Versions Compared

Old Version 5

changes.mady.by.user Marina Adomeit

Saved on

compared with

New Version Current

changes.mady.by.user Marina Adomeit

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


This page contains information about roadmap for devops, but may include description to actual issues and developments.

RESPONSIBLE: Content is defined and maintained by devops team.

ActionDescriptionStatusDue DateAssigned toComment

Service Architecture Documented

Make a reference drawing of service architecture

Seamless Access Deployment Architecture

Status
colourGreen
titledone


Marina Marina, consult with Leif
Update the requirements for service operations

To reflect the service architecture that was documented

Seamless Access Operational Requirements

Status
colourGreen
titledone


Marina, consult with Leif
Deploy beta service

First node deployed by end of November. Docker environment was prepared and remaining nodes deployment should be an easy exercise.

Two production nodes in SUNET network are created. 

 Maria to check with Leif on creating the AWS machines.

Status
colourYellow
titleIN progress

Two production nodes are done


Maria, Leif
Definition for the hosting environment firewall capabilities

That will be implemented in all different environment. 

This becomes part of the service definition for baseline operations.

Seamless Access Operational Documentation

Status
colourGreen
titledone


Leif
Prepare the OLA

Marina received the GEANT template OLA 

https://docs.google.com/document/d/1vw-V9VsdRmiGa4lAI-wZlaHzHwSZ9GSMXcXRcg1JfA4/edit

Draft OLA prepared: https://wiki.geant.org/pages/resumedraft.action?draftId=114921107&draftShareId=f423f5ac-a6c2-40a8-8e97-7220fbf6ccb7&

Marina created draft, was checked with GEANT ops team. It was shared on 26th Nov with Jonny from sunet noc. 

Status
colourYellow
titleIN progress


First draft till 10th OctoberMarina (consult with Jonny)
Pen testing of the beta service

Agreed with DFN cert that the pen testing will be 3rd week of November. We should let them know about our readiness on first week of November.

2 types of pen testing will be done: no info then full info. First just give the domain. End then we give them the zone file.

Talk to heather  - report of the audit that was alreday done for the privacy audit. WAYF Cloud and P3W Security & Privacy Recommendations

First round done in 28th Nov.

Marina Adomeit to arrange with Klaus/dfn cert for the next pen testing round. 

Status
colourYellow
titleIN progress

Dependent on deploying beta serviceMarina via DFN cert (consult Leif, inform Jonny of results)
Code testing of code that is running as web app

Audit for modern Java Script. Marina is checking with Marcin. There seams to be capability for Java Script testing. Waiting to get info from Leif. 

Marina Adomeit to check again!


Status
colourGreen
titledone

IPR testing and security testing done by white source tool


Marina via Marcin (consult Leif, inform Jonny of results)
Get budget for the monitoring, and clean up the ops budget

status.io, pingdom.com

Marina will prepare the CR from Elena ... use 20 k and move to monitoring and VMs

Marina Adomeit to do the budget assignment 

Marina Adomeit remind Leif to agree which kind of licence we need for those  

WP5 leaders approved the 10k budget, need to make the CRFirst week OctoberMarina
Configure internal monitoring

Setup an idenpendent Nagios instance in SUNET.

Maria did the most of the work. Some minor things and integration with Slack is left over.

Status
colourGreen
titledone



Maria
Organise purchase of supporting services

status.io

pingdom.com

CDN

Marina Adomeit to talk to Nicole to do the PO for this

Status
colourGreen
titledone
 for status.io and pingdom.con 

Status
titlenot started
 for CDN

End November....Marina to initiate via Task 3
Configure external monitoringLeif, Maria, MarinaSet the public status pagesLeif, Maria, Marina

Nagios - done!!!, integration in slack in progress

status.io - 

Pingdom - 

Once licence is available move to the licensed instance

Status
colourGreen
titledone

End October (with deployment of beta service)Maria
Prepare the financial consumption reporting

when all supporting services are purchasedMarina
Prepare the ops reportingMarina regular checks with Maria, every Friday 12:00

Status
colourGreen
titledone


Marina
Check the GDPR

User never touches any of the nodes that are maintained by seamless access.org. The only interaction point is the CDN. Their privacy policy and DPA should be checked!!! 

technology-compliance

Document the data flow for Seamless Access https://docs.google.com/presentation/d/1emWsyTn6trMRCCNbTHrGHYHrajtHfOZl0--T70BFe_o/edit?usp=sharing 

Based on the data flow, Magdalena can review the GDPR

external audit on privacy statements - in 2020 as service proves viable

Status
colourGreen
titledone


Check the GDPRMarina via GEANT project GDPR
Check the IPR? Marina to consult with KlaasDefine the procedure for configuration changes

...

