1. Security Edge Protection Proxy (SEPP) Cloud Native Installation Guide
  2. Customizing SEPP

3 Customizing SEPP

This section explains the configuration parameters of the SEPP.

Follow the below steps to customize the ocsepp-custom-values-1.3.0.yaml file as per the required parameters:
  1. Go to the Oracle Help Center (OHC) Web site.
  2. Navigate to Industries->Communications->Cloud Native Core->Release 2.2.0.
  3. Click the SEPP Custom Template link to download the zip file.
  4. Unzip the file to get ocscp-custom-configTemplates-1.3.0.0.0 file that contains the ocsepp-custom-configTemplates-1.3.0.0.0. This file is used during installation.
  5. Customize the ocsepp-custom-values-1.3.0.yaml file.
  6. Save the updated ocsepp-custom-values-1.3.0.yaml file in the helm chart directory.

Configuration Parameters

This section includes information about the configuration parameters of OCSEPP.

Global Parameters: Ingress Gateway

OCSEPP allows customization of parameters for the following services and related settings.

Table 3-1 Global Parameters: Ingress Gateway

Parameter Description Mandatory Parmeter Default value Notes
global.dockerRegistry Name of the Docker registry which hosts Ingress docker images. Yes reg-1:5000 This is the registry which has docker images. Change this value if there is a need.
global.type type of service Yes LoadBalancer Possible values are :- ClusterIP, NodePort, LoadBalancer and ExternalName
global.serviceAccountName Service Account name No ''  
global.metalLbIpAllocationEnabled Enable or disable IP Address allocation from Metallb Pool No true  
global.metalLbIpAllocationAnnotation Address Pool Annotation for Metallb No metallb.universe.tf/address-pool: signaling  
global.staticIpAddressEnabled

If Static load balancer IP needs to be set, then set staticIpAddressEnabled flag to true and provide value for staticIpAddress

Else random IP will be assigned by the metalLB from its IP Pool

 No false  
global.staticIpAddress StaticIp   10.75.212.60  
global.publicHttpSignalingPort Http Signalling port Yes 80  
global.publicHttpsSignallingPort Https Signalling port Yes 443  
global.staticNodePortEnabled Node Port Enabled No true  
global.staticHttpNodePort Http Node Port Yes 30075  
global.staticHttpsNodePort Https Node Port Yes 30043  
enableOutgoingHttps Enabling it for outgoing https request Yes false Change it to true for enabling https for outgoing requests.
enableIncomingHttp Enabling it for incoming http request Yes false  
enableIncomingHttps Enabling it for incoming https request Yes true  
oauthValidatorEnabled Oauth Validator Enabled Yes false Change it to true to enable oauth
jaegerTracingEnabled Enable jaeger tracing No false Change it to true if needed.
openTracing.jaeger.udpSender.host Jaeger Host Yes (If jaegerTracingEnabled is true) jaeger-agent.cne-infra  
openTracing.jaeger.udpSender.port Jaeger Port Yes (If jaegerTracingEnabled is true) 6831  
openTracing.jaeger.probabilisticSampler   Yes (If jaegerTracingEnabled is true) 0.5  
nfType NFType of service producer Yes (When oauthValidatorEnabled) Value to be updated accordingly  
nfInstanceId: NF InstanceId of service producer. Yes (When oauthValidatorEnabled) Value to be updated accordingly  
producerScope: Comma-seperated list of services hosted by service producer. Yes (When oauthValidatorEnabled) Value to be updated accordingly  
allowedClockSkewSeconds set this value if clock on the parsing NF(producer) is not perfectly in sync with the clock on the NF(consumer) that created the JWT. Yes (When oauthValidatorEnabled) 0  
nrfPublicKeyKubeSecret Name of the secret which stores the public key(s) of NRF. Yes (When oauthValidatorEnabled) Value to be updated accordingly  
nrfPublicKeyKubeNamespace Namespace of the NRF publicKey Secret Yes (When oauthValidatorEnabled) Value to be updated accordingly  
validationType Values can be "strict" or "relaxed".

