1. Network Slice Selection Function (NSSF) Cloud Native Installation Guide
  2. Customizing NSSF
  3. NSSF Configurable Parameters

NSSF Configurable Parameters

NS-Selection

Table 5-1 NS-Selection

Helm Parameter Description Default Value Mandatory (M)/ Optional (O) Accepted Values Notes
omeMcc MCC of PLMN of Home network   M 3 digit integer value Used when Ns-Selection GET request comes without TAI
homeMnc MNC of PLMN of Home network   M 2/3 digit integer value Used when Ns-Selection GET request comes without TAI
nrfUrl URL of NRF   M Valid URL  
reqnftime When set to true AMF can send current time as Http Header FALSE O TRUE/FALSE

This field is used when time based network slice is enabled. If set to true time sent by AMF is used to get time profile based slice

When not then current local time of NSSF is used to get Slice.
outboundProxy Value of outbound proxy for NSSF   O Host-name/IP address:port of outbound proxy  
features.nrfdiscovery Flag to enable / disable NRF discovery for each GET request on NS-Selection Initial Register and Update Config request FALSE O TRUE/FALSE  
features.relevance Flag to enable / disable Relevance feature FALSE O TRUE/FALSE

When enabled, in conjection with features.candidateResolution.

NSSF will apply relevance algorithm to select/sort Candidate AMFs as a response to Initial register or UE config update request which are part of selected Target AMF Set.
features.candidateResolution Flag to enable / disable Candidate Resolution feature FALSE O TRUE/FALSE

When this feature is set to false NSSF returns TargetAMFSetId and TargetAMFRegionId for NS-Selection GET request for Initial Register message and UE-Config update.

When this feature is set to true NSSF computes and returns Candidate AMF list for NS-Selection GET request for Initial Register message and UE-Config update.
nrfDiscoveryProperties.disclimit Max Number of AMFs set on NRF discovery request 5 Mandatory when features.nrfdiscovery is set to true 2-10 This is accepted only when nrfDiscovery is set to true.
candidateResolutionProperties.maxcandidates: Maximum number of candidate AMFs 3 Mandatory when features.candidateResolutionis set to true 2-10 This value is accepted only when candidateResolution is enabled.

global.databaseSecretName

This parameter is the name of Kubectl secret which contains Username and password for Database.

   M Kubernetes Secret file name

Creation of Secrets must be done before installation of NSSF.
mysql.primary.host Primary MYSQL Host IP or Hostname ocnssf-mysq M Primary Mysql HostName or IP

OCNSSF will connect Primary MYSQL if not available then it will connect secondary host.

For MYSQL Cluster use respective IP Address or Mysql Host or Service
mysql.secondary.host Secondary MYSQL Host IP or Hostname ocnssf-mysql M Secondary Mysql HostName or IP For MYSQL Cluster use respective Secondary IP Address or Mysql Host or Service
mysql.port Port of MYSQL Database 3306 M Port of MySQL Database  
image.repository Full Image Path   M Full image path of image  
log.level Logging level INFO O INFO, DEBUG, FATAL, ERROR, WARN Logging level

NS-Availability

Table 5-2 NS-Availability

Helm Parameter Description Default Value Mandatory (M)/ Optional (O) Accepted Values Notes
maxExpiryDuration Max duration (in Hours) upto which AMF can subscribe to NSSF 240 O 100-1000

Max Expiry duration must be more than Min Expiry duration.

Requesting more than max expiry duration will be gruanted the value which is configured.
minExpiryDuration Min duration (in Hours) of a valid subscription towards NSSF 0 O 0-100 Request lesser than configured value shall be rejected.

global.databaseSecretName

This parameter is the name of Kubectl secret which contains Username and password for Database.

   M Kubernetes Secret file name

Creation of Secrets must be done before installation of NSSF.
mysql.primary.host Primary MYSQL Host IP or Hostname ocnssf-mysq M Primary Mysql HostName or IP

OCNSSF will connect Primary MYSQL if not available then it will connect secondary host.

