From: gururajarao79 Date: Thu, 27 Mar 2025 13:59:29 +0000 (+0530) Subject: opa pdp documentation X-Git-Tag: 5.1.2~3 X-Git-Url: https://gerrit.onap.org/r/gitweb?a=commitdiff_plain;h=1776ff2c780dfabbaa1c4a861b330d3dbe470fb6;p=policy%2Fparent.git opa pdp documentation Issue-ID: POLICY-5329 Change-Id: I38d158446084f2822cefb6499b5b710f47e27e84 Signed-off-by: gururajarao79 --- diff --git a/docs/conf.py b/docs/conf.py index b4e839ec..61e5f792 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -61,6 +61,15 @@ redoc = [ 'hide-hostname': True, } }, + { + 'name': 'Policy OPA', + 'page': 'opa/local-swagger', + 'spec': 'https://raw.githubusercontent.com/onap/policy-opa-pdp/' + release + '/api/openapi.yaml', + 'opts': { + 'suppress-warnings': True, + 'hide-hostname': True, + } + }, { 'name': 'Policy DROOLS', 'page': 'drools/local-swagger', diff --git a/docs/index.rst b/docs/index.rst index 7922c08e..7110cfe3 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -20,6 +20,7 @@ Policy Framework Architecture drools/drools xacml/xacml apex/apex + opa/opa distribution/distribution clamp/clamp system-attributes/system-attributes diff --git a/docs/opa/OPA-architecture.rst b/docs/opa/OPA-architecture.rst new file mode 100644 index 00000000..a6ea42aa --- /dev/null +++ b/docs/opa/OPA-architecture.rst @@ -0,0 +1,145 @@ +.. This work is licensed under a Creative Commons Attribution 4.0 International License. + +OPA-PDP high level architecture +******************************* + +.. contents:: + :depth: 3 + +Software Architecture +^^^^^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: imageblock + + .. container:: content + + |OPA PDP Architecture| + + .. container:: title + + Figure 1. OPA PDP Architecture + + .. container:: ulist + + - **KafkaListener/Producer**: This component listens for incoming PDP_UPDATE and PDP_STATE_CHANGE messages from PAP. OPA PDP sends PDP_STATUS messages to PAP via Producer. + - **OPA PDP Engine**: The Go application that decodes base64 TOSCA policies and handles the deployment and undeployment of policies into the OPA SDK. + + .. container:: ulist + + - Msg Processor: Handles incoming PDP_UPDATE and PDP_STATE_CHANGE messages from PAP. + - PDP STATE: Maintains PDP State Active or Passive. + - Policy Map: In Memory Cache that holds the Map of names of policies,policy keys and data keys deployed. + - Metrics: Handles statistics of number of policies deployed,success and failure counts and other metrics. + + - **OPA SDK**: An Open Source OPA Go library component that stores data and policies in memory and manages the policies. + - **REST Interface**: Exposes APIs for decision-execution, dynamic data updates, fetch statistics, and health checks. + +OPA PDP And PolicyFramework Interaction +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + OPA-PDP will handles all messages that PAP sends similar to other PDPs.Following are functionalities supported. + + .. container:: ulist + + - Registration + - Handle PDP_UPDATE + - Handle PDP_STATE_CHANGE + - Send Heartbeat Messages + - Deploy Policy + - Undeploy Policy + + .. container:: paragraph + + Once OPA-PDP is up it will send “Registration”( PDP_STATUS) message to PAP.Some of the information included in the message are: + + .. container:: ulist + + - pdpType the type of the PDP opa . + - pdpGroup to which the PDP should belong to **opaGroup**. + - state the initial state of the PDP which is PASSIVE. + - healthy whether the PDP is “HEALTHY” or not. + - name a name that is unique to the PDP instance for e.g. **opa-f849384c-dd78-4016-a7b5-1c660fb6ee0e** + + .. literalinclude:: resources/registration_message.json + :language: JSON + :caption: Regsitration Message + + .. container:: paragraph + + Upon receiving the registration message PAP sends a PDP_UPDATE message along with the **pdpHeartbeatIntervalMs**, which specifies the time interval at which PDPs should send heartbeats to the PAP. The OPA-PDP starts a timer to send heartbeat messages periodically. Additionally, the OPA-PDP sends a PDP_STATUS response to the PDP_UPDATE message. + + .. literalinclude:: resources/response_to_pdp_update.json + :language: JSON + :caption: Example PDP_STATUS response to PDP_UPDATE + + .. container:: paragraph + + PAP sends a