"strict" means that incoming request without "Authorization"(Access Token) header will be rejected.

"relaxed" means that if incoming request contains "Authorization" header, it will be validated.If incoming request doesnot contain

"Authorization" header, validation will be ignored.

 Yes (When oauthValidatorEnabled) Value to be updated accordingly  
producerPlmnMNC MNC of service producer. No Value to be updated accordingly  
producerPlmnMCC MCC of service producer. No Value to be updated accordingly  

Global Parameters: Egress Gateway

Table 3-2 Global Parameters: Egress Gateway

Parameter Description Mandatory Parameters Dafault Value Notes
ssl.tlsVersion Indicate the version of TLS used. Yes(If enableIncomingHttp is true otherwise No) TLSv1.2  
ssl.privateKey.k8SecretName Name of the privatekey secret Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.privateKey.k8NameSpace Namespace of privatekey Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.privateKey.rsa.fileName rsa private key file name Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.privateKey.ecdsa.fileName ecdsa private key file name Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.certificate.k8SecretName Name of the privatekey secret Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.certificate.k8NameSpace Namespace of privatekey Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.certificate.rsa.fileName rsa private key file name Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.certificate.ecdsa.fileName ecdsa private key file name Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.caBundle.k8SecretName Name of the privatekey secret Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.caBundle.k8NameSpace Namespace of privatekey Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.caBundle.rsa.fileName rsa private key file name Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.keyStorePassword.k8SecretName Name of the privatekey secret Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.keyStorePassword.k8NameSpace Namespace of privatekey Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.keyStorePassword.fileName File name that has password for keyStore Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.trustStorePassword.k8SecretName Name of the privatekey secret Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.trustStorePassword.k8NameSpace Namespace of privatekey Yes (If enableIncomingHttp is true otherwise No) n/a  
ssl.trustStorePassword.fileName File name that has password for trustStore Yes (If enableIncomingHttp is true otherwise No) n/a  

Table 3-3 Resource Customizable Parameters

Parameter Description Mandatory Parameters Dafault Value Notes
resources.limits.cpu CPU Limit   2 Change all the values as per the need
resources.limits.memory Memory Limit   4Gi  
resources.limits.initServiceCpu Init Container CPU Limit   1  
resources.limits.updateServiceCpu Update Container CPU Limit   1  
resources.limits.initServiceMemory Init Container Memory Limit   1Gi  
resources.limits.updateServiceMemory Update Container Memory Limit   1Gi  
resources.requests.cpu CPU for requests   1  
resources.requests.memory Memory for requests   2Gi  
resources.requests.initServiceCpu Init Container CPU for requests   1  
resources.requests.updateServiceCpu Update Container CPU for requests   1  
resources.requests.initServiceMemory Init Container Memory for requests   1Gi  
resources.requests.updateServiceMemory Update Container Memory for requests   1Gi  
resources.target.averageCpuUtil     80  
minReplicas Min replicas to scale to maintain an average CPU utilization Yes 2  
maxReplicas Max replicas to scale to maintain an average CPU utilization Yes 5  
log.level Log level No DEBUG  
ports.containerPort ContainerPort represents a network port in a single container No 8081  
ports.containersslPort   No 8443  
actuatorPort ActuatorPort No 9090  

Table 3-4 Routes Config Customizable Parameters

Parameter Description Mandatory Parameters Dafault Value Notes
id id of the route Yes n32f-ipx  
uri Service name of the internal microservice of this NF Yes http://ocsepp-n32f-ipx:8082/  
path Provide the path to be matched. Yes /n32f-forward/v1/n32f-process  
order Provide the order of the execution of this route. Yes 1  

