ONAP introduction

ONAP from the milky way point of view

From the very optimistic perspective ONAP is an independent system in the outer space that provides interfaces for User, Admin and OSS/BSS system in the North and xNF in the South and uses interfaces provided by NFVI and xNF.

ONAP deployed on kubernetes

ONAP has to be deployed on some infra. Currently it's kubernetes.

ONAP deployed on kubernetes with external databases

As most of applications ONAP requires some persistence layer in form of databases. As ONAP follows micro-service architecture principle in theory each component could ship its own database but in practice in commercial deployments its desired to configure ONAP to use external DB engines already existing in operators infrastructure.

ONAP deployed on kubernetes with external databases and external IAM

Obviously it's hard to imagine operator that would like to have one more identity DB to managed specifically for ONAP thus ONAP should have the ability to integrate with external IAM system.

ONAP deployed on kubernetes with external databases and external IAM and external CA

Most of the operators probably already have Certificate Authority server running in their network and a requirement that all services should present a valid certificate signed by this CA. This means that ONAP should provide the ability to integrate with external CA instead of shipping own one.

Defining system boundaries

Provided interfaces

1. Admin/User/OSS/BSS interfaces are REST.
2. xNF southbound interfaces are VES events (protocol depends on the collector used)

Used interfaces

1. Kubernetes interface is REST. Exact supported version of kubernetes has to be specified by every ONAP release
2. Database interface depends on DB type but only encrypted communication should be used
3. xNF interface depends on particular xNF but all xNFs should support secure protocols for communication
4. NFVI interface is REST (usually OpenStack or Kubernetes)
5. IAM interface is Open ID Connect
   1. if operator already has OIDC compatible solution ONAP should just use it
   2. if operator has Identity Provider (LDAP/Kerberos/etc) external OIDC solution should be deployed (ie keycloak) with operator IdP configured as backend
   3. In testing environment external OIDC solution should be deployed and bootstraped with test users
6. CA interface can be one of:
   1. Manual interaction by deployer that will retrieve certificates and the bootstrap ONAP instance with them
   2. One of automated certificate retrieval protocols (ACME, CMPv2 etc)
   3. In testing environment external CA (and ONAP should use automated certificate retrieval as described in b) solution should be deployed