Document certification issuing process #356

mbuechse · 2023-10-06T13:50:34Z

Resolves #337 and #346.
Supersedes #239.

mbuechse · 2023-10-09T10:06:57Z

josephineSei

I only have one bigger point, that maybe should be discussed in a meeting. Its about the interval of the tests repeated.

Standards/scs-xxxx-v1-achieving-certification.md

neuroserve · 2023-10-24T14:26:30Z

At point two I'd expect a link/reference to the (valid/versioned) "SCS compliance test suite". Same for the basis of the "classification" (e. g. what is meant by "light", "medium" and "heavy").

frosty-geek

added my 2¢ but overall LGTM either way

Standards/scs-xxxx-v1-achieving-certification.md

Standards/scs-0004-v1-achieving-certification.md

anjastrunk · 2023-11-09T07:50:30Z

Standards/scs-0004-v1-achieving-certification.md

+
+3. If the desired certificate requires manual checks, then the operator MUST offer the SCS project suitable access. Manual checks MUST be repeated once every 3 months.
+
+4. Details on the standards achieved, as well as the current state and the history of all test and check results will be displayed on a public webpage (henceforth, _certificate status page_) owned by SCS.


As we publish results of SCS conformance tests, we need the permission of CSP to do so in order to prevent any legally conficrts. I do not know, if this should be part of "Regulations for achieving SCS-compatible certification". However, we should keep this in mind and add an appropriate statement to SCS certificate's terms and conditions.

My understanding is that any CSP objecting to this kind of publication should NOT apply for certification. Nobody is being forced.

My understanding is that any CSP objecting to this kind of publication should NOT apply for certification. Nobody is being forced.

I agree. They can run their tests the same as non-public clouds for their own information and don't need to apply for the certification.

However, practically speaking there should be some retention period such as 5 years, not all time.

Would we remove test results for CSPs who no longer wish to be certified in case they recertify later?

I guess we need to write a little "SCS certification terms & conditions document" that states obligations and conditions. I don't want to sign individual contracts, so it's a T&C thing. (In German: Allgemeine Geschäftsbedingungen.)

Standards/scs-0004-v1-achieving-certification.md

anjastrunk

See comments inline.

Standards/scs-0004-v1-achieving-certification.md

garloff

Overall looks good to me.
I have a slight preference for "once per quarter" over "once every 3 months" because of the stated reasons. Feel free to apply this proposed change.
Next steps then would be to merge this and ask for opinions before we turn the draft into an approved document.

fdobrovolny

I now saw that I did a review a week ago but did not send it.

I added my two cents other than that LGTM.

fdobrovolny · 2023-11-15T15:55:54Z

Standards/scs-0004-v1-achieving-certification.md

+
+3. If the desired certificate requires manual checks, then the operator MUST offer the SCS project suitable access. Manual checks MUST be repeated once every 3 months.
+
+4. Details on the standards achieved, as well as the current state and the history of all test and check results will be displayed on a public webpage (henceforth, _certificate status page_) owned by SCS.


My understanding is that any CSP objecting to this kind of publication should NOT apply for certification. Nobody is being forced.

I agree. They can run their tests the same as non-public clouds for their own information and don't need to apply for the certification.

However, practically speaking there should be some retention period such as 5 years, not all time.

Would we remove test results for CSPs who no longer wish to be certified in case they recertify later?

Standards/scs-0004-v1-achieving-certification.md

mbuechse · 2023-11-23T09:09:57Z

I now saw that I did a review a week ago but did not send it.

I added my two cents other than that LGTM.

Thanks @fdobrovolny -- very good points! I added them to today's agenda.

Standards/scs-0004-v1-achieving-certification.md

fkr · 2024-01-10T12:12:14Z

I just talked to @mbuechse since I was missing the part of "things to check for compliance that requires system level access" - which will (of course) be done by the operator with a results file submitted to SCS.
@mbuechse and I agreed that we will open an issue for that and revisit that ONCE we have the first compliance check that requires this (since so far, we have none that require that).

fkr

Thanks @mbuechse for your efforts on this!

josephineSei

All my comments are of informational nature.

I put in a few implications this will have on airgapped and high-security infrastructures.

To summarize: this might be enough for operators of such infrastructures to not go for scs-compatability. I have no strong opinion on whether this is okay or not.

josephineSei · 2024-01-11T07:23:26Z

Standards/scs-0004-v1-achieving-certification.md

+
+   <!-- Initially this will probably be eMail -->
+
+3. If the desired certificate requires manual checks, then the operator MUST offer the SCS project suitable access. Manual checks MUST be repeated once every quarter.