PDP_STATE_CHANGE message to change the state of PDPs from PASSIVE to ACTIVE. After registration, PAP makes a PDP ACTIVE by default. OPA-PDP handles the state change, updates its state accordingly, and sends a PDP_STATUS response. When a PDP becomes ACTIVE .In the ACTIVE state, OPA-PDP is ready to receive decision requests. + + .. literalinclude:: resources/response_to_pdp_state_change.json + :language: JSON + :caption: Example PDP_STATUS response to PDP_STATE_CHANGE + +Deploy OPA policy +^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + After receiving the PDP_UPDATE message to deploy policies on Kafka, the OPA PDP will perform the following steps: + + .. container:: ulist + + - Parse the message + - Extract policy + - Perform base64 decoding + - Validate Rego syntax of decoded policy + - validate json format of decoded policy + - validate constraints + +.. note:: + .. container:: ulist + + - Policy key should start with policyname. + - Datakey should start with node.policyname. + - The package name in rego file and policy key should be same. + - Policy naming rules are validated. + + +UnDeploy OPA policy +^^^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + After receiving the PDP_UPDATE message to undeploy policies on Kafka, the OPA PDP will perform the following steps: + + .. container:: ulist + + - Parse the message + - Check policy exists + - Remove data from OPA SDK + - Remove policy from OPA SDK + + + +.. container:: + :name: footer + + .. container:: + :name: footer-text + + 1.0.0-SNAPSHOT + Last updated 2025-03-27 16:04:24 IST + +.. |OPA PDP Architecture| image:: images/OPA-PDP.drawio.svg + :width: 700px + :height: 300px \ No newline at end of file diff --git a/docs/opa/OPA-decision-example.rst b/docs/opa/OPA-decision-example.rst new file mode 100644 index 00000000..6fe7bd19 --- /dev/null +++ b/docs/opa/OPA-decision-example.rst @@ -0,0 +1,58 @@ +.. This work is licensed under a Creative Commons Attribution 4.0 International License. + +OPA-PDP Decision +**************** + +.. contents:: + :depth: 3 + +OPA-PDP Decision +^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + OPA-PDP supports sending structured responses to decision requests. The OPA-PDP response is similar to the output from the Rego playground. The decision response is based on the "policy filter" provided in the decision request, which is mandatory. The "policyFilter" is a list of filter values, allowing multiple filters to be specified for the required output. If the policy filter contains an empty value, all output parameters are displayed. If an incorrect policy filter value is provided, valid input filters are displayed. The policy ID should be mentioned in the "policyName" field. + Input field should be populated with json for which decision needs to be validated. + + .. csv-table:: + :header: "Header", "Example value", "Description" + :widths: 25,10,70 + + "policyName", "cell.consistency", "tosca-policy" + "policyFilter", "allow", "output parameter" + "input", "{cell:445611193265040128,PCI:2}", "input json" + + .. csv-table:: + :header: "/decision" + :widths: 10 + + `Decision Swagger <./local-swagger.html#tag/OPAPDPDecisionControllerv1>`_ + + .. container:: paragraph + + This operation performs a decision request on PDP whether PCI value 2 can be modified on cell id 445611193265040128. + Here is a sample request: + + .. literalinclude:: resources/decision_request.json + :language: JSON + :caption: cell.consistency decision request json + + .. container:: paragraph + + As the policy allows changes on cell id 445611193265040128 and the pci is in range change is permitted. + Here is a sample response: + + .. literalinclude:: resources/decision_response.json + :language: JSON + :caption: cell.consistency decision response + +.. container:: + :name: footer + + .. container:: + :name: footer-text + + 1.0.0-SNAPSHOT + Last updated 2025-03-27 16:04:24 IST \ No newline at end of file diff --git a/docs/opa/OPA-dynamic-dataupdate.rst b/docs/opa/OPA-dynamic-dataupdate.rst new file mode 100644 index 00000000..738ee5ae --- /dev/null +++ b/docs/opa/OPA-dynamic-dataupdate.rst @@ -0,0 +1,93 @@ +OPA-PDP Dynamic Data Update +*************************** + +.. contents:: + :depth: 3 + +OPA-PDP Dynamic Data Update +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + The Data API provides endpoints for reading and writing data in OPA-PDP. However, data updated via the Data API is not persisted in OPA-PDP. + This feature is useful for scenarios where data needs to be dynamically modified without redeploying the policy. Users can also fine-tune and validate the data configuration. Once the configuration is finalized, users can undeploy the existing policy and create new data/policy with the updated configuration. + +GET a Document +^^^^^^^^^^^^^^ + + .. csv-table:: + :header: "/data/{path:.