[onap-tsc] Hi! Our Monday's meeting will be dedicated to identifying gaps in integration testing for ONAP Platform, while implementing use cases/functional reqs

[Alla Goldner]

Ben will present integration information.

Yang, please also attend our meeting.

Best Regards, Alla
This email and the information contained herein is proprietary and confidential 
and subject to the Amdocs Email Terms of Service, which you may review at 
https://www.amdocs.com/about/email-terms-of-service 


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#4587): https://lists.onap.org/g/onap-tsc/message/4587
Mute This Topic: https://lists.onap.org/mt/29700859/21656
Group Owner: onap-tsc+ow...@lists.onap.org
Unsubscribe: https://lists.onap.org/g/onap-tsc/leave/2743226/1412191262/xyzzy  
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [onap-discuss] [onap-tsc] Ubuntu and Alpine discussion

[Chaker Al Hakim]

Hi Team,

I was also on the TSC call and was engaged in the discussion as well. I agree 
with  Srini’s position that we should support ONAP on both  Ubuntu as well as 
Alpine Linux. Looking just at the disk image footprint as one driver to support 
only Alpine Linux may not be the best way to go; In addition, deploying ONAP on 
a base Linux that is not commercially supported may not be the best approach 
moving forward.

If the end goal of the Footprint Optimization is to ultimately support ONAP 
only on  Alpine Linux then this discussion becomes much broader then just 
footprint optimization and should be presented and discussed as such  at the 
ArchCom and at the the TSC level to make sure everyone is aware of the 
potential long term impact.


Regards,
Chaker


From: onap-disc...@lists.onap.org [mailto:onap-disc...@lists.onap.org] On 
Behalf Of Sylvain Desbureaux
Sent: Friday, February 08, 2019 4:11 AM
To: onap-disc...@lists.onap.org; srinivasa.r.addepa...@intel.com; 
onap-tsc@lists.onap.org
Subject: Re: [onap-discuss] [onap-tsc] Ubuntu and Alpine discussion

Hello Srini,

Fyi size of images on dockerhub may not be the same once downloaded (I don’t 
know why):

For example, alpine:3.9 is said at 3MB and ubuntu:18.04 is said at 32MB.
Once downloaded (on an x86_64 server), here’s what I have:

docker images
REPOSITORY  TAG IMAGE ID
CREATED SIZE
ubuntu  18.04   47b19964fb50
2 days ago  88.1MB
alpine  3.9 caf27325b298
8 days ago  5.53MB


Regards,

---
Sylvain Desbureaux

De : mailto:onap-disc...@lists.onap.org>> au nom 
de Srini 
mailto:srinivasa.r.addepa...@intel.com>>
Répondre à : "onap-disc...@lists.onap.org" 
mailto:onap-disc...@lists.onap.org>>, 
"srinivasa.r.addepa...@intel.com" 
mailto:srinivasa.r.addepa...@intel.com>>
Date : vendredi 8 février 2019 à 00:03
À : "onap-tsc@lists.onap.org" 
mailto:onap-tsc@lists.onap.org>>
Cc : "onap-disc...@lists.onap.org" 
mailto:onap-disc...@lists.onap.org>>
Objet : Re: [onap-discuss] [onap-tsc] Ubuntu and Alpine discussion

Hi Adolfo,

“Having said that, projects that can clearly demonstrate that they can't 
migrate to Alpine should be given the opportunity to request an exception and 
do the work themselves.
“

This is the point that raised the discussion in TSC. Above statement seem to 
indicate that the goal for ONAP is to move to Alpine. So far, my impression was 
that ONAP would be supported on both Ubuntu and Alpine.  Hence the discussion 
today.

Since Alpine is not supported commercially, it is always be a challenge for few 
to adopt ONAP as is.
Ubuntu is open source with commercial support. Now that Ubuntu also has thin 
version, adopting Ubuntu thin image as base package would address concerns 
related to size as well as support.  Moreover Ubuntu has big eco-system too and 
many packages get tested against Ubuntu.
Since ONAP is also tested so far on Ubuntu based containers, I think work for 
ONAP teams also would be relatively lesser if we go with Ubuntu minimal image.

I have not tried Ubuntu thin image. Again, my 2 cents on studying Ubuntu 
minimal image and its applicability.


Srini

From: onap-tsc@lists.onap.org 
[mailto:onap-tsc@lists.onap.org] On Behalf Of Adolfo Perez-Duran
Sent: Thursday, February 7, 2019 12:06 PM
To: onap-tsc@lists.onap.org
Cc: onap-disc...@lists.onap.org
Subject: Re: [onap-tsc] Ubuntu and Alpine discussion

Hi Srini,

Thanks for joining the discussion.