In an airgapped scenario this would mean a real person has to go their and do the checks. And even that is not always possible, as the physical entrance to data centers may be restricted to certain persons. (I have already seen this in public cloud offerings).

josephineSei · 2024-01-11T07:26:33Z

Standards/scs-0004-v1-achieving-certification.md

+
+   For public clouds, it is recommended to offer the SCS project access to the infrastructure so the test suite runs can be triggered continuously by the SCS team.
+
+   Alternatively, and for non-public clouds, the results (log files) MUST be submitted to SCS by a mechanism of SCS' choice and need to be reproduced again on request by SCS.


We should have a set of options for providing the results ready. On some airgapped infrastructures getting information like that out of it is nearly impossible as every information is classified. That may even lead to a letter with printed logs, that need to be destroyed in certain ways after reading.

josephineSei · 2024-01-11T07:28:19Z

Standards/scs-0004-v1-achieving-certification.md

+
+3. If the desired certificate requires manual checks, then the operator MUST offer the SCS project suitable access. Manual checks MUST be repeated once every quarter.
+
+4. Details on the standards achieved, as well as the current state and the history of all test and check results of the past 18 months will be displayed on a public webpage (henceforth, _certificate status page_) owned by SCS.


As for some infrastructures we will talk about classified information, it would be very interesting to define exactly, what information will be displayed. (No need to do this here in this standard, but it will be good to have such information.)

Signed-off-by: alexander-diab <59739986+alexander-diab@users.noreply.github.com>

…ucture as per scs-0001 Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

…see #346) Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Signed-off-by: Kurt Garloff <kurt@garloff.de>

Co-authored-by: Kurt Garloff <kurt@garloff.de> Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

mbuechse mentioned this pull request Oct 6, 2023

Create certification-issuing-process.md #239

Closed

mbuechse linked an issue Oct 6, 2023 that may be closed by this pull request

Tracking and documenting compliance of clouds with SCS certificates #346

Closed

4 tasks

mbuechse mentioned this pull request Oct 6, 2023

Tracking and documenting compliance of clouds with SCS certificates #346

Closed

4 tasks

mbuechse force-pushed the issue/337 branch from 58ceed5 to a976802 Compare October 6, 2023 13:53

mbuechse marked this pull request as ready for review October 9, 2023 10:04

mbuechse requested review from fkr, garloff, alexander-diab, anjastrunk, josephineSei and jschoone October 9, 2023 10:05

mbuechse force-pushed the issue/337 branch from dd670af to d1551fc Compare October 9, 2023 10:08

josephineSei reviewed Oct 9, 2023

View reviewed changes

mbuechse requested a review from frosty-geek October 20, 2023 14:05

frosty-geek requested a review from neuroserve October 24, 2023 09:45

frosty-geek approved these changes Oct 24, 2023

View reviewed changes

berendt reviewed Oct 25, 2023

View reviewed changes

Standards/scs-xxxx-v1-achieving-certification.md Outdated Show resolved Hide resolved

Standards/scs-xxxx-v1-achieving-certification.md Outdated Show resolved Hide resolved

Standards/scs-xxxx-v1-achieving-certification.md Outdated Show resolved Hide resolved

anjastrunk reviewed Nov 9, 2023

View reviewed changes

Standards/scs-0004-v1-achieving-certification.md Show resolved Hide resolved

anjastrunk reviewed Nov 9, 2023

View reviewed changes

Standards/scs-0004-v1-achieving-certification.md Outdated Show resolved Hide resolved

anjastrunk reviewed Nov 9, 2023

View reviewed changes

Standards/scs-0004-v1-achieving-certification.md Show resolved Hide resolved

anjastrunk requested changes Nov 9, 2023

View reviewed changes

garloff reviewed Nov 17, 2023

View reviewed changes

Standards/scs-0004-v1-achieving-certification.md Outdated Show resolved Hide resolved

garloff reviewed Nov 17, 2023

View reviewed changes

Standards/scs-0004-v1-achieving-certification.md Outdated Show resolved Hide resolved

garloff approved these changes Nov 17, 2023

View reviewed changes

mbuechse mentioned this pull request Nov 17, 2023

Extra flavor specs are not set osism/openstack-flavor-manager#19

Closed

mbuechse force-pushed the issue/337 branch from 1897f20 to 122d2ec Compare November 17, 2023 21:28

fdobrovolny approved these changes Nov 21, 2023

View reviewed changes

anjastrunk reviewed Dec 6, 2023

View reviewed changes

Standards/scs-0004-v1-achieving-certification.md Show resolved Hide resolved

anjastrunk approved these changes Dec 6, 2023

View reviewed changes

fkr requested a review from flyersa January 10, 2024 11:42

fkr approved these changes Jan 10, 2024

View reviewed changes

josephineSei reviewed Jan 11, 2024

View reviewed changes

alexander-diab and others added 18 commits January 12, 2024 16:08

Create certification-issuing-process.md

e6f7ba7

Signed-off-by: alexander-diab <59739986+alexander-diab@users.noreply.github.com>

Replaced text with 2023-03-16 version, edited a bit, added formal str…

dd439fc

…ucture as per scs-0001 Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Moved/renamed file according to scs-0001

b05e06b

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Corrected section headings

0e065d8

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Corrected typography according to markdownlint

f03b455

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Tried to correct ordered list

cc181b4

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Refine regulations regarding continuous testing and result tracking (…

