Resolve "Implement Security Context with CAPIF interconnection support"

Jorge Moratinosrequested to merge
OCF223-implement-security-context-with-capif-interconnection-support into staging

Proposers

  • Jorge Moratinos Salcines (Telefónica)

Description

Creation of security context must be implemented to support invoker that request a security context to reach an API offered by a provider registered on other CCF.

Acknowledgements

This work is funded by the European Commission through the project with Grant Agreement number . example HORIZON-JU-SNS-2022 FLEX-SCALE project with Grant Agreement number 101096909.

Edited by Jorge Moratinos

Merge request reports

helm/04_capif_services/charts/ocf-security/templates/configmap.yaml

+28 −21
Changes for helm/04_capif_services/charts/ocf-security/templates/configmap.yaml: 28 added lines, 21 removed lines.
Original line number Diff line number Diff line
@@ -4,25 +4,32 @@ metadata: 
  name: capif-security-configmap

data:

  config.yaml: |

    mongo: {

      'user': '{{ .Values.env.mongoInitdbRootUsername }}',

      'password': '{{ .Values.env.mongoInitdbRootPassword }}',

      'db': 'capif',

      'col': 'security',

      'capif_service_col': 'serviceapidescriptions',

      'certs_col': 'certs',

      'capif_invokers' : 'invokerdetails',

      'host': 'mongo',

      'port': "27017"

    }

    mongo:

      user: '{{ .Values.env.mongoInitdbRootUsername }}'

      password: '{{ .Values.env.mongoInitdbRootPassword }}'

      db: capif

      col: security

      capif_service_col: serviceapidescriptions

      certs_col: certs

      capif_invokers: invokerdetails

      col_interconnected: interconnected

      col_capif_configuration: capif_configuration

      col_capif_configuration: 'capif_configuration'

      host: '{{ .Values.env.mongoHost }}'

      port: '{{ .Values.env.mongoPort }}'



    monitoring: {

      "fluent_bit_host": fluent-bit,

      "fluent_bit_port": 24224,

      "opentelemetry_url": "otel-collector",

      "opentelemetry_port": "55680",

      "opentelemetry_max_queue_size": 8192,

      "opentelemetry_schedule_delay_millis": 20000,

      "opentelemetry_max_export_batch_size": 2048,

      "opentelemetry_export_timeout_millis": 60000

    }
 
 No newline at end of file
 
    monitoring:

      fluent_bit_host: fluent-bit

      fluent_bit_port: 24224

      opentelemetry_url: otel-collector

      opentelemetry_port: 55680

      opentelemetry_max_queue_size: 8192

      opentelemetry_schedule_delay_millis: 20000

      opentelemetry_max_export_batch_size: 2048

      opentelemetry_export_timeout_millis: 60000



    ca_factory:

      url: !ENV ${VAULT_HOSTNAME}

      port: !ENV ${VAULT_PORT}

      token: !ENV ${VAULT_ACCESS_TOKEN}

      verify: False

helm/04_capif_services/charts/ocf-security/values.yaml

+2 −0
Changes for helm/04_capif_services/charts/ocf-security/values.yaml: 2 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -24,6 +24,8 @@ env: 
  mongoInitdbRootPassword: example

  logLevel: "INFO"

  timeout: "30"

  mongoHost: mongo

  mongoPort: 27017



serviceAccount:

  # Specifies whether a service account should be created

services/TS29222_CAPIF_API_Invoker_Management_API/Dockerfile

+1 −1
Changes for services/TS29222_CAPIF_API_Invoker_Management_API/Dockerfile: 1 added line, 1 removed line.
Original line number Diff line number Diff line 
FROM labs.etsi.org:5050/ocf/capif/python:3-slim-bullseye

FROM labs.etsi.org:5050/ocf/capif/python:3.13-slim



RUN mkdir -p /usr/src/app

WORKDIR /usr/src/app

services/TS29222_CAPIF_API_Provider_Management_API/Dockerfile

+1 −1
Changes for services/TS29222_CAPIF_API_Provider_Management_API/Dockerfile: 1 added line, 1 removed line.
Original line number Diff line number Diff line 
FROM labs.etsi.org:5050/ocf/capif/python:3-slim-bullseye

FROM labs.etsi.org:5050/ocf/capif/python:3.13-slim



RUN mkdir -p /usr/src/app

WORKDIR /usr/src/app

services/TS29222_CAPIF_Access_Control_Policy_API/capif_acl/core/internal_service_ops.py

+11 −4
Changes for services/TS29222_CAPIF_Access_Control_Policy_API/capif_acl/core/internal_service_ops.py: 11 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -126,10 +126,17 @@ class InternalServiceOps(Resource): 
        current_app.logger.debug(f"Removing ACLs for invoker: {invoker_id}")

        mycol = self.db.get_col_by_name(self.db.acls)



        mycol.update_many({"api_invoker_policies.api_invoker_id": invoker_id},

                          {"$pull": {"api_invoker_policies": {

                              "api_invoker_id": invoker_id}}}

                          )

        acls = mycol.find({"api_invoker_policies.api_invoker_id": invoker_id}, {"_id": 0})

        for acl in acls:

            new_api_invoker_policies = [policy for policy in acl["api_invoker_policies"]

                                       if policy["api_invoker_id"] != invoker_id]

            acl["api_invoker_policies"] = new_api_invoker_policies

            if not acl["api_invoker_policies"]:

                mycol.delete_one({'service_id': acl["service_id"], 'aef_id': acl["aef_id"]})

            else:

                mycol.update_one({'service_id': acl["service_id"], 'aef_id': acl["aef_id"]}, {

                                  "$set": acl})



        RedisEvent("ACCESS_CONTROL_POLICY_UNAVAILABLE").send_event()

        current_app.logger.info(f"ACLs for invoker: {invoker_id} removed")