You are viewing an old version of this page. View the current version.
Compare with Current
View Page History
« Previous
Version 30
Next »
Support for the Multi Tenancy in ONAP
Guilin Proposed Requirements - Multi-tenancy v2.2.pdf
Executive Summary - Provide the multi tenant non-functional support in ONAP
- As a starting point tenant wise runtime operations could be differed for each tenant.
Business Impact - Enables operators and service providers to use leverage ONAP
Business Markets - All operators and service providers can leverage the multi-tenancy functionality of ONAP
Funding/Financial Impacts - Reduction in operations expense from using industry standard Interfaces.
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
Documenting ONAP APIs
Guilin Proposed Requirements
Also see: Developing ONAP API Documentation
Executive Summary - Improve ONAP API Documentation:
- Developer Friendly
- Non-Developer Friendly
- Easy to Find & Easy to Navigate
- Common and Uniform Documentation Structure and Approach
- Provides Information on Using the API (e.g., quick start)
- Try It For Yourself (TIFY) Examples
Proposed non-functional requirements for Guilin release:
- All components should place externally facing (i.e. interfaces exposed by the ONAP component to either other ONAP components or components external to ONAP) API definitions (e.g. Swagger) in a common path within their Gerrit/Git
Suggested Path: <Component>/docs/api/swagger/ - Apply ReDoc to Swagger and place HTML in Readthedocs for the release
Apply Minimum (Phase 1+) swagger guidelines
- See: Proposed Phase 1+ OpenAPI 2.0 / Swagger Style Guide
- Use the common insert for the info section (e.g., license info, contact info, etc): Swagger Insert Sample for Info Section
Related JIRAs under the Documentation project for the API Documentation non-functional requirements:
Epic: https://jira.onap.org/browse/DOC-608
User Story: https://jira.onap.org/browse/DOC-609
User Story: https://jira.onap.org/browse/DOC-610
User Story: https://jira.onap.org/browse/DOC-611
Business Impact - Enables developers, operators and service providers to use leverage ONAP; Improve integration velocity for API client developers; Ease development handoffs;
Business Markets - All developers,operators and service providers can leverage ONAP APIs
Funding/Financial Impacts - Reduction in development and integration expense from using well defined open Interfaces.
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
Deterministic ONAP installation result
slides: 20200511.ONAP.relG.TIM.non functional requirements.v2.pptx
Proposed non-functional requirements for Guiling release:
- ONAP installation result shall be determinstic at k8s level with 99% success rate (e.g. all POD are up and running)
- ONAP installation result shall be deterministic at functional level with 97% success rate (e.g. all functional modules are up and running, APIs are responsiveness, etc)
- ONAP installation result shall be determinstic at service level with 95% success rate (e.g. a service can be designed, distributed and deployed successfully)
Same requirements shall apply when one or more ONAP functional modules are re-installed
Business Impact - Enables operators and service providers opex saving
Business Markets - All operators and service providers can leverage the benefit of a deterministic installation
Funding/Financial Impacts - Reduction in operations expense
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP projects shall upgrade all outdated, vulnerable direct dependencies in their code base
Executive Summary - All ONAP projects shall reduce the risks associated with software vulnerabilities in the ONAP code base by upgrading all outdated, vulnerable direct dependencies in their code bases following the recommendations of SECCOM. The project and repo specific recommendations are provided in the Security Vulnerability space.
Business Impact - Improves the security posture of ONAP.
Business Markets - All operators and service providers can leverage the of fewer vulnerabilities in the open source dependencies in ONAP
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP projects shall define code coverage improvements and achieve at least 55% code coverage
Executive Summary - Each project written in Java, Python or Javascript must provide the planned percent improvement in code coverage by M2 and meet the planned improvement by M4. Code coverage for each project must be at least 55% of the code base.
Business Impact - Improves the security posture of ONAP by improving the testing suite.
Business Markets - All operators and service providers can use the automated test suites in their own environments
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
Executive Summary - Integration testing shall continue to test for unsecure communication (HTTP) and vulnerable ports (e.g., JDWP). Integration shall add tests to ensure that project containers use the versions of Java, Python, Linux, Docker, database and utilities specified in Guilin versions.
Business Impact - Improves the security posture of ONAP by using current versions and simplifies the deployment.
Business Markets - All operators and service provider.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP shall increase the number of Docker Benchmark tests
Executive Summary - Integration testing shall include tests that a non-root user for the container has been created, containers use only trusted base images (versions specified on Guilin versions), and HEALTHCHECK instructions have been added to container images.
Business Impact - Improves the security posture of ONAP by hardening containers.