For MYSQL Cluster, use respective IP Address or Mysql Host or Service.
mysql.secondary.host Secondary MYSQL Host IP or Hostname ocnssf-mysql M Secondary Mysql HostName or IP For MYSQL Cluster, use respective Secondary IP Address or Mysql Host or Service.
mysql.port Port of MYSQL Database 3306 M Port of MySQL Database  
image.repository Full Image Path   M Full image path of image  
log.level Logging level INFO O INFO, DEBUG, FATAL, ERROR, WARN Logging level

NS-Config

Table 5-3 NS-Config

Helm Parameter Description Default Value Mandatory (M)/ Optional (O) Accepted Values Notes
nrf: subscription Flag to enable subscription to NRF based on Target AMF set and Region Id TRUE M TRUE/FALSE When set to true, NSSF subscribes to get all the AMFs added/deleted on Target AMF set and Target AMF region is configured to NRF. NS-Policy: nrfDiscovery and NS-Config: nrf: Subscription are mutually exclusive.
notificationHandlerUrl URL at which NS-Config MS receives notifications   When nrf.subscription is set to true then Mandatory Valid URL This is the URL where NRF sends notifications when nrf:subscription is set to true.
mysql.primary.host Primary MYSQL Host IP or Hostname ocnssf-mysql M Primary Mysql HostName or IP

OCNSSF will connect Primary MYSQL if not available then it will connect secondary host.

For MYSQL Cluster use respective IP Address or Mysql Host or Service.

global.databaseSecretName

This parameter is the name of Kubectl secret which contains Username and password for Database.

   M Kubernetes Secret file name

Creation of Secrets must be done before installation of NSSF.
mysql.secondary.host Secondary MYSQL Host IP or Hostname ocnssf-mysql M Secondary Mysql HostName or IP For MYSQL Cluster use respective Secondary IP Address or Mysql Host or Service.
mysql.port Port of MYSQL Database 3306 M Port of MySQL Database  
image.repository Full Image Path   M Full image path of image  
log.level Logging level INFO O INFO, DEBUG, FATAL, ERROR, WARN Logging level

NS-Subscription

Table 5-4 NS-Subscription

Helm Parameter Description Default Value Mandatory (M)/ Optional (O) Accepted Values Note
httpMaxRetries Number of retry s to be done when AMF does not respond to Notification. 3 M 2-5  

global.databaseSecretName

This parameter is the name of Kubectl secret which contains Username and password for Database.

   M Kubernetes Secret file name

Creation of Secrets must be done before installation of NSSF.
mysql.primary.host Primary MYSQL Host IP or Hostname ocnssf-mysq M Primary Mysql HostName or IP

OCNSSF connects Primary MYSQL, if not available then it will connect secondary host.

For MYSQL Cluster use respective IP Address or Mysql Host or Service
mysql.secondary.host Secondary MYSQL Host IP or Hostname ocnssf-mysql M Secondary Mysql HostName or IP For MYSQL Cluster use respective Secondary IP Address or Mysql Host or Service
mysql.port Port of MYSQL Database 3306 M Port of MySQL Database  
image.repository Full Image Path   M Full image path of image  
log.level Logging level INFO O INFO, DEBUG, FATAL, ERROR, WARN Logging level

Common Micro Services

Ingress Gateway

Table 5-5 Ingress Gateway

Parameter Description Default Value Mandatory (M)/Optional (O) Range or Possible Values (If applicable) Notes
global.dockerRegistry Name of the Docker registry which hosts Ingress docker images. NA M   This is the registry which has docker images. Change this value if there is a need.
global.type type of service LoadBalancer M ClusterIP, NodePort, LoadBalancer and ExternalName  
global.serviceAccountName Service Account name '' O    
global.metalLbIpAllocationEnabled Enable or disable IP Address allocation from Metallb Pool true O    
global.metalLbIpAllocationAnnotation Address Pool Annotation for Metallb metallb.universe.tf/address-pool: signaling No    
global.staticIpAddressEnabled