Table 3-5 Fixed value parameters

Parameter Description Mandatory Parameters Dafault Value Notes
image.name Image name of ingress gateway No ocingress_gateway  
image.tag Image Tag name of ingress gateway No 1.6.2  
image.pullPolicy Image Pull Policy No Always  
initContainersImage.name Image name of initContainer No configurationinit  
initContainersImage.tag Image tag name of initContainer No 1.1.1  
initContainersImage.pullPolicy Image Pull Policy No Always  
updateContainersImage.name Image name of updateContainer No configurationupdate  
updateContainersImage.tag Image tag name of updateContainer No 1.1.1  
updateContainersImage.pullPolicy Image Pull Policy No Always  
fullnameOverride Label to override name of api-gateway micro-service name Yes ingress  
serviceMeshCheck Load balancing will be handled by Ingress gateway, if true it would be handled by serviceMesh Yes false  
cipherSuites Supported Cipher Suites in Ingress No - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256  
cncoamGatewayEnable CnCoam Gateway Enabled No false Change it to true if required
maxConnectionsQueuedPerDestination Jetty Client Settings No 4096  
maxConnectionsPerDestination Jetty Client Settings No 12 ( This will be used when serviceMeshCheck is enabled)  
maxConnectionsPerIp Jetty Client Settings No 12  
connectionTimeout Jetty Client Settings No 10000  

Table 3-6 Global Parameters: Egress Gateway

Parameter Description Mandatory Parameters Dafault Value Notes
global.appinfoServiceEnable Enabled to get RBAC permission for k8s apiserver communication Yes true  
global.dockerRegistry Name of the Docker registry which hosts Egress docker images. Yes reg-1:5000 Ideally this is the registry which has docker images. Change this value if there is a need.
global.serviceAccountName Service Account Name No ''  
serviceEgressGateway.port   No 8080  
serviceEgressGateway.sslPort SSL Port No 8442  
serviceEgressGateway.actuatorPort Actuator Port No 9090  
enableOutgoingHttps Enabling it for outgoing https request No false Change it to true for enabling https for outgoing requests.
K8ServiceCheck Enable this if loadbalancing is to be done by egress instead of K8s No false  
scpHttpHost Scp HTTP IP/FQDN Yes NA  
scpHttpPort Scp PORT Yes NA  
scpHttpsHost Scp HTTPS IP/FQDN Yes NA  
scpHttpsPort Scp HTTPS PORT Yes NA  
scpApiPrefix Change this value to corresponding prefix "/" is not expected to be provided along. Applicable only for SCP with TLS enabled. No / Examples : XXX, Point to be noted here is that / is not required to be included when providing some data.
scpDefaultScheme Default scheme applicable when 3gpp-sbi-target-apiroot header is missing No https  
scpIntegrationEnabled Change this to false when scp integration is not required No true  
headlessServiceEnabled Enabling this will make the service type default to ClusterIP No false  
cipherSuites Supported Cipher Suites in Egress No - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 Connection with other ciphers would be rejected.
log.level Log level No DEBUG  
jaegerTracingEnabled Enable jaeger tracing No false Change it to true if needed.
openTracing.jaeger.udpSender.host Jaeger Host Yes (If jaegerTracingEnabled is true) jaeger-agent.cne-infra  
openTracing.jaeger.udpSender.port Jaeger Port Yes (If jaegerTracingEnabled is true) 6831  
openTracing.jaeger.probabilisticSampler   Yes (If jaegerTracingEnabled is true) 0.5  
nrfAuthority NRF's ${HOSTNAME}:{PORT} Yes Modify the field with actual value, required if oAuth is enabled.  
nfType NFType of service consumer. Yes Modify the field with actual value , required if oAuth is enabled.  
nfInstanceId: NF InstanceId of Service Consumer. Yes Modify the field with actual value, required if oAuth is enabled.  
oauthClientEnabled: Flag to enable or disable oauth client. If not modified, Default value 'false' will be defaulted. No false Change it to true to enable Oauth
consumerPlmnMNC MNC of service Consumer. No Modify the field with actual value , required if oAuth is enabled.  
consumerPlmnMCC MCC of service Consumer. No Modify the field with actual value , required if oAuth is enabled.  
maxConnectionsQueuedPerDestination jetty client configuration No 1024  
maxConnectionsPerDestination   No 4  
maxConnectionsPerIp Max Connections allowed per Ip No 4  
connectionTimeout Connection timeout in milli seconds No 1000  
egressGwCertReloadEnabled   No true  

