1 .. This work is licensed under a
2 .. Creative Commons Attribution 4.0 International License.
3 .. http://creativecommons.org/licenses/by/4.0
13 Policy life cycle API comprises of policy design API and policy deployment API. This documentation focuses on policy
14 design API. Policy design API is publicly exposed for clients to Create/Read/Update/Delete (CRUD) policy types, policy type
15 implementation and policies which can be recognized and executable by appropriate policy engines incorporated in ONAP
16 policy framework. Policy design API backend is running in an independent building block component of policy framework
17 that provides REST service for aforementioned CRUD behaviors. Policy design API component interacts with a policy database
18 for storing and fetching new policies or policy types as needed. Apart from CRUD, API is also exposed for clients to retrieve
19 healthcheck status of this API REST service and statistics report including a variety of counters that reflect the history
22 We strictly follow `TOSCA Specification <http://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.1/TOSCA-Simple-Profile-YAML-v1.1.pdf>`_
23 to define policy type and policy. A policy type is equivalent to the policy model mentioned by clients before Dublin release.
24 Both policy type and policy are included in a TOSCA Service Template which is used as the entity passed into API POST call
25 and the entity returned by API GET and DELETE calls. More details are presented in following sessions.
26 We encourage clients to compose all kinds of policies and corresponding policy types in well-formed TOSCA Service Template.
27 One Service Template can contain one or more policies and policy types. Each policy type can have multiple policies created
28 atop. In other words, different policies can match the same or different policy types. Existence of a policy type is a prerequisite
29 of creating such type of policies. In the payload body of each policy to create, policy type name and version should be indicated and
30 the specified policy type should be valid and existing in policy database.
32 To ease policy creation, we preload several widely used policy types in policy database. Below is a table listing the preloaded policy types.
35 :header: "Policy Type Name", "Payload"
38 "Monitoring.TCA", `onap.policies.monitoring.cdap.tca.hi.lo.app.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.monitoring.cdap.tca.hi.lo.app.yaml>`_
39 "Monitoring.Collectors", `onap.policies.monitoring.dcaegen2.collectors.datafile.datafile-app-server.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.monitoring.dcaegen2.collectors.datafile.datafile-app-server.yaml>`_
40 "Optimization", `onap.policies.Optimization.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.Optimization.yaml>`_
41 "Optimization.Resource", `onap.policies.optimization.Resource.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.Resource.yaml>`_
42 "Optimization.Resource.AffinityPolicy", `onap.policies.optimization.resource.AffinityPolicy.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.resource.AffinityPolicy.yaml>`_
43 "Optimization.Resource.DistancePolicy", `onap.policies.optimization.resource.DistancePolicy.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.resource.DistancePolicy.yaml>`_
44 "Optimization.Resource.HpaPolicy", `onap.policies.optimization.resource.HpaPolicy.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.resource.HpaPolicy.yaml>`_
45 "Optimization.Resource.OptimizationPolicy", `onap.policies.optimization.resource.OptimizationPolicy.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.resource.OptimizationPolicy.yaml>`_
46 "Optimization.Resource.PciPolicy", `onap.policies.optimization.resource.PciPolicy.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.resource.PciPolicy.yaml>`_
47 "Optimization.Resource.Vim_fit", `onap.policies.optimization.resource.Vim_fit.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.resource.Vim_fit.yaml>`_
48 "Optimization.Resource.VnfPolicy", `onap.policies.optimization.resource.VnfPolicy.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.resource.VnfPolicy.yaml>`_
49 "Optimization.Service", `onap.policies.optimization.Service.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.Service.yaml>`_
50 "Optimization.Service.QueryPolicy", `onap.policies.optimization.service.QueryPolicy.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.service.QueryPolicy.yaml>`_
51 "Optimization.Service.SubscriberPolicy", `onap.policies.optimization.service.SubscriberPolicy.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.optimization.service.SubscriberPolicy.yaml>`_
52 "Controlloop.Guard.Common", `onap.policies.controlloop.guard.Common.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.controlloop.guard.Common.yaml>`_
53 "Controlloop.Guard.Common.Blacklist", `onap.policies.controlloop.guard.common.Blacklist.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.controlloop.guard.common.Blacklist.yaml>`_