+}","method","example" + :widths: 25,5,25 + + `Data Swagger <./local-swagger.html#tag/OPAPDPDecisionControllerv1>`_,"GET","/data/node/cell/consistency" + + .. container:: paragraph + + This operation gets the data stored in PDP in json format. + + .. literalinclude:: resources/data_get_response.json + :language: JSON + :caption: response for GET cell.consistency data stored in OPA-PDP + +Patch a Document +^^^^^^^^^^^^^^^^ + + .. csv-table:: + :header: "/data/{path:.+}","method","example" + :widths: 25,5,25 + + `Data Swagger <./local-swagger.html#tag/OPAPDPDecisionControllerv1>`_,"PATCH","/data/node/cell/consistency" + + .. container:: paragraph + + Update a document. + + OPA_PDP accepts updates encoded as JSON Patch operations. The message body of the request should contain a JSON encoded array containing one or more JSON Patch operations. + Each operation specifies the operation type, path, and an optional value. For more information on JSON Patch, see RFC 6902. + + The effective path of the JSON Patch operation is obtained by joining the path portion of the URL with the path value from the operation(s) contained in the message body. + In all cases, the parent of the effective path MUST refer to an existing document, otherwise the server returns 404. In the case of **remove** and **replace** operations, the effective path MUST refer to an existing document, otherwise the server returns 404. + + .. csv-table:: + :header: "Header", "Example value", "Description" + :widths: 25,10,70 + + "policyName", "cell.consistency", "tosca-policy" + "op", "add,replace,remove", "operation type" + "path", "maxPCI", "path at which operation needs to be performed refer RFC 6902" + "value","4000", "A string or json content that needs to be replaced or added" + + .. literalinclude:: resources/data_replace_request.json + :language: JSON + :caption: **replace** maxPCI data value to 4000 in cell.consistency policy + + .. literalinclude:: resources/data_remove_request.json + :language: JSON + :caption: **remove** maxPCI element from data in cell.consistency policy + + .. literalinclude:: resources/data_add_request.json + :language: JSON + :caption: **add** test json element to data in cell.consistency policy + +.. warning:: + .. container:: paragraph + + Improper dynamic data updates can leave the data in an incorrect state. In such situations, + you can undeploy and redeploy the policy to restore the old data. Some common mistakes to avoid include: + + .. container:: ulist + + - Removing JSON elements without restoring them. + - Replacing values without restoring them. + - Adding unnecessary data elements. + +.. container:: + :name: footer + + .. container:: + :name: footer-text + + 1.0.0-SNAPSHOT + Last updated 2025-03-27 16:04:24 IST \ No newline at end of file diff --git a/docs/opa/OPA-introduction.rst b/docs/opa/OPA-introduction.rst new file mode 100644 index 00000000..ff1c3875 --- /dev/null +++ b/docs/opa/OPA-introduction.rst @@ -0,0 +1,156 @@ +.. This work is licensed under a Creative Commons Attribution 4.0 International License. + +Introduction to OPA +*************************** + +.. contents:: + :depth: 3 + +1. Introduction to OPA +^^^^^^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + `Open Policy Agent (OPA) `__ is an open-source, general-purpose policy engine that unifies policy enforcement across the stack. + It allows you to decouple policy decisions from your service's code, making it easier to manage and maintain policies. + The integration of Open Policy Agent (OPA) as a Policy Decision Point (PDP) within the Open Network Automation Platform (ONAP) enhances the platform's policy