Table 3-7 Service Customizable Parameters

Parameter Description Mandatory Parameters Dafault Value Notes
type type of service Yes ClusterIP Possible values are :- ClusterIP, NodePort, LoadBalancer and ExternalName
ssl.privateKey.k8SecretName Name of the privatekey secret Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.privateKey.k8NameSpace Namespace of privatekey Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.privateKey.rsa.fileName rsa private key file name Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.privateKey.ecdsa.fileName ecdsa private key file name Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.certificate.k8SecretName Name of the privatekey secret Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.certificate.k8NameSpace Namespace of privatekey Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.certificate.rsa.fileName rsa private key file name Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.certificate.ecdsa.fileName ecdsa private key file name Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.caBundle.k8SecretName Name of the privatekey secret Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.caBundle.k8NameSpace Namespace of privatekey Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.caBundle.rsa.fileName rsa private key file name Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.keyStorePassword.k8SecretName Name of the privatekey secret Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.keyStorePassword.k8NameSpace Namespace of privatekey Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.keyStorePassword.fileName File name that has password for keyStore Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.trustStorePassword.k8SecretName Name of the privatekey secret Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.trustStorePassword.k8NameSpace Namespace of privatekey Yes (If enableOutgoingHttps is true otherwise No) n/a  
ssl.trustStorePassword.fileName File name that has password for trustStore Yes (If enableOutgoingHttps is true otherwise No) n/a  

Table 3-8 Resource Customizable Parameters

Parameter Description Mandatory Parameters Dafault Value Notes
resources.limits.cpu CPU Limit   2  
resources.limits.memory Memory Limit   4Gi  
resources.limits.initServiceCpu Init Container CPU Limit   1  
resources.limits.updateServiceCpu Update Container CPU Limit   1  
resources.limits.initServiceMemory Init Container Memory Limit   1Gi  
resources.limits.updateServiceMemory Update Container Memory Limit   1Gi  
resources.requests.cpu CPU for requests   1  
resources.requests.memory Memory for requests   2Gi  
resources.requests.initServiceCpu Init Container CPU for requests   1  
resources.requests.updateServiceCpu Update Container CPU for requests   1  
resources.requests.initServiceMemory Init Container Memory for requests   1Gi  
resources.requests.updateServiceMemory Update Container Memory for requests   1Gi  
resources.target.averageCpuUtil     80  
minReplicas Minimum replicas to scale to maintain an average CPU utilizati   2  
maxReplicas Maximum replicas to scale to maintain an average CPU utilization   5  

Table 3-9 Routes Config Customizable Parameters

Parameter Description Mandatory Parameters Dafault Value Notes
id id of the route Yes (If scpintegrationenabled is true)   Can be any name of your choice
uri Provide any dummy url , existing url can also left with existing value Yes (If scpintegrationenabled is true)   Please note provided sample url does not make any impact (http or https) as url's will be constructed in the code.
path Provide the path to be matched. Yes (If scpintegrationenabled is true)    
order Provide the order of the execution of this route. Yes (If scpintegrationenabled is true)    
filterName Provide filtername as "ScpFilter" Yes (If scpintegrationenabled is true)    

Table 3-10 Fixed value parameters

Parameter Description Mandatory Parameters Dafault Value Notes
erviceEgressGateway.port Internal port on which egress gateway is running for HTTP2 No 8080 Change this value if there is any specific need.
serviceEgressGateway.sslPort Internal port on which egress gateway is running for HTTPS No 8442 Change this value if there is any specific need.
deploymentEgressGateway.image Image name of egress gateway No ocegress_gateway  
deploymentEgressGateway.imageTag Image Tag name of egress gateway No 1.6.1  
deploymentEgressGateway.pullPolicy Pull Policy of Image No Always  
initContainersImage.name Image name of initContainer No configurationinit  
initContainersImage.tag Image tag name of initContainer No 1.1.1  
initContainersImage.pullPolicy Pull Policy of Image No Always  
updateContainersImage.name Image name of updateContainer No configurationupdate  
updateContainersImage.tag Image tag name of updateContainer No 1.1.1  
updateContainersImage.pullPolicy Pull Policy of Image No Always  
fullnameOverride   Yes egress  
httpClientBean To be used when oAuth is enabled. when https is enabled then it should be jettysClient , when https is disabled then it can left as '' Yes jettysClient

