87 lines
3.8 KiB
YAML
87 lines
3.8 KiB
YAML
---
|
|
name: CrossProjectNetwork
|
|
description: >
|
|
Identify cross-project network connections unless the projects are defined as
|
|
being in the same group allowing for inter-connectivity.
|
|
|
|
The first four rules below define by name which projects belong in the same
|
|
group, where network inter-connectivity is expected. The use of name to
|
|
specify projects works under the assumption of having a single keystone
|
|
domain in which project names are unique. If names are unsuitable for
|
|
your use case, the policy can be customized to use specify
|
|
inter-connectivity groups by ID directly in the project_groups_by_id
|
|
table.
|
|
rules:
|
|
-
|
|
comment: >
|
|
User should customize this. project_groups_by_name(group_id, project_name).
|
|
rule: >
|
|
project_groups_by_name(1, 'admin')
|
|
-
|
|
comment: >
|
|
User should customize this. project_groups_by_name(group_id, project_name).
|
|
rule: >
|
|
project_groups_by_name(1, 'service')
|
|
-
|
|
comment: >
|
|
User should customize this. project_groups_by_name(group_id, project_name).
|
|
rule: >
|
|
project_groups_by_name(2, 'demo')
|
|
-
|
|
comment: >
|
|
User should customize this. project_groups_by_name(group_id, project_name).
|
|
rule: >
|
|
project_groups_by_name(2, 'alt_demo')
|
|
-
|
|
comment: >
|
|
Translates the project_groups_by_name defined above to
|
|
project_groups_by_id. If desired, this rule can be replaced by explicit
|
|
definition of the project_groups_by_id table.
|
|
rule: >
|
|
project_groups_by_id(group_id, project_id) :-
|
|
project_groups_by_name(group_id, project_name),
|
|
keystonev3:projects(name=project_name, id=project_id)
|
|
-
|
|
comment: "Define that projects belong to same group of expected inter-connectivity."
|
|
rule: >
|
|
same_group(project_a, project_b) :-
|
|
project_groups_by_id(group_id, project_a),
|
|
project_groups_by_id(group_id, project_b)
|
|
-
|
|
comment: >
|
|
Identify servers associated to a port belonging to a different project
|
|
not in the same group.
|
|
rule: >
|
|
unexpected_server_to_port(server_project_id, port_project_id, server_id, server_name) :-
|
|
neutronv2:ports(id=port_id, tenant_id=port_project_id, network_id=network_id, device_id=server_id),
|
|
nova:servers(id=server_id, name=server_name, tenant_id=server_project_id),
|
|
not same_group(port_project_id, server_project_id)
|
|
-
|
|
comment: >
|
|
Identify servers connected to a network belonging to a different project
|
|
not in the same group.
|
|
rule: >
|
|
unexpected_server_to_network(server_project_id, network_project_id, server_id, server_name) :-
|
|
neutronv2:ports(id=port_id, network_id=network_id, device_id=server_id),
|
|
nova:servers(id=server_id, name=server_name, tenant_id=server_project_id),
|
|
neutronv2:networks(id=network_id, tenant_id=network_project_id),
|
|
not same_group(server_project_id, network_project_id)
|
|
-
|
|
comment: >
|
|
Warn on servers associated to a port belonging to a different project
|
|
not in the same group.
|
|
rule: >
|
|
warning(server_project_name, server_project_id, port_project_name, port_project_id, server_name, server_id) :-
|
|
unexpected_server_to_port(server_project_id, port_project_id, server_id, server_name),
|
|
keystonev3:projects(name=server_project_name, id=server_project_id),
|
|
keystonev3:projects(name=port_project_id, id=port_project_name)
|
|
-
|
|
comment: >
|
|
Error on servers connected to a network belonging to a different project
|
|
not in the same group.
|
|
rule: >
|
|
error(server_project_name, server_project_id, network_project_name, network_project_id, server_name, server_id) :-
|
|
unexpected_server_to_network(server_project_id, network_project_id, server_id, server_name),
|
|
keystonev3:projects(name=server_project_name, id=server_project_id),
|
|
keystonev3:projects(name=network_project_name, id=network_project_id)
|