BCEFJKLMNOPQRSTUVWXYZAAABACADAEAFAG
1
Goal for v1.0:
- cloud native compliance
- k8s-native - best practices
- cntt r2 compliance
2
CCDPRequirementBusiness requirementWhy?Test traceability - existing test coverage (eg. OPNFV, K8s e2e, CNF Conformance)Potential OVP category (eg. base, performance, ONAP)Comments
3
Cloud native/K8s native Functional requirement
4
CCDP-002Container is responsive after a resetCNF Conformance:
- Resetting the container and checking to see if the CNF comes back up

ONAP:
- example test checking for recovery
5
CCDP-003Container provides API for health status monitoringCNF Conformance:
- liveness entry in the helm chart
- readiness entry in the helm chart

"Always define liveness and readiness probes in the pod definitions." https://www.openshift.com/blog/14-best-practices-for-developing-applications-on-openshift
6
CCDP-004CNF services work as expected after being rescheduled to a new node

Note: CNF may need to say "K8s Workload"		CNF Conformance
- Using upstream projects for chaos engineering (e.g Litmus)		CNF should not retain node specific state which causes it to fail when scheduled to a new node. CNF should restablish connections to other services (including CNFs) as needed automatically leverging orchestration
7
CCDP-005Container is OCI compliantCNF Conformance:
- Is the container image OCI compliant
8
CCDP-006Recommendation: Container should run in an unprivileged modeCNF Conformance:
- Check if any containers are running in privileged mode		What about different runtimes? What about Kata containers?
9
CCDP-007Recommendation: Container should execute process as non-root userSE-Linux based environments will require dropping root privileges. Example: OpenShift

Potential test: look at Dockerfile for user mapping

https://engineering.bitnami.com/articles/running-non-root-containers-on-openshift.html
https://docs.openshift.com/container-platform/3.3/creating_images/guidelines.html
https://docs.openshift.com/enterprise/3.2/admin_guide/manage_scc.html
10
CCDP-008Container does not require local persistent storage

"A container may use local storage if available, but must not rely on it for persistent storage of data"		CNF Conformance
- Test for stateful storage on local volumes
- Test for K8s volume usage
- Test if killing a node means data is lost or not accessible by the CNF when it is rescheduled
- Test if killing a pod means data is lost or not accessible by the CNF when it is rescheduled
- Test if killing a container means data is lost or not accessible by the CNF when it is rescheduled
11
CCDP-009K8s Workload resource (Pod, Deployment, ReplicaSet) works as expected after being rescheduled to a new node

Note: related to CCDP-004
12
A container may use local storage if available, but must not rely on it for persistent storage of data

(May be a duplicate of CCDP-008. Probably should be merged)		CNF Conformance
- Test if killing a node means data is lost or not accessible by the CNF when it is rescheduled
- Test if killing a pod means data is lost or not accessible by the CNF when it is rescheduled
- Test if killing a container means data is lost or not accessible by the CNF when it is rescheduled		merged with CCDP-0008
13
Containers should be runtime isolated from containers in another Podin another K8s Workload (resource?)
14
15
Shared resource access between containers in different Pods should be managed by orchestrationShared resources between K8s Workload resources should be managed by orchestration
16
Containers should be runtime isolated from one another
17
Containers should be runtime isolated from the hostCNF Conformance:
- Check if any containers are running in privileged mode
- Check if any protected directories or files are accessed
18
Container trust can be validated:
- signed image
- scanned for vulnerabilities
...		CNF Conformance:
- Is the container (image) signed ticket #78
- Has the image been scanned for vulnerabilities
19
Works with any Certified Kubernetes productCNF Conformance:
- Checks alpha endpoint usage
- Checks beta endpoint usage
- Checks generally available (GA) endpoint usage
20
Should work with any CNI-compatible networkdifficult to support every CNI implementation since the pod spec is different for each. there are examples of doing this but not sure if this should be a requirement... even SHOULD

Required: network application probe testing. Eg. ability to send network traffic through the application to validate it functions for each CNI tested
21
22
Containers in a K8s Workload resource (Pod, Deployment, ReplicaSet) work as expected after being rescheduled to a new nodeIs this needed?

scheduling happens at the workload resource level. testing should focus on workload resource vs the insides of those resources when possible
23
24
25
Has a startup time less than X seconds/minutes/hoursService Level Agreements + Service Level Objectives- New services will be made available sooner.
- Failed services can be repalced in a faster time allowing less down time.
- Upgrading or deploying security fixes will be faster		CNF Conformance
- Check if the CNF have a reasonable startup time.		TODO: decide on requirement wording that is not so ambigous that someone can say 5 minutes is reasonable.

TC: IMO, this should follow best practices from the cloud nativeĀ±K8s community not existing Telecom expectations.

Currently the reasonable startup time test waits 25 seconds. This is configurable.

- The cloud native/k8s community should decide on the best practice for CNF developers. (probably a low threshold)
- SPs should be able to decide what number is reasonable, which can be larger than the best pratices.

Victor: Need to specify when the timing is started. After image is on the node?
26
Image size should be less than NNN MbSmaller image size:
- decreases time to retrieve the image and deploy it to nodes
- is an indicator that the application may have been broken down into smaller self-contained microservices
- may indicate different orgnizational units are providing delievarables independtly supporting deployment at their different rates of change. Eg. fast security updates from one org can be deployed independetly 		CNF Conformance
- Check the image size of the CNF.
TODO: decide on requirement wording that is not so ambigous that someone can say 1GB is reasonable.

TC: IMO, this should follow best practices from the cloud nativeĀ±K8s community not existing Telecom expectations.
27
Upgradeable indepdently of other CNFs (application/Pod/container?)
28
CNF recovers if network connectivity is lostCNF Conformance:
- Litmus Chaos Experiment for Pod Network Loss [157]
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100