#Jetty bean name

#when http enabled -> ''

#when https enabled -> jettysClient
egressGwCertReloadEnabled Egress GW Certificates Reload Enabled No true  
jaegerTracingEnabled JaegerTracing Enabled No false  
ssl.tlsVersion TLS Version Yes TLSv1.2  
initialAlgorithm   Yes RSA256 ES256 can also be used, but corresponding certificates need to be used.

Table 3-11 N32-Forward Internetwork Packet Exchange (n32f-ipx)

Parameter Description Mandatory Parameters Dafault Value Notes
replicaCount Number of replicas initiall yes 1  
log.level Describes log level no INFO  
resources.limit.cpu Resource Requirements(limit of cpu) Yes 4  
resources.limit.memory Resource Requirements(limit of memory) Yes 4  
resources.requests.cpu Resource Requirements(requested cpu) Yes 4  
resources.requests.cpu Resource Requirements(requested memory) Yes 4  
resources.target.averageCpuUtil Resource Requirements(avg cpu utilisation) Yes 50  
configs.secretName Name of the secret containing Private Key used by signing the JSON Patch Document created by IPX Yes ocsepp-ipx-secret  
configs.namespace Namespace of the secret Yes seppsvc  
configs.algorithm Algorithm used for signing JSON Patch Document Yes ES256  
configs.keyName Private Key Name in the secret Yes private_key.pem  
configs.kid Kid used for signing JSON Patch Document Yes 1234  
configs.ipxIdentity IPX Idenity Yes ipx.oracle.com  
configs.jaegerTracingEnabled Enables Jaeger Tracing Yes false  
configs.openTracing.jaeger.udpSender.host Jaeger Tracing Host Yes(if jaeger is enabled) jaeger-agent.cne-infra  
configs.openTracing.jaeger.udpSender.port Jaegar Tracing Port Yes(if jaeger is enabled) 6831  
configs.openTracing.jaeger.logSpans Jaegar Tracing Logs Yes(if jaeger is enabled) false  
configs.openTracing.jaeger.probabilisticSamplingRate Jaegar Tracing Sampling Rate Yes(if jaeger is enabled) 0.5  
maxConnectionsQueuedPerDestination jettyClient Config No 4096  
maxConnectionsPerDestination Max Connections allowed per destination No 12  
maxConnectionsPerIp Max Connections allowed per Ip No 12  
connectionTimeout Connection timeout in millsec No 10000  

Table 3-12 JSON Web Signature Service (jws-svc)

Parameter Description Mandatory Parameters Dafault Value Notes
replicaCount Number of replicas for the pod yes 1  
minReplicas Minimum Number of Relicas yes 1  
maxReplicas Maximum num of replicas of pod yes 3  
resources.limit.cpu Resource Requirements(limit of cpu) Yes 4  
resources.limit.memory Resource Requirements(limit of memory) Yes 4  
resources.requests.cpu Resource Requirements(requested cpu) Yes 4  
resources.requests.cpu Resource Requirements(requested memory) Yes 4  
resources.target.averageCpuUtil Resource Requirements(avg cpu utilisation) Yes 50  
log.level Log Lovel yes INFO  
configs.jaegerTracingEnabled Enables Jaeger Tracing Yes false  
configs.openTracing.jaeger.udpSender.host Jaeger Tracing Host Yes(if jaeger is enabled) jaeger-agent.cne-infra  
configs.openTracing.jaeger.udpSender.port Jaegar Tracing Port Yes(if jaeger is enabled) 6831  
configs.openTracing.jaeger.logSpans Jaegar Tracing Logs Yes(if jaeger is enabled) false  
configs.openTracing.jaeger.probabilisticSamplingRate Jaegar Tracing Sampling Rate Yes(if jaeger is enabled) 0.5