RETIRED, Congress
Go to file
Alexander Yip 83b7d334cd Enable all services
Change-Id: I7f6ec42920d8e24edc4da75d1ffe38e82d9b01c9
2014-08-22 15:13:17 -07:00
bin Fix relative import path in source tree 2014-07-08 16:25:36 -07:00
congress Fixed return value in row_model's get_items 2014-08-20 12:55:35 -07:00
contrib/devstack Improved robustness of devstack install script for snapshot 2014-08-21 09:08:32 -07:00
doc/source Enable all services 2014-08-22 15:13:17 -07:00
etc Removed Services theory 2014-08-20 12:28:53 -07:00
examples Added policy error checking 2014-02-28 13:52:09 -08:00
specs Merge "Spec API validation" 2014-07-24 00:47:49 +00:00
thirdparty Rearrange project directory structure 2013-08-13 10:34:44 -07:00
.coveragerc Restructure to follow OpenStack cookiecutter template 2014-01-07 15:31:36 -08:00
.gitignore Add devstack integration files 2014-08-01 20:49:30 +00:00
.gitreview Restructure to follow OpenStack cookiecutter template 2014-01-07 15:31:36 -08:00
.mailmap Restructure to follow OpenStack cookiecutter template 2014-01-07 15:31:36 -08:00
.testr.conf Restructure to follow OpenStack cookiecutter template 2014-01-07 15:31:36 -08:00
CONTRIBUTING.rst Updated docs for alpha 2014-08-18 16:28:57 -07:00
HACKING.rst Restructure to follow OpenStack cookiecutter template 2014-01-07 15:31:36 -08:00
LICENSE Restructure to follow OpenStack cookiecutter template 2014-01-07 15:31:36 -08:00
MANIFEST.in Add hook to create parser in setup.py 2014-07-08 16:43:38 -07:00
Makefile First cut of user-docs 2014-03-18 14:57:55 -07:00
README.rst Enable all services 2014-08-22 15:13:17 -07:00
antlr3 Hack to make unittests pass with tox 2014-02-20 16:42:11 -08:00
babel.cfg Restructure to follow OpenStack cookiecutter template 2014-01-07 15:31:36 -08:00
future-features.txt Adding future-features.txt 2014-04-17 13:59:15 -07:00
openstack-common.conf Restructure to follow OpenStack cookiecutter template 2014-01-07 15:31:36 -08:00
requirements.txt Fix requirements.txt 2014-08-14 11:23:35 -07:00
run_tests.sh Add run_tests.sh to congress 2014-07-15 15:11:36 -07:00
setup.cfg Add missing entry point in setup.cfg for congress-server 2014-07-17 13:24:03 -07:00
setup.py Sync requirements with upstream 2014-08-01 20:49:23 +00:00
test-requirements.txt Sync requirements with upstream 2014-08-01 20:49:23 +00:00
tox.ini Add hook to create parser in setup.py 2014-07-08 16:43:38 -07:00

README.rst

Congress Introduction and Installation

1. What is Congress

Congress is an open policy framework for the cloud. With Congress, a cloud operator can declare, monitor, enforce, and audit "policy" in a heterogeneous cloud environment. Congress get inputs from a cloud's various cloud services; for example in Openstack, Congress fetches information about VMs from Nova, and network state from Neutron, etc. Congress then feeds input data from those services into its policy engine where Congress verifies that the cloud's actual state abides by the cloud operator's policies. Congress is designed to work with any policy and any cloud service.

2. Why is Policy Important

The cloud is a collection of autonomous services that constantly change the state of the cloud, and it can be challenging for the cloud operator to know whether the cloud is even configured correctly. For example,

  • The services are often independent from each other, and do not support transactional consistency across services, so a cloud management system can change one service (create a VM) without also making a necessary change to another service (attach the VM to a network). This can lead to incorrect behavior.
  • Other times, we have seen a cloud operator allocate cloud resources and then forget to clean them up when the resources are no longer in use, effectively leaving garbage around the system and wasting resources.
  • The desired cloud state can also change over time. For example, if a security vulnerability appears in Linux version X, then all machines with version X that were ok in the past are now in an undesirable state. A version number policy would detect all the machines in that undesirable state. This is a trivial example, but the more complex the policy, the more helpful a policy system becomes.

Congress's job is to help people manage that plethora of state across all cloud services with a susinct policy language.

3. Using Congress

Setting up Congress involves writing policies and configuring Congress to fetch input data from the cloud services. The cloud operator writes policy in the Congress policy language, which receives input from the cloud services in the form of tables. The language itself resembles datalog. For more detail about the policy language and data format see Policy <policy.rst>.

To add a service as an input data source, the cloud operator configures a Congress "driver", and the driver queries the service. Congress already has drivers for several types of service, but if a cloud operator needs to use an unsupported service, she can write a new driver without much effort, and probably contribute the driver to the Congress project so that no one else needs to write the same driver.

Finally, when using Congress, the cloud operator will need to address violations that Congress detects. Usually, this means fixing the cloud configuration to abide by the policy. In the future Congress will also provide mechanisms to enforce policy (by preventing violations before they occur or correcting violations after the fact) and to audit policy (analyze the history of policy and policy violations).

  • Free software: Apache license

4. Installing Congress

There are 2 ways to install Congress.

  • As part of devstack. This allows you to run Congress alongside live instances of other OpenStack projects like Nova and Neutron.
  • Standalone. This allows you to write code and run unit tests, without requiring a full devstack installation.

4.1 Devstack-install

The contrib/devstack/ directory contains the files necessary to integrate Congress with devstack.

To install, make sure you have git installed. Then:

$ git clone https://git.openstack.org/openstack-dev/devstack
 (Or set env variable DEVSTACKDIR to the location to your devstack code)

$ wget http://git.openstack.org/cgit/stackforge/congress/plain/contrib/devstack/prepare_devstack.sh

$ chmod u+x prepare_devstack.sh

$ ./prepare_devstack.sh

Configure ENABLED_SERVICES in the devstack/localrc file :

ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-obj,n-cpu,n-sch,n-cauth,horizon,mysql,rabbit,sysstat,cinder,c-api,c-vol,c-sch,n-cond,quantum,q-svc,q-agt,q-dhcp,q-l3,q-meta,q-lbaas,n-novnc,n-xvnc,q-lbaas

Run devstack as normal. Note: the default data source configuration assumes the admin password is 'password':

$ ./stack.sh

4.2 Standalone-install

Install the following software, if you haven't already.

Clone Congress:

$ git clone https://github.com/stackforge/congress.git
$ cd congress

Install test harness:

$ pip install 'tox<1.7'

Run unit tests:

$ tox -epy27

Read the HTML documentation:

$ make docs
Open doc/html/index.html in a browser