2675332

…see #346) Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Include test classification and related documents

ff69ea9

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Mention that classification refers to resource usage

40c51a6

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

added link to current test suite

5fbe151

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Pacify linter: use absolute path

9ec1d67

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Edits according to reviews and latest SIG team meeting

36baa46

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Rename document to assign a number

08ec200

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

clarify that SCS @ OSBA is the initial SCS CAB

f956787

Signed-off-by: Kurt Garloff <kurt@garloff.de>

Update Standards/scs-0004-v1-achieving-certification.md

543870a

Co-authored-by: Kurt Garloff <kurt@garloff.de> Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Add details regarding retention of the certificate status page

1028627

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Fix typo in Allliance

c24af41

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

Refine: submission of log files at least weekly

c3b04d7

Signed-off-by: Matthias Büchse <matthias.buechse@cloudandheat.com>

mbuechse force-pushed the issue/337 branch from 8e01728 to c3b04d7 Compare January 12, 2024 15:08

mbuechse merged commit b2c0c4f into main Jan 12, 2024
5 checks passed

mbuechse deleted the issue/337 branch January 12, 2024 15:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Document certification issuing process #356

Document certification issuing process #356

mbuechse commented Oct 6, 2023

mbuechse commented Oct 9, 2023

josephineSei left a comment

neuroserve commented Oct 24, 2023

frosty-geek left a comment

anjastrunk Nov 9, 2023

mbuechse Nov 9, 2023

fdobrovolny Nov 15, 2023

garloff Nov 17, 2023 •

edited

Loading

anjastrunk left a comment

garloff left a comment

fdobrovolny left a comment

fdobrovolny Nov 15, 2023

mbuechse commented Nov 23, 2023

fkr commented Jan 10, 2024

fkr left a comment

josephineSei left a comment

josephineSei Jan 11, 2024

josephineSei Jan 11, 2024

josephineSei Jan 11, 2024


		3. If the desired certificate requires manual checks, then the operator MUST offer the SCS project suitable access. Manual checks MUST be repeated once every 3 months.

		4. Details on the standards achieved, as well as the current state and the history of all test and check results will be displayed on a public webpage (henceforth, _certificate status page_) owned by SCS.


		<!-- Initially this will probably be eMail -->

		3. If the desired certificate requires manual checks, then the operator MUST offer the SCS project suitable access. Manual checks MUST be repeated once every quarter.


		For public clouds, it is recommended to offer the SCS project access to the infrastructure so the test suite runs can be triggered continuously by the SCS team.

		Alternatively, and for non-public clouds, the results (log files) MUST be submitted to SCS by a mechanism of SCS' choice and need to be reproduced again on request by SCS.

Document certification issuing process #356

Document certification issuing process #356

Conversation

mbuechse commented Oct 6, 2023

mbuechse commented Oct 9, 2023

josephineSei left a comment

Choose a reason for hiding this comment

neuroserve commented Oct 24, 2023

frosty-geek left a comment

Choose a reason for hiding this comment

anjastrunk Nov 9, 2023

Choose a reason for hiding this comment

mbuechse Nov 9, 2023

Choose a reason for hiding this comment

fdobrovolny Nov 15, 2023

Choose a reason for hiding this comment

garloff Nov 17, 2023 • edited Loading

Choose a reason for hiding this comment

anjastrunk left a comment

Choose a reason for hiding this comment

garloff left a comment

Choose a reason for hiding this comment

fdobrovolny left a comment

Choose a reason for hiding this comment

fdobrovolny Nov 15, 2023

Choose a reason for hiding this comment

mbuechse commented Nov 23, 2023

fkr commented Jan 10, 2024

fkr left a comment

Choose a reason for hiding this comment

josephineSei left a comment

Choose a reason for hiding this comment

josephineSei Jan 11, 2024

Choose a reason for hiding this comment

josephineSei Jan 11, 2024

Choose a reason for hiding this comment

josephineSei Jan 11, 2024

Choose a reason for hiding this comment

garloff Nov 17, 2023 •

edited

Loading