management capabilities. + OPA provides a flexible and scalable solution for enforcing policies across various components of ONAP. + + .. container:: imageblock + + .. container:: content + + |OPA Overview| + + .. container:: title + + Figure 1. OPA Overview + +2. Key Benefits +^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + - **Unified Policy Enforcement**: OPA allows for consistent policy enforcement across different ONAP modules, ensuring that policies are applied uniformly. + - **Declarative Policy Language**: Policies are written in Rego, a high-level declarative language, making them easy to understand and maintain. + - **Scalability**: OPA's architecture supports horizontal scaling, allowing it to handle large volumes of policy decisions efficiently. + +3. Use Cases +^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + - **Access Control**: Enforcing fine-grained access control policies for ONAP services. + - **Resource Management**: Applying policies to manage and allocate network resources efficiently. + - **Compliance**: Ensuring that ONAP operations comply with regulatory and organizational policies. + +4. Rego Language +^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + `Rego `__ is a declarative query language used by the Open Policy Agent (OPA) to write policy as code. It is designed to be easy to read and write, focusing on providing powerful support for referencing nested documents and ensuring that queries are correct and unambiguous.Rego is a powerful and flexible language for defining policies in a declarative manner. It is an essential tool for anyone looking to implement policy as code in their applications. + +4.1 Rego Key Features +###################### + + .. container:: sectionbody + + .. container:: paragraph + + - **Declarative**: Rego allows you to specify what you want to achieve rather than how to achieve it. + - **JSON Support**: Rego works seamlessly with JSON data, making it ideal for modern applications. + - **Policy as Code**: Rego enables you to define policies that can be version-controlled and integrated into your CI/CD pipelines. + +4.2 Basic Syntax +###################### + + .. container:: sectionbody + + .. container:: paragraph + + Rego rules are defined using a simple and intuitive syntax. Here is an example of a basic rule: + + .. container:: codeblock + + .. container:: content + + .. code-block:: + + package example + import rego.v1 + + default allow = false + + allow if { + input.user == "alice" + } + + .. container:: paragraph + + In this example, the `allow` rule is defined to be true if the `input.user` is "alice". + +4.3 Advanced Features +########################### + + .. container:: sectionbody + + .. container:: paragraph + + Rego supports a variety of advanced features, including: + + - **Composite Values**: You can define rules using composite values such as objects and arrays. + - **Built-in Functions**: Rego provides a rich set of built-in functions for manipulating data. + - **Modules**: You can organize your policies into reusable modules. + +4.4 Example +############ + + .. container:: sectionbody + + .. container:: paragraph + + Here is a more complex example that demonstrates some of Rego's capabilities: + + .. container:: codeblock + + .. container:: content + + .. code-block:: + + package example + import rego.v1 + + import data.servers + + default allow = false + + allow if { + input.user == "admin" + servers[input.server].owner == input.user + } + + .. container:: paragraph + + In this example, the `allow` rule checks if the `input.user` is "admin" and if they own the specified server. + +.. container:: + :name: footer + + .. container:: + :name: footer-text + + 1.0.0-SNAPSHOT + Last updated 2025-03-27 16:04:24 IST + +.. |OPA Overview| image:: images/opa-service.svg + :width: 300px + :height: 200px \ No newline at end of file diff --git a/docs/opa/OPA-pdp-engine.rst b/docs/opa/OPA-pdp-engine.rst new file mode 100644 index 00000000..b040ed78 --- /dev/null +++ b/docs/opa/OPA-pdp-engine.rst @@ -0,0 +1,73 @@ +.. This work is licensed under a Creative Commons Attribution 4.0 International License. +.. http://creativecommons.org/licenses/by/4.0 + +Policy OPA PDP Engine +##################### + +.. contents:: + :depth: 3 + +Policy OPA PDP Engine +^^^^^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + The ONAP OPA Policy PDP Engine leverages OPA, an `open source implementation `__, to support fine-grained policy decisions in the ONAP. The REGO 1.0 Standard serves as the policy language for access control decisions. The ONAP OPA PDP translates TOSCA Compliant Policies into the Rego language, loads them into the OPA engine, exposes a decision api for delivering decisions. + +ONAP OPA PDP Supported Policy Types +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + Currently, only Native Policy is supported. This policy type can be used by any client or ONAP component that requires native OPA evaluation: + + .. csv-table:: Supported Base Policy Types + :header: "Application", "Base Policy Type", "Description" + + "Native", "onap.policies.native.opa", "OPA PDP Policies" + + .. container:: paragraph + + The TOSCA template for the OPA policy type is shown below: + + .. literalinclude:: resources/onap.policies.native.opa.yaml + :language: YAML + :caption: OPA Policy type + :linenos: + +How OPA PDP Works in ONAP Policy Framework +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + opa-pdp integrates into policy framework like any other pdp engine in policy framework + + 1. **Policy Definition**: Policies are defined using native opa policytype and stored in a central repository. + 2. **Policy Deployment**: The Policy Administration Point (PAP) deploys these policies to the OPA PDP instances. + 3. **Policy Evaluation**: When a policy decision is needed, ONAP components can query the OPA PDP, which evaluates the request against the deployed policies and returns a decision. + 4. **Policy Updates**: The PAP can update policies dynamically, and OPA PDP instances will automatically pick up these changes without downtime. + + .. container:: imageblock + + .. container:: content + + |ONAP POLICY FRAMEWORK| + +.. container:: + :name: footer + + .. container:: + :name: footer-text + + 1.0.0-SNAPSHOT + Last updated 2025-03-27 16:04:24 IST + +.. |ONAP POLICY FRAMEWORK| image:: images/PFHighestLevel.svg + :width: 500px + :height: 100px \ No newline at end of file diff --git a/docs/opa/OPA-policy-guide.rst b/docs/opa/OPA-policy-guide.rst new file mode 100644 index 00000000..369de6e7 --- /dev/null +++ b/docs/opa/OPA-policy-guide.rst @@ -0,0 +1,92 @@ +.. This work is licensed under a Creative Commons Attribution 4.0 International License. + +OPA PDP Policy Guide +******************** + +.. contents:: + :depth: 3 + +Policy Creation Steps +^^^^^^^^^^^^^^^^^^^^^ + + .. container:: sectionbody + + .. container:: paragraph + + Following are the steps in writing a policy. + + .. container:: ulist + + 1. write rego files for policy.OPA PDP supports rego version v1. + 2. write json file for data + 3. Encode rego files and json to base64 + 4. write tosca policy with encoded content + + Let us assume we are writing a policy to check whether modifying a PCI value on a cell is allowed. + +write rego files for policy +########################### + + .. container:: paragraph + + When writing Rego files, if you need to use data, you must reference it with the data key. For example: data.node.cell.consistency.minPCI. + + .. literalinclude:: resources/cell_consistency.rego + :caption: rego code to check PCI range validation + :linenos: + + .. literalinclude:: resources/cell_consistency_topology.rego + :caption: rego code to check whether PCI change allowed on current cell + :linenos: + +.. note:: + .. container:: ulist + + - OPA PDP supports rego version v1 + +write json for data +################### + + .. literalinclude:: resources/cell_consistency.json + :language: JSON + :caption: data file which acts as a data source for policy checks + :linenos: + +Encode rego files and json to base64 write tosca policy +######################################################## + + .. literalinclude:: resources/cell_consistency.yaml + :language: YAML + :caption: tosca policy cell consistency + :linenos: + + .. container:: paragraph + + In the above yaml file two fields that are important are data and policy.Both are of type map they have key and value pair. + + .. note:: + .. container:: ulist + + - while writing policy keys should start with policy-id (eg:cell.consistency,cell.consistency.topology) + - while writing data keys should start with node. (eg:node.cell.consistency) + - The package name (eg: cell.consistency) inside the rego file should match the policy key. + + .. container:: paragraph + + TOSCA policy names must adhere to naming rules. The OPA PDP emphasizes that each TOSCA policy should have a unique policy name or policy ID. Internally, the OPA PDP creates directories based on the name structure. If two policy names share the same parent hierarchy (considering . as the hierarchy delimiter), deleting a policy higher in the hierarchy will also delete its child policies. To prevent this, the following constraints are added. + + .. container:: ulist + + - **Not Allowed**: If a policy named onap.org.cell is deployed, then deploying a policy named onap.org.cell.consistency is disallowed because this name shares the direct hierarchical structure. + - **Not Allowed**: If a policy named onap.org.cell is deployed, then deploying a policy named onap.org is disallowed because it is parent directory. + - **Allowed**: If a policy named onap.org.cell is deployed, then deploying a policy named onap.org.consistency,onap.org1.cell,onap1.org.cell is permitted, as it does not share the same hierarchy. + + +.. container:: + :name: footer + + .. container:: + :name: footer-text + + 1.0.0-SNAPSHOT + Last updated 2025-03-27 16:04:24 IST \ No newline at end of file diff --git a/docs/opa/images/OPA-PDP.drawio.svg b/docs/opa/images/OPA-PDP.drawio.svg new file mode 100644 index 00000000..0176071b --- /dev/null +++ b/docs/opa/images/OPA-PDP.drawio.svg @@ -0,0 +1,4 @@ + + + +
PAP
Kafka Listener/Producer
In Memory 
OPA-PDP
Apache Kafka
policy-pdp-pap
OPA SDK
/Policies
/Data
In Memory
Msg Processor
OPA PDP Engine
Policy Map
PDP State
Metrics
REST API
OPA opensource SDK
OPA PDP Components
 \ No newline at end of file diff --git a/docs/opa/images/OPAPDPArchitecture.png b/docs/opa/images/OPAPDPArchitecture.png new file mode 100644 index 00000000..850e627d Binary files /dev/null and b/docs/opa/images/OPAPDPArchitecture.png differ diff --git a/docs/opa/images/PFHighestLevel.svg b/docs/opa/images/PFHighestLevel.svg new file mode 100644 index 00000000..4c65f717 --- /dev/null +++ b/docs/opa/images/PFHighestLevel.svg @@ -0,0 +1,4 @@ + + + +
PolicyAPI
PolicyAPI
PolicyDB
PolicyDB
PolicyAdministration
PolicyAdministration
opa-pdp
opa-pdp
Policy Framework Component
Policy Framework Component
Other Component
Other ComponentText is not SVG - cannot display \ No newline at end of file diff --git a/docs/opa/images/opa-service.svg b/docs/opa/images/opa-service.svg new file mode 100644 index 00000000..53d6d977 --- /dev/null +++ b/docs/opa/images/opa-service.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/opa/opa.rst b/docs/opa/opa.rst new file mode 100644 index 00000000..cae59dc1 --- /dev/null +++ b/docs/opa/opa.rst @@ -0,0 +1,15 @@ +.. This work is licensed under a Creative Commons Attribution 4.0 International License. + +.. _opa-doc: + +Policy OPA PDP Engine +---------------------- +.. toctree:: + :maxdepth: 1 + + OPA-introduction.rst + OPA-pdp-engine.rst + OPA-architecture.rst + OPA-policy-guide.rst + OPA-decision-example.rst + OPA-dynamic-dataupdate.rst \ No newline at end of file diff --git a/docs/opa/resources/cell_consistency.json b/docs/opa/resources/cell_consistency.json new file mode 100644 index 00000000..3e397049 --- /dev/null +++ b/docs/opa/resources/cell_consistency.json @@ -0,0 +1,5 @@ +{ + "allowedCellId" : 445611193265040129, + "minPCI": 1, + "maxPCI": 3000 + } \ No newline at end of file diff --git a/docs/opa/resources/cell_consistency.rego b/docs/opa/resources/cell_consistency.rego new file mode 100644 index 00000000..c5f3dd25 --- /dev/null +++ b/docs/opa/resources/cell_consistency.rego @@ -0,0 +1,14 @@ +package cell.consistency +import rego.v1 +import data.cell.consistency.topology +default allow = false +# Rule to allow if PCI is within range 1-3000 +allow_if_pci_in_range if { + input.PCI >= data.node.cell.consistency.minPCI + input.PCI <= data.node.cell.consistency.maxPCI +} +# Main rule to determine the final decision +allow if{ + topology.check_cell_consistency + allow_if_pci_in_range +} \ No newline at end of file diff --git a/docs/opa/resources/cell_consistency.yaml b/docs/opa/resources/cell_consistency.yaml new file mode 100644 index 00000000..7437fcfa --- /dev/null +++ b/docs/opa/resources/cell_consistency.yaml @@ -0,0 +1,17 @@ +tosca_definitions_version: tosca_simple_yaml_1_1_0 +topology_template: + policies: + - cell.consistency: + type: onap.policies.native.opa + type_version: 1.0.0 + properties: + data: + node.cell.consistency: eyAgIAogICJhbGxvd2VkQ2VsbElkIiA6IDQ0NTYxMTE5MzI2NTA0MDEyOSwgCiAgIm1pblBDSSI6IDEsIAogICJtYXhQQ0kiOiAzMDAwICAKIH0= + policy: + cell.consistency: cGFja2FnZSBjZWxsLmNvbnNpc3RlbmN5CmltcG9ydCByZWdvLnYxCmltcG9ydCBkYXRhLmNlbGwuY29uc2lzdGVuY3kudG9wb2xvZ3kKZGVmYXVsdCBhbGxvdyA9IGZhbHNlCiMgUnVsZSB0byBhbGxvdyBpZiBQQ0kgaXMgd2l0aGluIHJhbmdlIDEtMzAwMAphbGxvd19pZl9wY2lfaW5fcmFuZ2UgIGlmIHsKICAgIGlucHV0LlBDSSA+PSBkYXRhLm5vZGUuY2VsbC5jb25zaXN0ZW5jeS5taW5QQ0kKICAgIGlucHV0LlBDSSA8PSBkYXRhLm5vZGUuY2VsbC5jb25zaXN0ZW5jeS5tYXhQQ0kKfQojIE1haW4gcnVsZSB0byBkZXRlcm1pbmUgdGhlIGZpbmFsIGRlY2lzaW9uCmFsbG93ICBpZnsKICAgIHRvcG9sb2d5LmNoZWNrX2NlbGxfY29uc2lzdGVuY3kKICAgIGFsbG93X2lmX3BjaV9pbl9yYW5nZQp9 + cell.consistency.topology: cGFja2FnZSBjZWxsLmNvbnNpc3RlbmN5LnRvcG9sb2d5CmltcG9ydCByZWdvLnYxCiMgUnVsZSB0byBjaGVjayBjZWxsIGNvbnNpc3RlbmN5CmNoZWNrX2NlbGxfY29uc2lzdGVuY3kgaWYgewogICAgaW5wdXQuY2VsbCAhPSBkYXRhLm5vZGUuY2VsbC5jb25zaXN0ZW5jeS5hbGxvd2VkQ2VsbElkCn0= + name: cell.consistency + version: 1.0.0 + metadata: + policy-id: cell.consistency + policy-version: 1.0.0 \ No newline at end of file diff --git a/docs/opa/resources/cell_consistency_topology.rego b/docs/opa/resources/cell_consistency_topology.rego new file mode 100644 index 00000000..e8f22f7e --- /dev/null +++ b/docs/opa/resources/cell_consistency_topology.rego @@ -0,0 +1,6 @@ +package cell.consistency.topology +import rego.v1 +# Rule to check cell consistency +check_cell_consistency if { + input.cell != data.node.cell.consistency.allowedCellId +} \ No newline at end of file diff --git a/docs/opa/resources/data_add_request.json b/docs/opa/resources/data_add_request.json new file mode 100644 index 00000000..e41d9f4f --- /dev/null +++ b/docs/opa/resources/data_add_request.json @@ -0,0 +1,27 @@ +{ + "onapName": "CDS", + "onapComponent": "CDS", + "onapInstance": "CDS", + "currentDateTime": "2025-01-17T08:26:41.857Z", + "currentDate": "2025-01-17", + "currentTime": "08:26:41.857Z", + "timeZone": "UTC", + "timeOffset": "+08:45", + "policyName": "cell.consistency", + "data": [ + { + "op": "add", + "path": "/test", + "value": { + "id": "s5", + "name": "job", + "protocols": [ + "amqp" + ], + "ports": [ + "p3" + ] + } + } + ] +} \ No newline at end of file diff --git a/docs/opa/resources/data_get_response.json b/docs/opa/resources/data_get_response.json new file mode 100644 index 00000000..c7487c89 --- /dev/null +++ b/docs/opa/resources/data_get_response.json @@ -0,0 +1,7 @@ +{ + "data": { + "allowedCellId": 445611193265040100, + "maxPCI": 3000, + "minPCI": 1 + } +} diff --git a/docs/opa/resources/data_remove_request.json b/docs/opa/resources/data_remove_request.json new file mode 100644 index 00000000..ed091f9c --- /dev/null +++ b/docs/opa/resources/data_remove_request.json @@ -0,0 +1,18 @@ +{ + "onapName": "CDS", + "onapComponent": "CDS", + "onapInstance": "CDS", + "currentDateTime": "2025-01-17T08:26:41.857Z", + "currentDate": "2025-01-17", + "currentTime": "08:26:41.857Z", + "timeZone": "UTC", + "timeOffset": "+08:45", + "policyName": "cell.consistency", + "data": [ + { + "op": "remove", + "path": "maxPCI", + "value": 4000 + } + ] +} \ No newline at end of file diff --git a/docs/opa/resources/data_replace_request.json b/docs/opa/resources/data_replace_request.json new file mode 100644 index 00000000..ba41109b --- /dev/null +++ b/docs/opa/resources/data_replace_request.json @@ -0,0 +1,18 @@ +{ + "onapName": "CDS", + "onapComponent": "CDS", + "onapInstance": "CDS", + "currentDateTime": "2025-01-17T08:26:41.857Z", + "currentDate": "2025-01-17", + "currentTime": "08:26:41.857Z", + "timeZone": "UTC", + "timeOffset": "+08:45", + "policyName": "cell.consistency", + "data": [ + { + "op": "replace", + "path": "maxPCI", + "value": 4000 + } + ] +} \ No newline at end of file diff --git