Leif needs to put the SUNET licence and check the the libraries

Magdalena organised code scanning for the libraries used and on 06.12.2019 confirmed all is in order: 

Regarding scanning of the code provided https://github.com/TheIdentitySelector in most of the files no source/binary files were detected, consequently no licence/vulnerabilities were detected. In the js-storage-master file there were 3 licences detected (MIT licences) – as this is permissive licence, there are no further issues with it. 

Marina Adomeit

Status
colourGreen
titledone


Leif, Marina to connect Leif to Magdalena
Configuration change, Release management, Regular updates process

Define the configuration change process. Should be reflected in the OLA. Have in mind other ops regions

Marina Adomeit to start writing this! 

Seamless Access Change Management Process

Status
colourGreen
titledone


Marina (consult with Jonny)
Support processDefine who the support process flow, the actors etc. Should be reflected in the OLA. Have in mind other ops regions. 

Status
colour

...

Yellow
title

...

IN progress


Marina (consult with Jonny) and take up with Heather
Service on boarding process

Status
colour

...

Yellow
title

...

IN progress



Formulate the L3 support Leif + certain members from the Technical Sterring group

Status
colourYellow
title

...

IN progress


Marina to take up with Heather
Service operations definition

Prepare a definition of the service ops baseline for additional operators of the service.

Security groups and firewall

Status
titlenot started


Marina and Maria, consult with Leif, Tech Steerting group for approval. 
For service production move all service components to stabile environment
  • Install new nodes in the AWS infrastructure - Planned for May 2020.  - delayed to  June/July 2020 (Maria will do the first one, and Berra will do the second one) DONE
  • Add api key auth servers to each node. Update the diagram. Waiting for Leif to finish development.
  • Handover to SUNET NOC and engaging Erik in the SA engineering - Marina sent email to Jonny 24 April 2020. -  in progress 
  • Move of DNS to a service that is served from multiple AS domains and that has global presence. Agreed to move to netnode service, which costs approx 20e per month. SUNET NOC will be able to admin this through an UI. We need to this setup of frobit. We will use webui same way we do for Sweden connect. Leif will do this - couple of weeks to finish this - aim to do this till end of October 2020. Enable 2 factor, Erik and Maria to figure out how to add Id - everybody who should access it to create identities with MFA.  Leif will talk to frobit. Erik/Maria and Leif will have access.

Marina Adomeit

  • Move away from serving origin service from the github pages. Agreed to serve origin from our own infrastrucutre, to build origin as docker container, and to serve it from each MD node as well. Start work in this in June 2020. One container per site is enough, redundancy is not necessary as it is static html. Create an A record for all those dresses and use this as origin.thiss.org ? Build mechanism for this contained exists in ?. We need to build orchestrations for the container, puppet, environment variable. Whitelist we can stick in yaml file.
    • Who develops puppet manifest - Leif will give instruction and Berra/Maria will do it
    • Couple of weeks, spin up a bunch of VM prepare everything.
    • Fastly will be used for load balancing - we can switch in parallel with GitHub pages. Add one by one in faulty by adding weight. Fastly can monitor backends - we can define a service test that looks at the manifest version. First change at least one backend, change test, and then change all other backends.
    • Deploying will be easy. 
  • Marina Adomeit check this with Leif. 

Status
colourYellow
titleIN progress



Handover to Noc

OLA review - in progress

Change management - in process

Monitoring: 

  • add monitors to nagios xi - metadata freshness (done), thiss-js validity (needs feature requests), all security and os updates are done
  • change Marias account to generic SUNET NOC for pingdom and status.io
  • update monitoring documentation in the geant wiki 

Finalize move of the DNS 

Define test procedure for the Change management process

Add the escalation paths for the TTP

Limit access to geant wiki... 

Add references in sunet ops wiki to geant wiki

Other documentation missing: 

  • add description to deployment guide of how the rollback procedure is done  
  • Document what is function of each server- who has access to them, how to troubleshoot and to test.  This needs to be documented in the geant wiki. 




Marina Adomeit to enable that Heather can cover when on vacation for deployment - enable heather to publish the maintenance  ... 

Marina Adomeit registration process - look at the airtable and registration form

  • internationalisation in searching - when we index metadata only English language strings are indexed. This adds multi language capability for : name and description . it doesent change name displayed - that is next version - it at least allows searches.
  • announce for beta in few days and production in 10 days ... 



Other ideas: talk to leif about moving away trom ssl/tls  certificates provided by fastly to our own?RedtitleCanceled