Support Policy Updates between PAP and the PDPs

Owned by Wayne Dunican
Last updated: May 16, 2021
2 min read

Currently, when policies are updated via one of the PAP APIs, the entire list of policies is transmitted to the PDPs.  The communication between PAP and the PDPs should be enhanced so that only the changes need be transmitted.

After receiving the request from REST layer, PAP does the basic validation checks and then generate a PDP_UPDATE message with full list of policies for that particular PdpSubGroup and sends it to the PDPs through DMaaP. And PDPs on the other side scans through the list and identifies the policies that needs to be deployed or undeployed. Thereby making PDPs share the work which ideally PAP should be doing as an administrator component.

The aim is to send only the requested & validated policies that needs to be deployed or undeployed in PDPs. So that PDPs can remove the scanning logic and focus more on the "execution" than "administration". And it also reduces the data transmitting over DMaaP (network) and making the layer more robust and resilient.



Important Note:

  • The change needs to be designed in a way so that it doesn't break the currently working contract between PAP & PDPs. And allow sometime for PDPs to adapt and move to the newer (simpler) way of managing policies.

  • The change shouldn't affect the PDP registration flow. Because there we would like to continue sending the FULL list of policies that are currently supported in PdpSubGroup in which the PDP is getting registered.



Current thoughts/suggestions:

  1. Enhance PDP_UPDATE message to contain two new lists (deploy and undeploy), while maintaining its current full list of policies. When the PDPs support delta policies we can then remove the original full list.

  2. Enhance PDP_UPDATE message to contain one new list of policies to be updated, and a boolean value to determine whether to deploy/undeploy the policies while maintaining the full list of policies. When the PDPs support the delta policies we can remove the original list.



May 14, 2021 

Current Status

At present, PAP has been updated so that when policies are updated, lists of delta policies  are sent to the various PDPs via the PDP_UPDATE message. Similar to before, PAP does the basic checks for validation when a request is received from the REST layer and then generates a PDP_UPDATE message for that particular PdpSubGroup and sends it to the PDPs through DMaaP. This time however, PAP sends a list of "policiesToBeDeployed" and another list of "policiesToBeUndeployed" along with the full list of policies, for now. The goal is to remove sending the full list of policies when all PDPs have been updated to accept delta policies. 

This eliminates the need for PDPs on the other side to scan through the full list of policies as before to determine what policies need to be deployed and undeployed. This is administration work and is now handled on the administration side i.e. PAP. 

APEX-PDP and DROOLS-PDP are the only PDPs which can handle delta policies at the moment. Note: Apex sends back a list of deployed policies via the PDP_STATUS message to PAP while DROOLS-PDP sends back a full list of policies to PAP via the PDP_STATUS message.