If Static load balancer IP needs to be set, then set staticIpAddressEnabled flag to true and provide value for staticIpAddress

Else random IP will be assigned by the metalLB from its IP Pool

 false No    
global.staticIpAddress StaticIp 10.75.212.60      
global.publicHttpSignalingPort Http Signalling port 80 M    
global.publicHttpsSignallingPort Https Signalling port 443 M    
global.staticNodePortEnabled Node Port Enabled true No    
global.staticHttpNodePort Http Node Port 30075 M    
global.staticHttpsNodePort Https Node Port 30043 M    
enableOutgoingHttps Enabling it for outgoing https request false M   Change it to true for enabling https for outgoing requests.
enableIncomingHttp Enabling it for incoming http request false M    
enableIncomingHttps Enabling it for incoming https request true M    
enablehttp1 Enable it for http1.1 false No   Change it to true to enable
dnsRefreshDelay Dns Refresh Delay in milli-seconds 120000 No    
oauthValidatorEnabled Oauth Validator Enabled false M   Change it to true to enable oauth
jaegerTracingEnabled Enable jaeger tracing false No   Change it to true if needed.
openTracing.jaeger.udpSender.host Jaeger Host jaeger-agent.cne-infra M (If jaegerTracingEnabled is true)    
openTracing.jaeger.udpSender.port Jaeger Port 6831 M (If jaegerTracingEnabled is true)    
openTracing.jaeger.probabilisticSampler Jaeger sampling frequency 0.5 M (If jaegerTracingEnabled is true)    
nfType NFType of service producer. Value to be updated accordingly M (When oauthValidatorEnabled)    
nfInstanceId: NF InstanceId of service producer. Value to be updated accordingly M (When oauthValidatorEnabled)    
producerScope: Comma-seperated list of services hosted by service producer. Value to be updated accordingly M (When oauthValidatorEnabled)    
allowedClockSkewSeconds set this value if clock on the parsing NF(producer) is not perfectly in sync with the clock on the NF(consumer) that created the JWT. 0 M (When oauthValidatorEnabled)    
nrfPublicKeyKubeSecret Name of the secret which stores the public key(s) of NRF. Value to be updated accordingly M (When oauthValidatorEnabled)    
nrfPublicKeyKubeNamespace Namespace of the NRF publicKey Secret Value to be updated accordingly M (When oauthValidatorEnabled)    
validationType Values can be "strict" or "relaxed"."strict" means that incoming request without "Authorization"(Access Token) header will be rejected. "relaxed" means that if incoming request contains "Authorization" header, it will be validated. If incoming request doesnot contain"Authorization" header, validation will be ignored. Value to be updated accordingly M (When oauthValidatorEnabled)    
producerPlmnMNC MNC of service producer. Value to be updated accordingly No    
producerPlmnMCC MCC of service producer. Value to be updated accordingly No    
cnccIamEnabled CNCC Identity-Access-Management(IAM) false No   Change it to true if required
ingressGwCertReloadEnabled   true No    
rateLimiting.enabled Ratelimiting feature enabled true No    
routeRateLimiting.enabled Route based ratelimiting feature enabled true No    
globalIngressRateLimiting.enabled Global rate limiting is enabled true No    
