getting issue details... STATUS

Review work around proposed by Andreas Geissler - deferred until Andreas Geissler returns from holiday

Workaround

Some project containers still experiencing problems: clients using the cert-initializer (e.g. SO, SDC, CDS) still fail.

Need to document certificate management in user docs.

Louis Gamers' AAF cert wiki page: (1) Create AAF CA certificates - Developer Wiki - Confluence (onap.org)

• Components such as dcaegen2 have their own cert init container with the aaf certificate embedded in the container image. This might be the reason why SO, SDC, and CDS broke if they have their own cert init containers.
• Unclear why onap-aaf-sms-preload and onap-dmaap-bc-dmaap-provisioning jobs broke in Louis's environment.

Review next steps:

-select signing software (SECCOM + LFIT)

-perform POC with friendly projects (ONAP)

-integrate into build process (LFIT)

Looking for a volunteering project to work with us. Request raised at the 18th September PTL's call but no volunteer so far.

Muddasar Ahmed to analyze which ONAP project has the most frequent changes in its containers.

Muddasar Ahmed to share confluence page.