search

mojaloop / project

Repo to track product development issues for the Mojaloop project.
Other
24 stars 15 forks source link

DevSecOps Initiaitive Epic 2 - Architecture / Solution wide concerns #1127

Closed godfreykutumela closed 4 years ago

godfreykutumela commented 4 years ago

Context:

The OSS offering does not include nor suggests implementation strategies for the following solution-wide (architectural) concerns: • Identity management • Request routing • Request authentication and authorisation • Encryption at rest and in transit • Inter-service and service to infra authentication and authorisation.

This un-opinionated approach delegates these decisions to implementation parties, which could lead to strategic decision making outside the OSS project, as the first implementations drive these decisions - this in turn can lead to vendor-lock and/or reduced applicability of the OSS offering. Security and quality could decrease.

Objectives:

Consider if the OSS offering should: • Require standard and compliant ways of addressing the concerns above - enforce standards in code/services in a plugable/extensible way; • Go one step further and address the above concerns by delivering reference implementations

Story 1 – Simply and Optimize Code Branching

  1. Perform analysis on the current branching strategy – Pedro
  2. Discuss and agree on best practice branching strategy to improve code quality and security - All
  3. Document new process\scripts - Godfrey

Story 2 - Simplify API Gateway Implementation and Management

  1. Review the current level of dependency on WS02 and the overall strategy to use WS02 – All
  2. Deliberate a new API gateway service breakdown to avoid possible future lock-ins -All
  3. Explore other simple out of the box ways of implementation an API gateway – Godfrey & Pedro
  4. Document and communicate the epic output - Godfrey

Story 3 - Identity and Access Management Architecture Review

  1. Review the current identity management within Mojaloop – All
  2. Review how credential management is handled today and recommend improvement – Godfrey & Victor
  3. Document and communicate the epic output - Godfrey
lewisdaly commented 4 years ago

Closing this Epic in favour of unified DevSecOps epic: https://github.com/mojaloop/project/issues/1213