On October 8, 2018 PTLs discussed and agree to using Alpine as the base image 
for footprint minimization.

Because images are immutable, once dependencies and libraries are mapped there 
should not be any perceptible difference introduced by the base image.

It may be fair to assume that integration testing occurs (should occur?) at the 
service (API) level, regardless of what base image was used to create a 
container.

Some projects, such as SO and AAF, had already adopted --on their own-- Alpine 
as their base image.

Also, the CIA team has already engaged a number of teams in the Dublin scope 
and has contributed patches to migrate to Alpine.

Having said that, projects that can clearly demonstrate that they can't migrate 
to Alpine should be given the opportunity to request an exception and do the 
work themselves.

There is a lot of work to be done (finding common base images that can be used 
across projects, multi-stage builds, CI/CD parameterization, etc). Migrating to 
a small  base image is only the first step. I encourage you to bring a 
contribution and help us realize the long term goals.

Adolfo

On Thu, Feb 7, 2019 at 12:25 PM Srini 

Re: [OpenDaylight TSC] [onap-tsc] CII Badging - Vulnerabilities

[Alexis de Talhouet]

Greeting ODL TSC,

I would like to add an item to next TSC agenda, to have a discussion 
following-up this mail-thread,
to see how we can move forward. Kindly let me know when would be a good time so 
we can have
the right persons from ONAP community to attend.

Thank you,
Alexis

> On Jan 22, 2019, at 4:28 PM, Alexis de Talhouet via Lists.Onap.Org 
>  wrote:
> 
> 
> 
>> On Jan 22, 2019, at 3:48 PM, Daniel Farrell > > wrote:
>> 
>> 
>> I have finally found the report and it's quite a few issues, so it's
>> hard to break them down.
>> 
>> First of all, I don't believe the list of issues flagged as coming from
>> OpenDaylight is accurate, as I compared the artifacts we are shipped in
>> karaf-0.8.3.
>> 
>> We also did not ship netty-4.0.30, we shipped 4.1.22.
>> 
>> We did not ship the following artifacts at all:
>> commons-fileupload
>> artemis-commons
>> faces-impl
>> sendgrid-java
>> netty-4.0.30 -- we are shipped 4.1.22.Final
>> 
>> I could not find a public repository for the SONATYPE advisories -- does
>> anyone have a pointer? Without that I cannot evaluate them...
>> 
>> We have upgraded org.bouncycastle in Oxygen SR4, so at least those two
>> CVEs have been fixed.
>> 
>> Finally, it seems that quite a few issues are affecting
>> ccsdk/distribution, which are coming from ODL projects like TSDR, SXP
>> and similar. I am not sure whether ONAP really uses them, so it may be
>> worthwhile to take a look at how the distribution is assembled.
> 
> 
> Thanks Daniel for copying. Thanks Robert for the answer.
> 
> Brian, yes, Robert did reply with some preliminary answers. We should ingest 
> them
> and start triaging our list.
> Also, we should look into how we could build a custom distro out of ODL 
> released artifacts
> specific for ONAP, as as pointed by Robert, we might not need everything. I 
> actually think
> we mostly need NETCONF, that I’m aware of.
> 
> I’ll follow-up w/ Dan Timoney and that.
> 
> Regards,
> Alexis
> 


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#4589): https://lists.onap.org/g/onap-tsc/message/4589
Mute This Topic: https://lists.onap.org/mt/28708638/21656
Group Owner: onap-tsc+ow...@lists.onap.org
Unsubscribe: https://lists.onap.org/g/onap-tsc/leave/2743226/1412191262/xyzzy  
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OpenDaylight TSC] [onap-tsc] CII Badging - Vulnerabilities

[Brian]

Daniell,

One item I meant to reply to before.
Since ONAP is Apache 2.0 and ODL is EPL we dont think we can build a 
distribution on the ONAP side that removes “ODL projects like TSDR, SXP
and similar”.   It would be awesome if ONAP could build its own distro but I 
dont think we know how to do that without tainting.

We dont use those other projects but they are in the distro. It would be useful 
to have some mechanism to do a CII Badging friendly distribution or something.

