Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

Overview

•OPA-PDP will be integrated as a new Policy Engine in the existing ONAP Policy Framework

•The OPA PDP Engine will utilize the open source implementation of Open Policy Agent to enable fine-grained policy decisions in ONAP

•It will support Rego version 1 for both policies and requests/responses for access control decisions

•Only Native Policy will be supported (Policy Type : onap.policies.native.opa)

•OPA-PDP will be compatible with all messaging interfaces towards PAP, similar to other Policy engines.

•OPA PDP will provide a Decision API that can be used to render decisions for ONAP components.

ONAP OPA PDP Supported Policy Types

Currently only Native Policy will be supported .This Policy type is used by any client or ONAP component who has the need of native OPA evaluation.

onap.policies.native.opa

Policy Type

Action

Description

onap.policies.native.opa

native

any client or ONAP component

How OPA-PDP fits in ONAP Policy Framework

image-20241106-104419.png

OPA-PDP high level architecture

image-20241111-044344.png

  • OPA-PDP implements a kafka listener, Publisher to receiving and sending messages to PAP

    • Once OPA-PDP is up it will send “Registration”( PDP_STATUS) message to PAP

    • Some of the information included in the message are:

    • pdpType the type of the PDP opa .

    • pdpGroup to which the PDP should belong to opaGroup

    • state the initial state of the PDP which is PASSIVE.

    • healthy whether the PDP is “HEALTHY” or not.

    • name a name that is unique to the PDP instance for e.g. “opa-f849384c-dd78-4016-a7b5-1c660fb6ee0e”

  • On receiving the registration message from a PDP, PAP checks and assigns it to a subgroup under the group. PAP sends PDP_UPDATE message. PAP also sends the pdpHeartbeatIntervalMs which is the time interval in which PDPs should send heartbeats to PAP. Currently (In first phase) OPA-PDP handles only the pdpHeartbeatIntervalMs and starts a timer for sending STATUS messages periodically. OPA-PDP sends PDP_STATUS response to PDP_UPDATE message.

In Phase-1, OPA-PDP STATUS message will not include policy name and version

  • PAP sends PDP_STATE_CHANGE message

OPA-PDP handles PDP_STATE_CHANGE. PAP sends PDP_STATE_CHANGE message to PDPs to change the state from PASSIVE to active or ACTIVE to PASSIVE. After registration is complete, PAP makes a PDP ACTIVE by default. OPA-PDP sends PDP_STATUS response to PDP_STATE_CHANGE. PDP updates its state as per the PDP_STATE_CHANGE received from PAP. When a PDP is changed to ACTIVE, any policies that are already pushed to the PDP start execution and start processing events as per the policies deployed.

In “ACTIVE” state OPA-PDP is in ready state to receive any decision requests

  • Decision Requests are REST requests sent from ONAP components. Below is the format of Decision API request 

  • Decision Request 
 {
	"OnapName":      "CDS",
	"OnapComponent": "CDS",
	"OnapInstance":  "CDS-component-instance",
	"RequestId":     "8e6f784e-c9cb-42f6-bcc9-edb5d0af1ce1",
	"Policy":        "role/allow",
	"input":         
	  {
	      "user":"alice",
	      "action":"read",
	      "object":"id123",
	      "type":"cat"}
	  }
}


curl -u 'policyadmin:zb!XztG34' -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{"onapName":"CDS","onapComponent":"CDS-component-instance","onapInstance":"CDS","requestId":"8e6f784e-c9cb-42f6-bcc9-edb5d0af1ce1","policy":"role/allow","input":{"user":"alice","action":"read","object":"id123","type":"cat"}}' -X POST 
http://0.0.0.0:8282/policy/pdpx/v1/decision

  • No labels