Business Markets - All operators and service provider.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
Business Impact - Improves the security posture of ONAP by lessening the risk from bad or malicious input.
Business Markets - All operators and service provider.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP must complete update of the java language (from v8 -> v11)
Executive Summary - All ONAP projects using java shall reduce the risks associated with no regular support for java v8 software as it causes increase of usage risk, as recommended by SECCOM.
Business Impact - Improves the security posture of ONAP.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP must complete update of the Python language (from 2.7 -> 3.8)
Business Impact - Improves the security posture of ONAP.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP shall use STDOUT for logs collection
Executive Summary - All ONAP projects should use a common place for logs data - all applications should generate logs that can be collected by Kubernetes in STDOUT, as recommended by SECCOM.
Business Impact - Improves the security posture of ONAP.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies -There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP Minimum Viable Product (MVP) must be defined
Executive Summary - . a subset of ONAP components should be identified - handling a minimum level of functionnality. This subset would consist in an ONAP baseline.
Business Impact - guarantees a minimum security level for this ONAP subset for each release ensuring a robust basis on which services can be developped.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
Flow management must be activated for ONAP.
Executive Summary - Full map of all the flows - before deploying ONAP in any actor's infrastructure should be defined: protocol type, ports open/closed with primary focus on outside of ONAP as an ingress.
Business Impact - flow management could then be controlled before any deployment.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP must implement IAM solutions.
Executive Summary - a centralized user access management solution should be proposed, so that any project relies on it.
Business Impact - common user management solution among projects, with respect of security requirements that will be defined.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP projects must use only approved and verified base images for their containers
Executive Summary - We are shipping container images as our official release artifacts. We need to make sure that we comply with all licenses used in base images. This infeasible when projects use dozen of different base images.
Business Impact - Lack of license compliance may limit ONAP adoption and lead to bad perception in the open source community.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
ONAP container repository (nexus) must not contain upstream docker images
Business Impact - Lack of license compliance may limit ONAP adoption and lead to bad perception in the open source community.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
No root (superuser) access to database from application container
Executive Summary - ONAP application container should not access database using root account. If application requires root access to bootstrap the database an init container or separate kubernetes job should be used.
Business Impact - Improves ONAP security and configurability by separating long running application container from actions that requires higher privileges.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
Container rootfs has to be mounted readOnly
Executive Summary - By design containers running in kubernetes should be ephemeral and stateless. It's a good security practice to mount their rootfs as a read only
Business Impact - Improves ONAP security and reduces the number of potential failures during ONAP deployment.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
Application config should be fully prepared before starting the application container
Executive Summary - Editing config files with sed from docker entrypoint script often causes a lot of silent failures in OOM deployments. Instead, config should be either provided as a ConfigMap and templated using helm or generated in the init container before the main application container comes up.
Business Impact - Reduces the number of potential failures during ONAP deployment and thus makes it more reliable.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider.
Continue hardcoded passwords removal
Executive Summary - This effort has been started in F release by eliminating mariadb-galera and postgres hardcoded passwords. This effort should be continued to eliminate next set of passwords hardcoded in helm charts. Apart from working on already existing passwords, as a part of this requirement, all new passwords should use common secret template.
Business Impact - Improve ONAP security and make it easier for commercial adoption.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider
All containers must run as non-root user
Executive Summary - This effort has been started in F with ONAP containers. Now we want to extend this to all containers that are deployed as a part of OOM.
Business Impact - Improve ONAP security and make it easier for commercial adoption.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider
ONAP components should be able to run without AAF and MSB
Executive Summary - AAF is not the only possible security solution for ONAP. In some cases ONAP may be deployed behind a reverse proxy or using service mesh. That's why components should be able to work (even in degradated mode in example using HTTP instead of HTTP or without authentication) without AAF available. The same for MSB. It's not the most cloud native solution for accessing services in kubernetes thus it should be possible to deploy ONAP without it and access services using for example API gateway.
Business Impact - Improve ONAP configurability and increase number of possible deployment option which will result in wider adoption among operators.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider
Replace NodePorts with ingress controller as a default deployment option
Executive Summary - Nginx-based ingress controller is available in ONAP since F release. It's time to finally eliminate NodePorts which from the very beginning were considered just a temporary and insecure solutions. All components must be able to fully work via ingress.
Business Impact - Improve ONAP security and configurability will result in wider adoption among operators.
Business Markets - All operators, service providers and entities using ONAP.
Funding/Financial Impacts - N/A
Organization Mgmt, Sales Strategies - There is no additional organizational management or sales strategies for this requirement outside of a service providers "normal" ONAP deployment and its attendant organizational resources from a service provider