Brian


From: Alexis de Talhouët 
Sent: Tuesday, January 22, 2019 4:29 PM
To: onap-tsc@lists.onap.org
Cc: TIMONEY, DAN ; Robert Varga ; FREEMAN, BRIAN D 

Subject: Re: [OpenDaylight TSC] [onap-tsc] CII Badging - Vulnerabilities




On Jan 22, 2019, at 3:48 PM, Daniel Farrell 
mailto:dfarr...@redhat.com>> wrote:


I have finally found the report and it's quite a few issues, so it's
hard to break them down.

First of all, I don't believe the list of issues flagged as coming from
OpenDaylight is accurate, as I compared the artifacts we are shipped in
karaf-0.8.3.

We also did not ship netty-4.0.30, we shipped 4.1.22.

We did not ship the following artifacts at all:
commons-fileupload
artemis-commons
faces-impl
sendgrid-java
netty-4.0.30 -- we are shipped 4.1.22.Final

I could not find a public repository for the SONATYPE advisories -- does
anyone have a pointer? Without that I cannot evaluate them...

We have upgraded org.bouncycastle in Oxygen SR4, so at least those two
CVEs have been fixed.

Finally, it seems that quite a few issues are affecting
ccsdk/distribution, which are coming from ODL projects like TSDR, SXP
and similar. I am not sure whether ONAP really uses them, so it may be
worthwhile to take a look at how the distribution is assembled.


Thanks Daniel for copying. Thanks Robert for the answer.

Brian, yes, Robert did reply with some preliminary answers. We should ingest 
them
and start triaging our list.
Also, we should look into how we could build a custom distro out of ODL 
released artifacts
specific for ONAP, as as pointed by Robert, we might not need everything. I 
actually think
we mostly need NETCONF, that I’m aware of.

I’ll follow-up w/ Dan Timoney and that.

Regards,
Alexis

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#4590): https://lists.onap.org/g/onap-tsc/message/4590
Mute This Topic: https://lists.onap.org/mt/28708638/21656
Group Owner: onap-tsc+ow...@lists.onap.org
Unsubscribe: https://lists.onap.org/g/onap-tsc/leave/2743226/1412191262/xyzzy  
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OpenDaylight TSC] [onap-tsc] CII Badging - Vulnerabilities

[Alexis de Talhouet]

> On Feb 8, 2019, at 10:00 AM, Brian  wrote:
> 
> Since ONAP is Apache 2.0 and ODL is EPL we dont think we can build a 
> distribution on the ONAP side that removes “ODL projects like TSDR, SXP
> and similar”.   It would be awesome if ONAP could build its own distro but I 
> dont think we know how to do that without tainting.

I tend to think we can. This is one of the things I want to discuss during ODL 
TSC when it is the good time.


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#4591): https://lists.onap.org/g/onap-tsc/message/4591
Mute This Topic: https://lists.onap.org/mt/28708638/21656
Group Owner: onap-tsc+ow...@lists.onap.org
Unsubscribe: https://lists.onap.org/g/onap-tsc/leave/2743226/1412191262/xyzzy  
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OpenDaylight TSC] [onap-tsc] CII Badging - Vulnerabilities

[Abhijit Kumbhare]

Sure Alexis - I will add this to the agenda next week. Earlier this week
Anil Belur was asking for the same to be on the agenda - but there was no
time this week to have this.

On Fri, Feb 8, 2019 at 7:06 AM Alexis de Talhouet 
wrote:

>
>
> On Feb 8, 2019, at 10:00 AM, Brian  wrote:
>
> Since ONAP is Apache 2.0 and ODL is EPL we dont think we can build a
> distribution on the ONAP side that removes “ODL projects like TSDR, SXP
> and similar”.   It would be awesome if ONAP could build its own distro but
> I dont think we know how to do that without tainting.
>
>
> I tend to think we can. This is one of the things I want to discuss during
> ODL TSC when it is the good time.
>
> 
>
>

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#4592): https://lists.onap.org/g/onap-tsc/message/4592
Mute This Topic: https://lists.onap.org/mt/28708638/21656
Group Owner: onap-tsc+ow...@lists.onap.org
Unsubscribe: https://lists.onap.org/g/onap-tsc/leave/2743226/1412191262/xyzzy  
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OpenDaylight TSC] [onap-tsc] CII Badging - Vulnerabilities

[TIMONEY, DAN]

All,

One clarification I wanted to make, re: Robert’s question about the list we’d 
provided.

