diff options
author | 2019-09-27 16:35:58 +0000 | |
---|---|---|
committer | 2019-09-27 16:38:56 +0000 | |
commit | 1900f7672eb60fcd2ac31da1ac30ebb8739b2124 (patch) | |
tree | 9afb5f4e1045988ae0b10802df62bb3e72e151c6 /docs | |
parent | 4c580f0458c40d27f4393cf46e462c5afcab1963 (diff) |
VNFRQTS - Updating release notes and fixing updated links
Issue-ID: VNFRQTS-718
Signed-off-by: Hagop Bozawglanian <hagop.bozawglanian@att.com>
Change-Id: Ib5d53309067d5a2930e8b75e6727f5014ed247e3
Diffstat (limited to 'docs')
7 files changed, 286 insertions, 33 deletions
diff --git a/docs/Chapter5/Heat/ONAP Heat Orchestration Template Format.rst b/docs/Chapter5/Heat/ONAP Heat Orchestration Template Format.rst index 96d0b1b..a23f217 100644 --- a/docs/Chapter5/Heat/ONAP Heat Orchestration Template Format.rst +++ b/docs/Chapter5/Heat/ONAP Heat Orchestration Template Format.rst @@ -565,7 +565,7 @@ be provided in place, or via a function :target: VNF :keyword: MUST NOT :validation_mode: static - :updated: dublin + :updated: el alto A VNF's Heat Orchestration Template resource attribute ``property:`` **MUST NOT** use more than two levels of nested ``get_param`` intrinsic diff --git a/docs/Chapter5/Heat/ONAP Heat Orchestration Templates Overview.rst b/docs/Chapter5/Heat/ONAP Heat Orchestration Templates Overview.rst index 7e55487..144235d 100644 --- a/docs/Chapter5/Heat/ONAP Heat Orchestration Templates Overview.rst +++ b/docs/Chapter5/Heat/ONAP Heat Orchestration Templates Overview.rst @@ -264,7 +264,7 @@ Base Modules :target: VNF :keyword: MUST :validation_mode: static - :updated: dublin + :updated: el alto A VNF Heat Orchestration Template's Base Module file name **MUST** include case insensitive 'base' in the filename and @@ -302,7 +302,7 @@ Incremental Modules :target: VNF :keyword: MUST :validation_mode: static - :updated: dublin + :updated: el alto VNF Heat Orchestration Template's Incremental Module file name **MUST** contain only alphanumeric characters and underscores @@ -350,6 +350,7 @@ Cinder Volume Modules :keyword: MUST :validation_mode: static :introduced: dublin + :updated: el alto A VNF Heat Orchestration Template's Cinder Volume Module ``resources:`` section @@ -381,7 +382,7 @@ Nested Heat file :target: VNF :keyword: MUST :validation_mode: static - :updated: dublin + :updated: el alto VNF Heat Orchestration Template's Nested YAML file name **MUST** contain only alphanumeric characters and underscores '_' and diff --git a/docs/Chapter5/Heat/ONAP Heat Resource ID and Parameter Naming Convention/Nova Parameters.rst b/docs/Chapter5/Heat/ONAP Heat Resource ID and Parameter Naming Convention/Nova Parameters.rst index 01edae9..1f11d02 100644 --- a/docs/Chapter5/Heat/ONAP Heat Resource ID and Parameter Naming Convention/Nova Parameters.rst +++ b/docs/Chapter5/Heat/ONAP Heat Resource ID and Parameter Naming Convention/Nova Parameters.rst @@ -30,7 +30,7 @@ Requirement R-01455 defines how the ``{vm-type]`` is defined. :keyword: MUST :validation_mode: static :introduced: casablanca - :updated: dublin + :updated: el alto A VNF's Heat Orchestration Template's ``OS::Nova::Server`` resource's diff --git a/docs/Chapter5/Heat/ONAP Heat VNF Modularity.rst b/docs/Chapter5/Heat/ONAP Heat VNF Modularity.rst index 5d3d2ed..a64cf53 100644 --- a/docs/Chapter5/Heat/ONAP Heat VNF Modularity.rst +++ b/docs/Chapter5/Heat/ONAP Heat VNF Modularity.rst @@ -105,7 +105,7 @@ A VNF module (base, incremental, cinder) **MAY** support nested templates. :validation_mode: none :introduced: el alto - If a VNF’s Heat Orchestration Template’s Incremental Module contains two or + If a VNF's Heat Orchestration Template's Incremental Module contains two or more ``OS::Nova::Server`` resources, the ``OS::Nova::Server`` resources **MAY** define the same ``{vm-type}`` (as defined in R-01455) or **MAY** define different ``{vm-type}``. diff --git a/docs/Chapter7/Monitoring-And-Management.rst b/docs/Chapter7/Monitoring-And-Management.rst index 6dc8d4b..f727354 100755 --- a/docs/Chapter7/Monitoring-And-Management.rst +++ b/docs/Chapter7/Monitoring-And-Management.rst @@ -316,7 +316,7 @@ Data Structure Specification of the Event Record :introduced: casablanca :validation_mode: static :impacts: dcae - :updated: dublin + :updated: el alto The VNF or PNF provider **MUST** provide a YAML file formatted in adherence with the :ref:`VES Event Registration specification <ves_event_registration_3_2>` @@ -334,7 +334,7 @@ Data Structure Specification of the Event Record :introduced: casablanca :validation_mode: static :impacts: dcae - :updated: dublin + :updated: el alto The VNF or PNF provider **MUST** indicate specific conditions that may arise, and recommend actions that may be taken at specific thresholds, or if specific @@ -357,7 +357,7 @@ These changes may modify any of the following: :introduced: casablanca :validation_mode: in_service :impacts: dcae - :updated: dublin + :updated: el alto The events produced by the VNF or PNF **MUST** must be compliant with the common event format defined in the diff --git a/docs/Chapter7/VNF-On-boarding-and-package-management.rst b/docs/Chapter7/VNF-On-boarding-and-package-management.rst index 057599a..2587a45 100755 --- a/docs/Chapter7/VNF-On-boarding-and-package-management.rst +++ b/docs/Chapter7/VNF-On-boarding-and-package-management.rst @@ -129,7 +129,7 @@ Resource Description :target: VNF or PNF PACKAGE :keyword: MUST :introduced: casablanca - :updated: dublin + :updated: el alto :validation_mode: static The VNF or PNF package **MUST** provide :ref:`VES Event Registration <ves_event_registration_3_2>` @@ -328,7 +328,7 @@ Resource Control Loop :id: R-42018 :target: VNF or PNF :keyword: MUST - :updated: dublin + :updated: el alto The VNF or PNF Package **MUST** include documentation which must include all events (fault, measurement for VNF or PNF Scaling, Syslogs, State Change diff --git a/docs/changes-by-section-el-alto.rst b/docs/changes-by-section-el-alto.rst index 905785a..a088598 100644 --- a/docs/changes-by-section-el-alto.rst +++ b/docs/changes-by-section-el-alto.rst @@ -27,9 +27,9 @@ navigate to the Summary of Changes ------------------ -* **Requirements Added:** 1 -* **Requirements Changed:** 14 -* **Requirements Removed:** 2 +* **Requirements Added:** 9 +* **Requirements Changed:** 21 +* **Requirements Removed:** 3 Monitoring & Management > Data Structure Specification of the Event Record @@ -42,6 +42,26 @@ Requirements Changed .. container:: note + :need:`R-570134` + + The events produced by the VNF or PNF **MUST** must be compliant with the common + event format defined in the + :ref:`VES Event Listener<ves_event_listener_7_1>` + specification. + + +.. container:: note + + :need:`R-120182` + + The VNF or PNF provider **MUST** indicate specific conditions that may arise, and + recommend actions that may be taken at specific thresholds, or if specific + conditions repeat within a specified time interval, using the semantics and + syntax described by the :ref:`VES Event Registration specification <ves_event_registration_3_2>`. + + +.. container:: note + :need:`R-520802` The VNF or PNF provider **MUST** provide a YAML file formatted in adherence with @@ -54,24 +74,80 @@ Requirements Changed * Any special handling to be performed for that event +Monitoring & Management > Monitoring & Management Requirements > Security +------------------------------------------------------------------------- + + +Requirements Added +~~~~~~~~~~~~~~~~~~ + + .. container:: note - :need:`R-570134` + :need:`R-55634` - The events produced by the VNF or PNF **MUST** must be compliant with the common - event format defined in the - :ref:`VES Event Listener<ves_event_listener_7_1>` - specification. + If VNF or PNF is using Basic Authentication, then the VNF or PNF + **MUST** be in compliance with + `RFC7617 <https://tools.ietf.org/html/rfc7617>`_ for authenticating HTTPS + connections to the DCAE VES Event Listener. .. container:: note - :need:`R-120182` + :need:`R-33878` - The VNF or PNF provider **MUST** indicate specific conditions that may arise, and - recommend actions that may be taken at specific thresholds, or if specific - conditions repeat within a specified time interval, using the semantics and - syntax described by the :ref:`VES Event Registration specification <ves_event_registration_3_2>`. + The VNF or PNF **MUST** support one