54 "Controlloop.Guard.Common.FrequencyLimiter", `onap.policies.controlloop.guard.common.FrequencyLimiter.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.controlloop.guard.common.FrequencyLimiter.yaml>`_
55 "Controlloop.Guard.Common.MinMax", `onap.policies.controlloop.guard.common.MinMax.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.controlloop.guard.common.MinMax.yaml>`_
56 "Controlloop.Guard.Coordination.FirstBlocksSecond", `onap.policies.controlloop.guard.coordination.FirstBlocksSecond.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.controlloop.guard.coordination.FirstBlocksSecond.yaml>`_
57 "Controlloop.Operational", `onap.policies.controlloop.Operational.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.controlloop.Operational.yaml>`_
58 "Controlloop.Operational.Common", `onap.policies.controlloop.operational.Common.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.controlloop.operational.Common.yaml>`_
59 "Controlloop.Operational.Common.Apex", `onap.policies.controlloop.operational.common.Apex.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.controlloop.operational.common.Apex.yaml>`_
60 "Controlloop.Operational.Common.Drools", `onap.policies.controlloop.operational.common.Drools.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.controlloop.operational.common.Drools.yaml>`_
61 "Naming", `onap.policies.Naming.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.Naming.yaml>`_
62 "Native.Drools", `onap.policies.native.Drools.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.native.Drools.yaml>`_
63 "Native.Xacml", `onap.policies.native.Xacml.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.native.Xacml.yaml>`_
64 "Native.Apex", `onap.policies.native.Apex.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policytypes/onap.policies.native.Apex.yaml>`_
66 We also preload a policy in the policy database. Below is a table listing the preloaded polic(ies).
69 :header: "Policy Type Name", "Payload"
72 "SDNC.Naming", `sdnc.policy.naming.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/sdnc.policy.naming.input.tosca.yaml>`_
74 Below is a table containing sample well-formed TOSCA compliant policies.
77 :header: "Policy Name", "Payload"
80 "vCPE.Monitoring.Tosca", `vCPE.policy.monitoring.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vCPE.policy.monitoring.input.tosca.yaml>`_ `vCPE.policy.monitoring.input.tosca.json <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vCPE.policy.monitoring.input.tosca.json>`_
81 "vCPE.Optimization.Tosca", `vCPE.policies.optimization.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vCPE.policies.optimization.input.tosca.yaml>`_ `vCPE.policies.optimization.input.tosca.json <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vCPE.policies.optimization.input.tosca.json>`_
82 "vCPE.Operational.Tosca", `vCPE.policy.operational.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vCPE.policy.operational.input.tosca.yaml>`_ `vCPE.policy.operational.input.tosca.json <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vCPE.policy.operational.input.tosca.json>`_
83 "vDNS.Guard.FrequencyLimiting.Tosca", `vDNS.policy.guard.frequencylimiter.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vDNS.policy.guard.frequencylimiter.input.tosca.yaml>`_
84 "vDNS.Guard.MinMax.Tosca", `vDNS.policy.guard.minmaxvnfs.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vDNS.policy.guard.minmaxvnfs.input.tosca.yaml>`_
85 "vDNS.Guard.Blacklist.Tosca", `vDNS.policy.guard.blacklist.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vDNS.policy.guard.blacklist.input.tosca.yaml>`_
86 "vDNS.Monitoring.Tosca", `vDNS.policy.monitoring.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vDNS.policy.monitoring.input.tosca.yaml>`_ `vDNS.policy.monitoring.input.tosca.json <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vDNS.policy.monitoring.input.tosca.json>`_
87 "vDNS.Operational.Tosca", `vDNS.policy.operational.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vDNS.policy.operational.input.tosca.yaml>`_ `vDNS.policy.operational.input.tosca.json <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vDNS.policy.operational.input.tosca.json>`_
88 "vFirewall.Monitoring.Tosca", `vFirewall.policy.monitoring.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vFirewall.policy.monitoring.input.tosca.yaml>`_ `vFirewall.policy.monitoring.input.tosca.json <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vFirewall.policy.monitoring.input.tosca.json>`_
89 "vFirewall.Operational.Tosca", `vFirewall.policy.operational.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vFirewall.policy.operational.input.tosca.yaml>`_ `vFirewall.policy.operational.input.tosca.json <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vFirewall.policy.operational.input.tosca.json>`_
90 "vFirewallCDS.Operational.Tosca", `vFirewallCDS.policy.operational.input.tosca.yaml <https://github.com/onap/policy-models/blob/master/models-examples/src/main/resources/policies/vFirewallCDS.policy.operational.input.tosca.yaml>`_