a/docs/opa/resources/decision_request.json b/docs/opa/resources/decision_request.json new file mode 100644 index 00000000..89661ac5 --- /dev/null +++ b/docs/opa/resources/decision_request.json @@ -0,0 +1,16 @@ +{ + "onapName": "CDS", + "onapComponent": "CDS", + "onapInstance": "CDS", + "currentDateTime": "2025-01-17T08:26:41.857Z", + "currentDate": "2025-01-17", + "currentTime": "08:26:41.857Z", + "timeZone": "UTC", + "timeOffset": "+08:45", + "policyName": "cell.consistency", + "policyFilter": ["allow"], + "input": { + "cell": 445611193265040128, + "PCI": 2 + } +} diff --git a/docs/opa/resources/decision_response.json b/docs/opa/resources/decision_response.json new file mode 100644 index 00000000..45c2ef43 --- /dev/null +++ b/docs/opa/resources/decision_response.json @@ -0,0 +1,6 @@ +{ + "output": { + "allow": true + }, + "policyName": "cell.consistency" +} \ No newline at end of file diff --git a/docs/opa/resources/onap.policies.native.opa.yaml b/docs/opa/resources/onap.policies.native.opa.yaml new file mode 100644 index 00000000..8d695c53 --- /dev/null +++ b/docs/opa/resources/onap.policies.native.opa.yaml @@ -0,0 +1,27 @@ +tosca_definitions_version: tosca_simple_yaml_1_1_0 +policy_types: + onap.policies.Native: + derived_from: tosca.policies.Root + description: a base policy type for all native PDP policies + version: 1.0.0 + name: onap.policies.Native + onap.policies.native.opa: + derived_from: onap.policies.Native + version: 1.0.0 + name: onap.policies.native.opa + description: a policy type for native opa policies + properties: + data: + type: map + type_version: 0.0.0 + description: The base64 encoded json data for Policy. + required: false + metadata: + encoding: Base64 + policy: + type: map + type_version: 0.0.0 + description: The base64 encoded rego PolicySet or Policy. + required: true + metadata: + encoding: Base64 \ No newline at end of file diff --git a/docs/opa/resources/registration_message.json b/docs/opa/resources/registration_message.json new file mode 100644 index 00000000..bd5d4b07 --- /dev/null +++ b/docs/opa/resources/registration_message.json @@ -0,0 +1,15 @@ +{ + "messageName": "PDP_STATUS", + "pdpType": "opa", + "state": "PASSIVE", + "healthy": "HEALTHY", + "description": "Pdp Status Registration Message", + "response": null, + "policies": [], + "name": "opa-4cd0a060-19bc-45ab-9955-7664d2b9604b", + "requestId": "9c73856c-3d02-4236-838f-3d58ea5cc058", + "pdpGroup": "opaGroup", + "pdpSubgroup": null, + "timestampMs": "1743010891210", + "deploymentInstanceInfo": "" +} \ No newline at end of file diff --git a/docs/opa/resources/response_to_pdp_state_change.json b/docs/opa/resources/response_to_pdp_state_change.json new file mode 100644 index 00000000..f08cea6b --- /dev/null +++ b/docs/opa/resources/response_to_pdp_state_change.json @@ -0,0 +1,18 @@ +{ + "messageName": "PDP_STATUS", + "pdpType": "opa", + "state": "ACTIVE", + "healthy": "HEALTHY", + "description": "Pdp Status Response Message to Pdp State Change", + "response": { + "responseTo": "3edbb47c-b015-4fd9-9572-26cde97cc23c", + "responseStatus": "SUCCESS", + "responseMessage": "PDP State Changed From PASSIVE TO Active" + }, + "policies": null, + "name": "opa-949018d3-cc9b-429b-96ae-46ca9c314e42", + "requestId": "02b186a6-485d-4392-90fa-d4cac34be97a", + "pdpGroup": "defaultGroup", + "pdpSubgroup": "opa", + "timestampMs": "1731335550069" +} \ No newline at end of file diff --git a/docs/opa/resources/response_to_pdp_update.json b/docs/opa/resources/response_to_pdp_update.json new file mode 100644 index 00000000..b1b65702 --- /dev/null +++ b/docs/opa/resources/response_to_pdp_update.json @@ -0,0 +1,19 @@ +{ + "messageName": "PDP_STATUS", + "pdpType": "opa", + "state": "PASSIVE", + "healthy": "HEALTHY", + "description": "Pdp Status Response Message For Pdp Update", + "response": { + "responseTo": "06f6d05f-6045-48d9-bcd8-40364fb695ae", + "responseStatus": "SUCCESS", + "responseMessage": "PDP Update was Successful" + }, + "policies": null, + "name": "opa-949018d3-cc9b-429b-96ae-46ca9c314e42", + "requestId": "e6a0607f-5fc8-4d62-afca-3cb984d827a3", + "pdpGroup": "defaultGroup", + "pdpSubgroup": "opa", + "timestampMs": "1731335550030", + "deploymentInstanceInfo":"" +} \ No newline at end of file