of the following authentication + methods for authenticating HTTPS connections to the DCAE VES Event + Listener: + + - The preferred method is Certificate Authentication + + - The non-preferred option is Basic Authentication. + + +.. container:: note + + :need:`R-43387` + + If the VNF or PNF is using Certificate Authentication, the + VNF or PNF **MUST** support mutual TLS authentication and the Subject + Name in the end-entity certificate MUST be used according to + `RFC5280 <https://tools.ietf.org/html/rfc5280>`_. + + Note: In mutual TLS authentication, the client (VNF or PNF) must + authenticate the server (DCAE) certificate and must provide its own + X.509v3 end-entity certificate to the server for authentication. + + +Requirements Changed +~~~~~~~~~~~~~~~~~~~~ + + +.. container:: note + + :need:`R-894004` + + If the VNF or PNF is using Basic Authentication, then when the VNF + or PNF sets up a HTTPS connection to the DCAE VES Event Listener, + the VNF or PNF **MUST** provide a username and password to the + DCAE VES Event Listener in the Authorization header and the VNF + or PNF MUST support one-way TLS authentication. + + Note: In one-way TLS authentication, the client (VNF or PNF) + must authentication the server (DCAE) certificate. + + +.. container:: note + + :need:`R-01427` + + If the VNF or PNF is using Basic Authentication, then the VNF or + PNF **MUST** support the provisioning of security and authentication + parameters (HTTP username and password) in order to be able to + authenticate with DCAE VES Event Listener. + + Note: The configuration management and provisioning software + are specific to a vendor architecture. ONAP Heat Orchestration Template Format > Heat Orchestration Template Structure > resources > properties @@ -191,6 +267,116 @@ Requirements Changed **MUST NOT** contain the case insensitive string ``base``. +ONAP Heat VNF Modularity +------------------------ + + +Requirements Added +~~~~~~~~~~~~~~~~~~ + + +.. container:: note + + :need:`R-610050` + + The same ``{vm-type}`` for a VNF's Heat Orchestration Template's + ``OS::Nova::Server`` resource (as defined in R-01455) **MAY** exist in + the VNF's Heat Orchestration Template's Base Module (or invoked nested yaml + file) and/or one or more of the VNF's Heat Orchestration Template's + Incremental Modules (or invoked nested yaml file). + + +.. container:: note + + :need:`R-610010` + + A VNF's Heat Orchestration Template's Base Module **MAY** declare zero, one, + or more than one ``OS::Nova::Server`` resource. A ``OS::Nova::Server`` + **MAY** be created in the base module or a nested yaml file invoked by the + base module. + + +.. container:: note + + :need:`R-610030` + + A VNF's Heat Orchestration Template's Incremental Module **MUST** + declare one or more ``OS::Nova::Server`` resources. A ``OS::Nova::Server`` + **MAY** be created in the incremental module or a nested yaml file invoked + by the incremental module. + + +.. container:: note + + :need:`R-610040` + + If a VNF's Heat Orchestration Template's Incremental Module contains two or + more ``OS::Nova::Server`` resources, the ``OS::Nova::Server`` resources + **MAY** define the same ``{vm-type}`` (as defined in R-01455) or **MAY** + define different ``{vm-type}``. + + Note that + + - there is no constraint on the number of unique ``{vm-type}`` defined in + the incremental module. + - there is no constraint on the number of ``OS::Nova::Server`` resources + that define the same ``{vm-type}`` in the incremental module. + - if an ``OS::Nova::Server`` is created in a nested yaml file invoked by + the incremental module, the nested yaml file **MUST NOT** contain more + than one ``OS::Nova::Server`` resource (as defined in R-17528). + + +.. container:: note + + :need:`R-610020` + + If a VNF's Heat Orchestration Template's Base Module contains two or more + ``OS::Nova::Server`` resources (created in the base module itself and/or + in a nested yaml file invoked by the base module), the ``OS::Nova::Server`` + resources **MAY** + define the same ``{vm-type}`` (as defined in R-01455) or **MAY** + define different ``{vm-type}``. + + Note that + + - there is no constraint on the