93 Below is a global API table from where swagger JSON for different types of policy design API can be downloaded.
98 :header: "API name", "Swagger JSON"
101 "Healthcheck API", ":download:`link <swagger/healthcheck-api.json>`"
102 "Statistics API", ":download:`link <swagger/statistics-api.json>`"
103 "Tosca Policy Type API", ":download:`link <swagger/policytype-api.json>`"
104 "Tosca Policy API", ":download:`link <swagger/policy-api.json>`"
105 "Legacy Operational Policy API", ":download:`link <swagger/operational-policy-api.json>`"
110 It is worth noting that we use basic authorization for API access with username and password set to *healthcheck* and *zb!XztG34* respectively.
111 Also, the new APIs support both *http* and *https*.
113 For every API call, client is encouraged to insert an uuid-type requestID as parameter.
114 It is helpful for tracking each http transaction and facilitates debugging.
115 Mostly importantly, it complies with Logging requirements v1.2.
116 If client does not provider the requestID in API call, one will be randomly generated
117 and attached to response header *x-onap-requestid*.
119 In accordance with `ONAP API Common Versioning Strategy Guidelines <https://wiki.onap.org/display/DW/ONAP+API+Common+Versioning+Strategy+%28CVS%29+Guidelines>`_,
120 in the response of each API call, several custom headers are added::
122 x-latestversion: 1.0.0
125 x-onap-requestid: e1763e61-9eef-4911-b952-1be1edd9812b
126 x-latestversion is used only to communicate an API's latest version.
128 x-minorversion is used to request or communicate a MINOR version back from the client to the server, and from the server back to the client.
130 x-patchversion is used only to communicate a PATCH version in a response for troubleshooting purposes only, and will not be provided by the client on request.
132 x-onap-requestid is used to track REST transactions for logging purpose, as described above.
134 .. swaggerv2doc:: swagger/healthcheck-api.json
136 .. swaggerv2doc:: swagger/statistics-api.json
138 .. swaggerv2doc:: swagger/policytype-api.json
140 .. swaggerv2doc:: swagger/policy-api.json
142 When making a POST policy API call, the client must not only provide well-formed JSON/YAML,
143 but also must conform to the TOSCA specification. For example. the "type" field for a TOSCA
144 policy should strictly match the policy type name it derives.
145 Please check out the sample policies in above policy table.
147 Also, in the POST payload passed into each policy or policy type creation call (i.e. POST API invocation), the client needs to explicitly
148 specify the version of the policy or policy type to create. That being said, the "version" field is mandatory in the TOSCA service template
149 formatted policy or policy type payload. If the version is missing, that POST call will return "406 - Not Acceptable" and
150 the policy or policy type to create will not be stored in the database.
152 To avoid inconsistent versions between the database and policies deployed in the PDPs, policy API REST service employs some enforcement
153 rules that validate the version specified in the POST payload when a new version is to create or an existing version to update.
154 Policy API will not blindly override the version of the policy or policy type to create/update.
155 Instead, we encourage the client to carefully select a version for the policy or policy type to change and meanwhile policy API will check the validity
156 of the version and feed an informative warning back to the client if the specified version is not good.
157 To be specific, the following rules are implemented to enforce the version:
159 1. If the incoming version is not in the database, we simply insert it. For example: if policy version 1.0.0 is stored in the database and now
160 a client wants to create the same policy with updated version 3.0.0, this POST call will succeed and return "200" to the client.