globalIngressRateLimiting.duration Iterations of time duration(In seconds) for which bucketCapacity and refillRate are reset. 1(in seconds) M(if globalIngressRateLimiting.enabled)    
globalIngressRateLimiting.burstCapacity Holds maximum number of tokens in the bucket for the given duration. 1 M(if globalIngressRateLimiting.enabled)    
globalIngressRateLimiting.refillRate Number of tokens to be added to the bucket for the given duration 1 M (if globalIngressRateLimiting.enabled)    
ssl.privateKey.k8SecretName Name of the privatekey secret n/a M (If enableIncomingHttps is true otherwise No)    
ssl.privateKey.k8NameSpace Namespace of privatekey n/a M (If enableIncomingHttps is true otherwise No)    
ssl.privateKey.rsa.fileName rsa private key file name n/a M (If enableIncomingHttps is true otherwise No)    
ssl.privateKey.ecdsa.fileName ecdsa private key file name n/a M (If enableIncomingHttps is true otherwise No)    
ssl.certificate.k8SecretName Name of the privatekey secret n/a M (If enableIncomingHttps is true otherwise No)    
ssl.certificate.k8NameSpace Namespace of privatekey n/a M (If enableIncomingHttps is true otherwise No)    
ssl.certificate.rsa.fileName rsa private key file name n/a M (If enableIncomingHttps is true otherwise No)    
ssl.certificate.ecdsa.fileName ecdsa private key file name n/a M (If enableIncomingHttps is true otherwise No)    
ssl.caBundle.k8SecretName Name of the privatekey secret n/a M (If enableIncomingHttps is true otherwise No)    
ssl.caBundle.k8NameSpace Namespace of privatekey n/a M (If enableIncomingHttps is true otherwise No)    
ssl.caBundle.rsa.fileName rsa private key file name n/a M (If enableIncomingHttps is true otherwise No)    
ssl.keyStorePassword.k8SecretName Name of the privatekey secret n/a M (If enableIncomingHttps is true otherwise No)    
ssl.keyStorePassword.k8NameSpace Namespace of privatekey n/a M (If enableIncomingHttps is true otherwise No)    
ssl.keyStorePassword.fileName File name that has password for keyStore n/a M (If enableIncomingHttps is true otherwise No)    
ssl.trustStorePassword.k8SecretName Name of the privatekey secret n/a M (If enableIncomingHttps is true otherwise No)    
ssl.trustStorePassword.k8NameSpace Namespace of privatekey n/a M (If enableIncomingHttps is true otherwise No)    
ssl.trustStorePassword.fileName File name that has password for trustStore n/a M (If enableIncomingHttps is true otherwise No)    
id id of the route   M    
uri Service name of the internal microservice of this NF   M    
path Provide the path to be matched.   M    
order Provide the order of the execution of this route.   M    
methodRateLimiting.method[0] Method on which ratelimiting is applicable   M (if routeRateLimiting.enabled)    
methodRateLimiting.burstCapacity[0] burstCapacity   M (if routeRateLimiting.enabled)    
methodRateLimiting.refillRate[0] Refill rate   M (if routeRateLimiting.enabled)    
methodRateLimiting.duration[0] Duration   M (if routeRateLimiting.enabled)    
image.repository Full Image Path   M Full image path of image  
log.level Logging level INFO O INFO, DEBUG, FATAL, ERROR, WARN Logging level

