...

Overview

•OPA-PDP will be integrated as a new Policy Engine in the existing ONAP Policy Framework

•The OPA PDP Engine will use utilize the open source implementation of Open Policy Agent to support enable fine-grained policy decisions in the ONAP .

•It will support Rego version 1 for both policies and requests/responses for access control decisions

•Only Native Policy will be supported (Policy Type : onap.policies.native.opa)

•OPA-PDP will support be compatible with all messaging interface interfaces towards PAP as , similar to other Policy engines support.

•OPA PDP will expose provide a Decision API which that can be used to render decisions for ONAP components.

...

ONAP OPA PDP Supported Policy Types

Currently only Native Policy will be supported .This Policy type is used by any client or ONAP component who has the need of native OPA evaluation.

...

How OPA-PDP fits in ONAP Policy Framework

...

OPA-PDP high level architecture

Image Added

• OPA-PDP implements a kafka listener, Publisher to receiving and sending messages to PAP

  • Once OPA-PDP is up it will send “Registration”( PDP_STATUS) message to PAP

  • Some of the information included in the message are:

  • pdpType the type of the PDP opa .

  • pdpGroup to which the PDP should belong to opaGroup

  • state the initial state of the PDP which is PASSIVE.

  • healthy whether the PDP is “HEALTHY” or not.

  • name a name that is unique to the PDP instance for e.g. “opa-f849384c-dd78-4016-a7b5-1c660fb6ee0e”

• On receiving the registration message from a PDP, PAP checks and assigns it to a subgroup under the group. PAP sends PDP_UPDATE message. PAP also sends the pdpHeartbeatIntervalMs which is the time interval in which PDPs should send heartbeats to PAP. Currently (In first phase) OPA-PDP handles only the pdpHeartbeatIntervalMs and starts a timer for sending STATUS messages periodically. OPA-PDP sends PDP_STATUS response to PDP_UPDATE message.

In Phase-1, OPA-PDP STATUS message will not include policy name and version

• PAP sends PDP_STATE_CHANGE message

OPA-PDP handles PDP_STATE_CHANGE. PAP sends PDP_STATE_CHANGE message to PDPs to change the state from PASSIVE to active or ACTIVE to PASSIVE. After registration is complete, PAP makes a PDP ACTIVE by default. OPA-PDP sends PDP_STATUS response to PDP_STATE_CHANGE. PDP updates its state as per the PDP_STATE_CHANGE received from PAP. When a PDP is changed to ACTIVE, any policies that are already pushed to the PDP start execution and start processing events as per the policies deployed.

In “ACTIVE” state OPA-PDP is in ready state to receive any decision requests

• Decision Requests are REST requests sent from ONAP components. Below is the format of Decision API request

• Code Block

  Decision Request { "OnapName": "CDS", "OnapComponent": "CDS", "OnapInstance": "CDS-component-instance", "RequestId": "8e6f784e-c9cb-42f6-bcc9-edb5d0af1ce1", "Policy": "role/allow", "input": { "user":"alice", "action":"read", "object":"id123", "type":"cat"} } } curl -u 'policyadmin:zb!XztG34' -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{"onapName":"CDS","onapComponent":"CDS-component-instance","onapInstance":"CDS","requestId":"8e6f784e-c9cb-42f6-bcc9-edb5d0af1ce1","policy":"role/allow","input":{"user":"alice","action":"read","object":"id123","type":"cat"}}' -X POST http://0.0.0.0:8282/policy/pdpx/v1/decision