162 2. If the incoming version is already in the database and the incoming payload is different from the same version in the database,
163 "406 - Not Acceptable" will be returned. This forces the client to update the version of the policy if the policy is changed.
165 3. If a client creates a version of a policy and wishes to update a property on the policy, they must delete that version of the policy and re-create it.
167 4. If multiple policies are included in the POST payload, policy API will also check if duplicate version exists in between
168 any two policies or policy types provided in the payload. For example, a client provides a POST payload which includes two policies with the same
169 name and version but different policy properties. This POST call will fail and return "406" error back to the calling application along with a
170 message such as "duplicate policy {name}:{version} found in the payload".
172 5. The same version validation is applied to policy types too.
174 6. To avoid unnecessary id/version inconsistency between the ones specified in the entity fields and the ones returned in the metadata field,
175 "policy-id" and "policy-version" in the metadata will only be set by policy API. Any incoming explicit specification in the POST payload will be
176 ignored. For example, A POST payload has a policy with name "sample-policy-name1" and version "1.0.0" specified. In this policy, the metadata
177 also includes "policy-id": "sample-policy-name2" and "policy-version": "2.0.0". The 200 return of this POST call will have this created policy with
178 metadata including "policy-id": "sample-policy-name1" and "policy-version": "1.0.0".
180 .. swaggerv2doc:: swagger/operational-policy-api.json
182 Regarding DELETE APIs for TOSCA compliant policies, we only expose API to delete one particular version of policy
183 or policy type at a time for safety purpose. If client has the need to delete multiple or a group of policies or policy types,
184 they will need to delete them one by one.
186 Sample API Curl Commands
187 -------------------------
189 From API client perspective, using *http* or *https* does not have much difference in curl command.
190 Here we list some sample curl commands (using *http*) for POST, GET and DELETE monitoring and operational policies that are used in vFirewall use case.
191 JSON payload for POST calls can be downloaded from policy table above.
193 Create vFirewall Monitoring Policy::
194 curl --user 'healthcheck:zb!XztG34' -X POST "http://{ip}:{port}/policy/api/v1/policytypes/onap.policies.monitoring.cdap.tca.hi.lo.app/versions/1.0.0/policies" -H "Accept: application/json" -H "Content-Type: application/json" -d @vFirewall.policy.monitoring.input.tosca.json
196 Get vFirewall Monitoring Policy::
197 curl --user 'healthcheck:zb!XztG34' -X GET "http://{ip}:{port}/policy/api/v1/policytypes/onap.policies.monitoring.cdap.tca.hi.lo.app/versions/1.0.0/policies/onap.vfirewall.tca/versions/1.0.0" -H "Accept: application/json" -H "Content-Type: application/json"
199 Delete vFirewall Monitoring Policy::
200 curl --user 'healthcheck:zb!XztG34' -X DELETE "http://{ip}:{port}/policy/api/v1/policytypes/onap.policies.monitoring.cdap.tca.hi.lo.app/versions/1.0.0/policies/onap.vfirewall.tca/versions/1.0.0" -H "Accept: application/json" -H "Content-Type: application/json"
202 Create vFirewall Operational Policy::
203 curl --user 'healthcheck:zb!XztG34' -X POST "http://{ip}:{port}/policy/api/v1/policytypes/onap.policies.controlloop.operational.common.Drools/versions/1.0.0/policies" -H "Accept: application/json" -H "Content-Type: application/json" -d @vFirewall.policy.operational.input.tosca.json
205 Get vFirewall Operational Policy::
206 curl --user 'healthcheck:zb!XztG34' -X GET "http://{ip}:{port}/policy/api/v1/policytypes/onap.policies.controlloop.operational.common.Drools/versions/1.0.0/policies/operational.modifyconfig/versions/1.0.0" -H "Accept: application/json" -H "Content-Type: application/json"
208 Delete vFirewall Operational Policy::
209 curl --user 'healthcheck:zb!XztG34' -X DELETE "http://{ip}:{port}/policy/api/v1/policytypes/onap.policies.controlloop.operational.common.Drools/versions/1.0.0/policies/operational.modifyconfig/versions/1.0.0" -H "Accept: application/json" -H "Content-Type: application/json"