Support Dynamic Policy Updation
User shall be able to deploy policy via PAP at run time. As currently we are supporting only Native policy for OPA, the design proposal is to encode rego file content in base 64 format and provide in the policy field.
For e.g. consider a sample rego file having following contents
package example
default allow = false
# Rule to check cell consistency
check_cell_consistency {
input.cell != "445611193265040129"
}
# Rule to allow if PCI is within range 1-3000
allow_if_pci_in_range {
input.PCI >= 1
input.PCI <= 3000
}
# Main rule to determine the final decision
allow {
check_cell_consistency
allow_if_pci_in_range
}
In the tosca template the rego contents will be encoded and added in policy field
tosca_definitions_version: tosca_simple_yaml_1_1_0
topology_template:
policies:
- native.cell.consistency.opa:
type: onap.policies.native.opa
type_version: 1.0.0
properties:
policy: cGFja2FnZSBleGFtcGxlCgpkZWZhdWx0IGFsbG93ID0gZmFsc2UKCiMgUnVsZSB0byBjaGVjayBjZWxsIGNvbnNpc3RlbmN5CmNoZWNrX2NlbGxfY29uc2lzdGVuY3kgewogICAgaW5wdXQuY2VsbCAhPSAiNDQ1NjExMTkzMjY1MDQwMTI5Igp9CgojIFJ1bGUgdG8gZGVueSBpZiBQQ0kgaXMgbm90IHdpdGhpbiByYW5nZSAxLTMwMDAKCgojIFJ1bGUgdG8gYWxsb3cgaWYgUENJIGlzIHdpdGhpbiByYW5nZSAxLTMwMDAKYWxsb3dfaWZfcGNpX2luX3JhbmdlIHsKICAgIGlucHV0LlBDSSA+PSAxCiAgICBpbnB1dC5QQ0kgPD0gMzAwMAp9CgojIE1haW4gcnVsZSB0byBkZXRlcm1pbmUgdGhlIGZpbmFsIGRlY2lzaW9uCmFsbG93IHsKICAgIGNoZWNrX2NlbGxfY29uc2lzdGVuY3kKICAgIGFsbG93X2lmX3BjaV9pbl9yYW5nZQp9
name: native.cell.consistency.opa
version: 1.0.0
metadata:
policy-id: native.cell.consistency.opa
policy-version: 1.0.0
OPA PDP after receiving the message on KAFKA will parse the message, extract policy, perform base64 decoding and deploys the policy to OPA. OPA PDP will send a PDP_STATUS message with the status of policy deployment.