The Nexus IQ server also reports on third party libraries that are embedded 
within other jars.  For example, ODL Oxygen doesn’t ship netty 4.0.30, but the 
jar for narayana-osgi-jta contains that version of netty.  I can tell that 
because when I look at “Occurrences” of that library in the Nexus IQ Server 
report, I see this:

netty-all-4.0.30.Final.jar located at 
opendaylight/oxygen/target/docker-stage/karaf-0.8.3.tar.gz/karaf-0.8.3/system/org/jboss/narayana/osgi/narayana-osgi-jta/5.5.2.Final/narayana-osgi-jta-5.5.2.Final.jar


I really wish we could just share the report, but unfortunately Sonatype told 
us in no uncertain terms that sort of thing is a violation of their software 
license terms.

I just wanted to reassure you  all that I really did do my best to be careful 
about separating out the vulnerabilities we’re inheriting from ODL from any 
that we’re introducing ourselves.

Dan
--
Dan Timoney
SDN-CP Development
ONAP Project Technical Lead : CCSDK and SDNC

Please go to  D2 ECOMP Release Planning 
Wiki for 
D2 ECOMP Project In-take, 2016 Release Planning, Change Management, and find 
key Release Planning Contact Information.


From: Abhijit Kumbhare 
Date: Friday, February 8, 2019 at 11:06 AM
To: "onap-tsc@lists.onap.org" 
Cc: Robert Varga , "TIMONEY, DAN" 
Subject: Re: [OpenDaylight TSC] [onap-tsc] CII Badging - Vulnerabilities

Sure Alexis - I will add this to the agenda next week. Earlier this week Anil 
Belur was asking for the same to be on the agenda - but there was no time this 
week to have this.

On Fri, Feb 8, 2019 at 7:06 AM Alexis de Talhouet 
mailto:adetalhoue...@gmail.com>> wrote:



On Feb 8, 2019, at 10:00 AM, Brian mailto:bf1...@att.com>> 
wrote:

Since ONAP is Apache 2.0 and ODL is EPL we dont think we can build a 
distribution on the ONAP side that removes “ODL projects like TSDR, SXP
and similar”.   It would be awesome if ONAP could build its own distro but I 
dont think we know how to do that without tainting.

I tend to think we can. This is one of the things I want to discuss during ODL 
TSC when it is the good time.



-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#4593): https://lists.onap.org/g/onap-tsc/message/4593
Mute This Topic: https://lists.onap.org/mt/28708638/21656
Group Owner: onap-tsc+ow...@lists.onap.org
Unsubscribe: https://lists.onap.org/g/onap-tsc/leave/2743226/1412191262/xyzzy  
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [onap-discuss] [onap-tsc] Ubuntu and Alpine discussion

[ramki krishnan via Lists.Onap.Org]

Srini and Chaker bring up valid points.

The following is a nice comparison of various linux container images -- 
http://crunchtools.com/comparison-linux-container-images/.

Excerpt below from the article.
-
Architecture
When evaluating a container image, or any Linux distribution in general, it’s 
important to take some basic things into consideration. Which C library, 
package format and core utilities are used, may be more important than you 
think. Most 
distributions use the same tools, but Alpine Linux has special versions of all 
of these, for the express purpose of a making a small 
distribution.
 But, small is not all that matters.

Changing core libraries and utilities can have a profound effect on what 
software will compile and run. It can also affect 
performance, security and cause 
discreet failure with the large and complex software stacks that are common 
today. Distributions have tried moving to smaller C libraries, and eventually 
moved back to glibc. The Debian Project and 
Elastic are two examples. 
Glibc just works, and it works 
everywhere, and it has had a profound amount of testing and 
usage over the years. It’s a 
similar story with GCC – tons of testing and 
automation.

….

I run into more problems than I can count using alpine. (1) once you add a few 
packages it gets to 200mb like everyone else. (2) some tools require rebuilding 
or compiling projects. Resource costs are the same or higher. (3) no glibc. It 
uclibc. (4) my biggest concern is security. I don’t know these guys or the 
package maintainers.
---

Thanks,
Ramki

From: onap-disc...@lists.onap.org  On Behalf Of 
Chaker Al Hakim
Sent: Friday, February 8, 2019 6:34 AM
To: onap-disc...@lists.onap.org; sylvain.desbure...@orange.com; 
srinivasa.r.addepa...@intel.com; onap-tsc@lists.onap.org
Subject: Re: [onap-discuss] [onap-tsc] Ubuntu and Alpine discussion

Hi Team,

I was also on the TSC call and was engaged in the discussion as well. I agree 
with  Srini’s position that we should support ONAP on both  Ubuntu as well as 
Alpine Linux. Looking just at the disk image footprint as one driver to support 
only Alpine Linux may not be the best way to go; In addition, deploying ONAP on 
a base Linux that is not commercially supported may not be the best approach 
moving forward.

