Creating policy enforcement rules¶
This article illustrates how you can create policy enforcement rules. For testing purposes, create rules that prohibit the creation of instances with the flavor with over 2048 MB of RAM following the procedure below.
Procedure:
Verify that you have configured your OpenStack environment as described in Setting up policy enforcement.
To create the
predeploy_errors
rule, run:congress policy rule create murano_system "predeploy_errors(eid, obj_id, msg) :- murano:objects(obj_id, pid, type), murano:objects(eid, tid, \"io.murano.Environment\"), murano:connected(eid, pid), murano:properties(obj_id, \"flavor\", flavor_name), flavor_ram(flavor_name, ram), gt(ram, 2048), murano:properties(obj_id, \"name\", obj_name), concat(obj_name, \": instance flavor has RAM size over 2048MB\", msg)"
The command above contains the following information:
predeploy_errors(eid, obj_id, msg) :- murano:objects(obj_id, pid, type), murano:objects(eid, tid, "io.murano.Environment"), murano:connected(eid, pid), murano:properties(obj_id, "flavor", flavor_name), flavor_ram(flavor_name, ram), gt(ram, 2048), murano:properties(obj_id, "name", obj_name), concat(obj_name, ": instance flavor has RAM size over 2048MB", msg)
Policy validation engine checks the
predeploy_errors
rule, and rules referenced within this rule are evaluated by the Congress engine.In this example, we create the rule that references the
flavor_ram
rule we create afterwards. It disables flavors with RAM more than 2048 MB and constructs the message returned to the user in themsg
variable.In this example we use data from policy murano which is represented by
murano:properties
. There are stored rows with decomposition of model representing murano application. We also use built-in functions of Congress:gt
stands for ‘greater-than’concat
joins two strings into one variable
To create the
flavor_ram
rule, run:congress policy rule create murano_system "flavor_ram(flavor_name, ram) :- nova:flavors(id, flavor_name, cpus, ram)"
This rule resolves parameters of flavor by flavor name and returns the
ram
parameter. It uses theflavors
rule fromnova
policy. Data in this policy is filled by thenova
datasource driver.Check the rule usage.
Deployment fails as the rule is violated: environment is in the Deploy
FAILURE
status. Check the deployment logs for details:
See also