Egress gateway

Table 5-6 Egress gateway

Parameter Description Default value Mandatory (M)/ Optional (O) Range or Possible Values (If applicable) Notes
openTracing.jaeger.probabilisticSampler   0.5 M (If jaegerTracingEnabled is true)    
maxConnectionsPerIp Max Connections allowed per Ip 4 No    
connectionTimeout Connection timeout in milli seconds 1000 No    
maxConnectionsQueuedPerDestination jetty client configuration 1024 No    
openTracing.jaeger.udpSender.port Jaeger Port 6831 M (If jaegerTracingEnabled is true)    
serviceEgressGateway.port   8080 No    
serviceEgressGateway.sslPort SSL Port 8442 No    
serviceEgressGateway.actuatorPort Actuator Port 9090 No    
global.serviceAccountName Service Account Name '' No    
cipherSuites Supported Cipher Suites in Egress 
   - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
   - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
   - TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
   - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
   - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 No   Connection with other ciphers would be rejected.
scp.instances.http[0].apiPrefix First Scp instance apiPrefix. Change this value to corresponding prefix if "/" is not expected to be provided along. Applicable only for SCP with TLS enabled. / No   Examples : XXX, Point to be noted here is that / is not required to be included when providing some data.
scp.instances.https[0].apiPrefix First Scp instance apiPrefix. Change this value to corresponding prefix if "/" is not expected to be provided along. Applicable only for SCP with TLS enabled. / No   Examples : XXX, Point to be noted here is that / is not required to be included when providing some data.
type Type of service ClusterIP M   Possible values are :- ClusterIP, NodePort, LoadBalancer and ExternalName
enableOutgoingHttps Enabling it for outgoing https request false No   Change it to true for enabling https for outgoing requests.
K8ServiceCheck Enable this if loadbalancing is to be done by egress instead of K8s false No    
headlessServiceEnabled Enabling this will make the service type default to ClusterIP false No    
jaegerTracingEnabled Enable jaeger tracing false No   Change it to true if needed.
notificationRateLimit.enabled Flag to enable rate limiting for "notification" type of messages. false No    
globalretry.enabled Can be set to true if Scp re-route feature(scpRerouteEnabled) is enabled. false No    
scp.scpDefaultScheme Default scheme applicable when 3gpp-sbi-target-apiroot header is missing https No    
openTracing.jaeger.udpSender.host Jaeger Host jaeger-agent.cne-infra M (If jaegerTracingEnabled is true)    
nfType NFType of service consumer. Modify the field with actual value , required if oAuth is enabled. M    
consumerPlmnMNC MNC of service Consumer. Modify the field with actual value , required if oAuth is enabled. No    
consumerPlmnMCC MCC of service Consumer. Modify the field with actual value , required if oAuth is enabled. No    
nrfAuthority NRF's ${HOSTNAME}:{PORT} Modify the field with actual value, required if oAuth is enabled. M    
nfInstanceId: NF InstanceId of Service Consumer. Modify the field with actual value, required if oAuth is enabled. M    
ssl.privateKey.k8SecretName Name of the privatekey secret n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.privateKey.k8NameSpace Namespace of privatekey n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.privateKey.rsa.fileName rsa private key file name n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.privateKey.ecdsa.fileName ecdsa private key file name n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.certificate.k8SecretName Name of the privatekey secret n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.certificate.k8NameSpace Namespace of privatekey n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.certificate.rsa.fileName rsa private key file name n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.certificate.ecdsa.fileName ecdsa private key file name n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.caBundle.k8SecretName Name of the privatekey secret n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.caBundle.k8NameSpace Namespace of privatekey n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.caBundle.rsa.fileName rsa private key file name n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.keyStorePassword.k8SecretName Name of the privatekey secret n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.keyStorePassword.k8NameSpace Namespace of privatekey n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.keyStorePassword.fileName File name that has password for keyStore n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.trustStorePassword.k8SecretName Name of the privatekey secret n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.trustStorePassword.k8NameSpace Namespace of privatekey n/a M (If enableOutgoingHttps is true otherwise No)    
ssl.trustStorePassword.fileName File name that has password for trustStore n/a M (If enableOutgoingHttps is true otherwise No)    
scp.instances.http[0].host First Scp instance HTTP IP/FQDN NA M(If "scp.scpIntegrationEnabled" is set to true.)   More SCP instances can be configured in a similar way if required.
scp.instances.http[0].port First Scp instance Port NA M(If "scp.scpIntegrationEnabled" is set to true.)    
scp.instances.https[0].host First Scp instance HTTPS IP/FQDN NA M(if "scp.scpIntegrationEnabled" is set to true.)   More SCP instances can be configured in a similar way if required.
scp.instances.https[0].port First Scp instance HTTPS Port NA M(if "scp.scpIntegrationEnabled" is set to true.)    
global.dockerRegistry Name of the Docker registry which hosts Egress docker images. ocnrf-registry.us.oracle.com:5000 M   Ideally this is the registry which has docker images. Change this value if there is a need.
global.appinfoServiceEnable Enabled to get RBAC permission for k8s apiserver communication true M    
scp.scpIntegrationEnabled Change this to false when scp integration is not required true No    
scp.scpRerouteEnabled Set this flag to true if re-routing to multiple SCP instances is to be enabled. true No    
oauthClientEnabled Flag to enable or disable oauth client. If not modified, Default value 'false' will be defaulted. true No   Change it to true to enable Oauth
egressGwCertReloadEnabled   true No    
           