If the end goal of the Footprint Optimization is to ultimately support ONAP 
only on  Alpine Linux then this discussion becomes much broader then just 
footprint optimization and should be presented and discussed as such  at the 
ArchCom and at the the TSC level to make sure everyone is aware of the 
potential long term impact.


Regards,
Chaker


From: onap-disc...@lists.onap.org 
[mailto:onap-disc...@lists.onap.org] On Behalf Of Sylvain Desbureaux
Sent: Friday, February 08, 2019 4:11 AM
To: onap-disc...@lists.onap.org; 
srinivasa.r.addepa...@intel.com; 
onap-tsc@lists.onap.org
Subject: Re: [onap-discuss] [onap-tsc] Ubuntu and Alpine discussion

Hello Srini,

Fyi size of images on dockerhub may not be the same once downloaded (I don’t 
know why):

For example, alpine:3.9 is said at 3MB and ubuntu:18.04 is said at 32MB.
Once downloaded (on an x86_64 server), here’s what I have:

docker images
REPOSITORY  TAG IMAGE ID
CREATED SIZE
ubuntu  18.04   47b19964fb50
2 days ago  88.1MB
alpine  3.9 caf27325b298
8 days ago  5.53MB


Regards,

---
Sylvain Desbureaux

De : mailto:onap-disc...@lists.onap.org>> au nom 
de Srini 
mailto:srinivasa.r.addepa...@intel.com>>
Répondre à : "onap-disc...@lists.onap.org" 
mailto:onap-disc...@lists.onap.org>>, 
"srinivasa.r.addepa...@intel.com" 
mailto:srinivasa.r.addepa...@intel.com>>
Date : vendredi 8 février 2019 à 00:03
À : "onap-tsc@lists.onap.org" 
mailto:onap-tsc@lists.onap.org>>
Cc : "onap-disc...@lists.onap.org" 
mailto:onap-disc...@lists.onap.org>>
Objet : Re: [onap-discuss] [onap-tsc] Ubuntu and Alpine discussion

Hi Adolfo,

“Having said that, projects that can clearly demonstrate that they can't 
migrate to Alpine shou

[onap-tsc] New Plugins For Confluence

[Kenny Paul]

Over the past couple of week Jess has been adding some new productivity macros 
to confluence for us:

 

‘PlantUML’ https://avono-support.atlassian.net/wiki/spaces/PUML/overview 

‘JSON Viewer’ https://elitesoftware.atlassian.net/wiki/spaces/JVE/overview 

 ‘SQL’ 
https://bobswift.atlassian.net/wiki/spaces/SQL/pages/20971530/SQL-query+Macro 

‘Viewtracker’ 
https://wiki.bitvoodoo.ch/display/public/BVVIEWTRACKER/Viewtracker+App 

‘Mermaid’ https://mermaidjs.github.io/ 

‘Tableenhancer’ https://tngtech-oss.atlassian.net/wiki/spaces/TABENH/overview 

 

And probably a couple of others that I’m forgetting 😊

 

 

Thanks!

-Kenny


Kenny Paul,  ONAP Technical Program Manager 
  kp...@linuxfoundation.org
510.766.5945 Pacific time zone

 


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#4595): https://lists.onap.org/g/onap-tsc/message/4595
Mute This Topic: https://lists.onap.org/mt/29708109/21656
Group Owner: onap-tsc+ow...@lists.onap.org
Unsubscribe: https://lists.onap.org/g/onap-tsc/leave/2743226/1412191262/xyzzy  
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [onap-tsc] CALL FOR NOMINATIONS: ONAP TSC SPECIAL ELECTION

[Kenny Paul]

Ballots have been emailed to 503 qualified addresses. Voting will close Fri. 
Feb 22 @ 16:00 pacific time
On Thu, Feb 7, 2019 at 06:01 PM, Kenny Paul wrote:

> 
> Nominations are closed.  Your candidates are Ramki Krishnan from VMware 
> Timo Perala from Nokia.
> Ballots will go out as soon as I can generate the email addresses.

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#4596): https://lists.onap.org/g/onap-tsc/message/4596
Mute This Topic: https://lists.onap.org/mt/29533058/21656
Group Owner: onap-tsc+ow...@lists.onap.org
Unsubscribe: https://lists.onap.org/g/onap-tsc/leave/2743226/1412191262/xyzzy  
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-