number of unique ``{vm-type}`` defined in + the base module. + - there is no constraint on the number of ``OS::Nova::Server`` resources + that define the same ``{vm-type}`` in the base module. + - if an ``OS::Nova::Server`` is created in a nested yaml file invoked by + the base module, the nested yaml file **MUST NOT** contain more than one + ``OS::Nova::Server`` resource (as defined in R-17528). + + +PNF Plug and Play > PNF Plug and Play +------------------------------------- + + +Requirements Changed +~~~~~~~~~~~~~~~~~~~~ + + +.. container:: note + + :need:`R-763774` + + The VNF or PNF **MUST** support a HTTPS connection to the DCAE + VES Event Listener. + + +Requirements Removed +~~~~~~~~~~~~~~~~~~~~ + + +.. container:: note + + R-579051 + + The PNF **MAY** support a HTTP connection to the DCAE VES Event Listener. + + Note: HTTP is allowed but not recommended. + + Resource: OS::Nova::Server - Parameters --------------------------------------- @@ -245,6 +431,15 @@ Requirements Changed .. container:: note + :need:`R-23311` + + The VNF's Heat Orchestration Template's base module or incremental module + resource ``OS::Nova::Server`` property + ``availability_zone`` parameter **MUST** be declared as type: ``string``. + + +.. container:: note + :need:`R-98450` A VNF's Heat Orchestration Template's base module or incremental module @@ -259,15 +454,6 @@ Requirements Changed increment by one. -.. container:: note - - :need:`R-23311` - - The VNF's Heat Orchestration Template's base module or incremental module - resource ``OS::Nova::Server`` property - ``availability_zone`` parameter **MUST** be declared as type: ``string``. - - VNF On-boarding and package management > Resource Control Loop -------------------------------------------------------------- @@ -301,6 +487,22 @@ Requirements Changed for all VES events provided by that VNF or PNF. +VNF Security > VNF Cryptography Requirements +-------------------------------------------- + + +Requirements Changed +~~~~~~~~~~~~~~~~~~~~ + + +.. container:: note + + :need:`R-49109` + + The VNF or PNF **MUST** support HTTPS using TLS v1.2 or higher + with strong cryptographic ciphers. + + VNF Security > VNF General Security Requirements ------------------------------------------------ @@ -318,6 +520,15 @@ Requirements Changed requirements, and, optionally, other relevant national equivalents. +.. container:: note + + :need:`R-258686` + + The VNF application processes **SHOULD NOT** run as root. If a VNF + application process must run as root, the technical reason must + be documented. + + VNF Security > VNF Identity and Access Management Requirements -------------------------------------------------------------- @@ -352,3 +563,44 @@ Requirements Removed PCRF, PCEF) that enable dynamic security control by blocking the malicious traffic or malicious end users. + +VNF or PNF CSAR Package > VNF Package Contents +---------------------------------------------- + + +Requirements Changed +~~~~~~~~~~~~~~~~~~~~ + + +.. container:: note + + :need:`R-01123` + + The VNF or PNF package Manifest file **MUST** contain: VNF or PNF + package meta-data, a list of all artifacts (both internal and + external) entry's including their respected URI's, as specified + in ETSI GS NFV-SOL 004 + + +VNF or PNF CSAR Package > VNF or PNF Package Authenticity and Integrity +----------------------------------------------------------------------- + + +Requirements Changed +~~~~~~~~~~~~~~~~~~~~ + + +.. container:: note + + :need:`R-130206` + + If the VNF or PNF CSAR Package utilizes Option 1 for package security, then + the complete CSAR file **MUST** contain a Digest (a.k.a. hash) for each of + the components of the VNF or PNF package. The table of hashes is included + in the package manifest file, which is signed with the VNF or PNF provider + private key. In addition, the VNF or PNF provider MUST include a signing + certificate that includes the VNF or PNF provider public key, following a + TOSCA pre-defined naming convention and located either at the root of the + archive or in a predefined location specified by the TOSCA.meta file with + the corresponding entry named "ETSI-Entry-Certificate". + |