===========================================
Murano Policy Enforcement - Developer Guide
===========================================

.. _policyenf_dev:

This document describes internals of murano policy enforcement.

Model Decomposition
-------------------

Models of Murano applications are transformed to set of rules that are processed by congress. This represent data for policy validation.

There are several "tables" created in murano policy for different kind of rules:

- ``murano:objects(object_id, parent_id, type_name)``
- ``murano:properties(object_id, property_name, property_value)``
- ``murano:relationships(source, target, name)``
- ``murano:connected(source, target)``
- ``murano:parent_types(object_id, parent_type_name)``
- ``murano:states(environment_id, state)``

``murano:objects(object_id, parent_id, type_name)``
""""""""""""""""""""""""""""""""""""""""""""""""""""""""

This rule is used for representation of all objects in Murano model (environment, applications, instances, ...).
Value of property ``type`` is used as ``type_name`` parameter:

.. code-block:: yaml

    name: wordpress-env
    '?': {type: io.murano.Environment, id: 83bff5ac}
    applications:
    - '?': {id: e7a13d3c, type: io.murano.databases.MySql}
..

Transformed to these rules:

- ``murano:objects+("83bff5ac", "tenant_id", "io.murano.Environment")``
- ``murano:objects+("83bff5ac", "e7a13d3c", "io.murano.databases.MySql")``

.. note:: The owner of the environment is a tenant


``murano:properties(object_id, property_name, property_value)``
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

Each object can have properties. In this example we have application with one property:

.. code-block:: yaml

    applications:
    - '?': {id: e7a13d3c, type: io.murano.databases.MySql}
    database: wordpress
..

Transformed to this rule:

- ``murano:properties+("e7a13d3c", "database", "wordpress")``

Inner properties are also supported using dot notation:

.. code-block:: yaml

    instance:
    '?': {id: 825dc61d, type: io.murano.resources.LinuxMuranoInstance}
    networks:
      useFlatNetwork: false
..

Transformed to this rule:

- ``murano:properties+("825dc61d", "networks.useFlatNetwork", "False")``

If model contains list of values it is represented as set of multiple rules:

.. code-block:: yaml

    instances:
    - '?': {id: be3c5155, type: io.murano.resources.LinuxMuranoInstance}
    networks:
      customNetworks: [10.0.1.0, 10.0.2.0]
..

Transformed to these rules:

- ``murano:properties+("be3c5155", "networks.customNetworks", "10.0.1.0")``
- ``murano:properties+("be3c5155", "networks.customNetworks", "10.0.2.0")``

``murano:relationships(source, target, name)``
""""""""""""""""""""""""""""""""""""""""""""""

Murano app models can contain references to other applications. In this example WordPress application references MySQL in property "database":

.. code-block:: yaml

    applications:
    - '?':
        id: 0aafd67e
        type: io.murano.databases.MySql
    - '?':
        id: 50fa68ff
        type: io.murano.apps.WordPress
      database: 0aafd67e
..

Transformed to this rule:

- ``murano:relationships+("50fa68ff", "0aafd67e", "database")``

.. note:: For property "database" we do not create rule ``murano:properties+``.

Also if we define inner object inside other object, they will have relationship between them:

.. code-block:: yaml

    applications:
    - '?':
        id: 0aafd67e
        type: io.murano.databases.MySql
      instance:
        '?': {id: ed8df2b0, type: io.murano.resources.LinuxMuranoInstance}
..

Transformed to this rule:

- ``murano:relationships+("0aafd67e", "ed8df2b0", "instance")``

There are special relationships "services" from the environment to its applications:

- ``murano:relationships+("env_id", "app_id", "services")``


``murano:connected(source, target)``
""""""""""""""""""""""""""""""""""""

This table stores both direct and indirect connections between instances. It is derived from the ``murano:relationships``:

.. code-block:: yaml

    applications:
    - '?':
        id: 0aafd67e
        type: io.murano.databases.MySql
      instance:
        '?': {id: ed8df2b0, type: io.murano.resources.LinuxMuranoInstance}
    - '?':
        id: 50fa68ff
        type: io.murano.apps.WordPress
      database: 0aafd67e
..

Transformed to rules:

- ``murano:connected+("50fa68ff", "0aafd67e")`` # WordPress to MySql
- ``murano:connected+("50fa68ff", "ed8df2b0")`` # WordPress to LinuxMuranoInstance
- ``murano:connected+("0aafd67e", "ed8df2b0")`` # MySql to LinuxMuranoInstance


``murano:parent_types(object_id, parent_name)``
"""""""""""""""""""""""""""""""""""""""""""""""

Each object in murano has a class type and these classes can inherit from one or more parents:

e.g. ``LinuxMuranoInstance`` > ``LinuxInstance`` > ``Instance``

So this model:

.. code-block:: yaml

    instances:
    - '?': {id: be3c5155, type: LinuxMuranoInstance}
..

Transformed to these rules:

- ``murano:objects+("...", "be3c5155", "LinuxMuranoInstance")``
- ``murano:parent_types+("be3c5155", "LinuxMuranoInstance")``
- ``murano:parent_types+("be3c5155", "LinuxInstance")``
- ``murano:parent_types+("be3c5155", "Instance")``

.. note:: Type of object is also repeated among parent types (``LinuxMuranoInstance`` in example) for easier handling of user-created rules.

.. note:: If type inherits from more than one parent and those parents inherit from one common type, ``parent_type`` rule is included only once for common type.

``murano:states(environment_id, state)``
""""""""""""""""""""""""""""""""""""""""

Currently only one record for environment is created:

- ``murano:states+("uugi324", "pending")``