notificationRateLimit.duration Iterations of time duration(In seconds) for which bucketCapacity and refillRate are reset.   M(If notificationRateLimit.enabled is set to true)    
notificationRateLimit.bucketCapacity Holds maximum number of tokens in the bucket for the given duration.   M(If notificationRateLimit.enabled is set to true)    
notificationRateLimit.refillRate Number of tokens to be added to the bucket for the given duration   M(If notificationRateLimit.enabled is set to true)    
globalretry.retries Number of re-routes to be attempted to alternate SCP instances and this property will be considered in the absence of "routesConfig[0].filterName2.retries" attribute at route level.   M(If "routesConfig[0].filterName2.retries" is not defined)    
routesConfig[0].id Id of the route   M  

Can be any name of your choice.

Note: Multiple routes can be configured in a similar way.
routesConfig[0].uri Provide any dummy url , existing url can also left with existing value   M   Please note provided sample url does not make any impact (http or https) as url's will be constructed in the code.
routesConfig[0].path Provide the path to be matched.   M    
routesConfig[0].order Provide the order of the execution of this route.   M    
routesConfig[0].filterName1 Provide filtername as "ScpFilter"   M (If scpintegrationenabled is true)   If FilterName1 is not provided then it would be considered as direct Egress Gateway path and configured accordingly during deployment.
routesConfig[0].filterName2.name Provide filtername as "ScpRetry"   M (If scpRerouteEnabled is true)   With out FilterName1 , it is not possible to configure FilterName2.name
routesConfig[0].filterName2.retries Number of re-routes to be attempted to alternate SCP instances if request matches this route's path.   M (If scpRerouteEnabled is true)   If this is not defined then globalretry.retries parameter is applicable when globalretry.enabled is true.
routesConfig[0].filterName2.methods The type of methods for which the re-route need to be attempted.   M (If scpRerouteEnabled is true)    
routesConfig[0].filterName2.statuses The type response error codes on which the re-route need to be attempted.   M (If scpRerouteEnabled is true)    
image.repository Full Image Path   M Full image path of image  
log.level Logging level INFO O INFO, DEBUG, FATAL, ERROR, WARN Logging level

Nrfclient

Table 5-7 Nrfclient

Parameter Description Default value Mandatory (M)/ Optional (O) Range or Possible Values (If applicable) Notes
deploymentNrfClientService.envNfNamespace Namespace in which NSSF is deployed ocnssf O    
configmapApplicationConfig.appProfiles List of NF-Profiles to register to NRF NA M NSSF-Profile is used to register to NRF List contains only one profile which is of NSSF
configmapApplicationConfig.nrfApiRoot URL of NRF NA M    
nfApiRoot URL pointing to ingress gateway of NSSF NA O    
image.repository Full Image Path   M Full image path of image  
log.level Logging level INFO O INFO, DEBUG, FATAL, ERROR, WARN Logging level

perf-info

Table 5-8 perf-info

Parameter Description Default value Mandatory (M)/ Optional (O) Range or Possible Values (If applicable) Notes
service_namespace Namespace in which NSSF is deployed ocnssf O   If no value is specified, NSSFs load reported to NRF is always 0.
configmapPerformance.prometheus Specifies Prometheus server URL No http://prometheus-server.prometheus:5802   If no value is specified, NSSFs load reported to NRF is always 0.
image.repository Full Image Path   M Full image path of image  
log.level Logging level INFO O INFO, DEBUG, FATAL, ERROR, WARN Logging level