9a26eb0f38
Following changes were made in congress mapping of murano objects: Relationship "services" is created for environment and its applications. Property tenant_id on environment is no longer needed. Ownerships respect embedded objects within the tree. Change-Id: I846d4d2be9ebf2fd7d5b75ea8e36eed87e56a633 Closes-Bug: #1439591
162 lines
4.8 KiB
ReStructuredText
162 lines
4.8 KiB
ReStructuredText
===========================================
|
|
Murano Policy Enforcement - Developer Guide
|
|
===========================================
|
|
|
|
This document describes internals of murano policy enforcement.
|
|
|
|
Model Decomposition
|
|
-------------------
|
|
|
|
Models of Murano applications are transformed to set of rules that are processed by congress. This represent data for policy validation.
|
|
|
|
There are several "tables" created in murano policy for different kind of rules:
|
|
|
|
- ``murano:objects(environment_id, object_id, type_name)``
|
|
- ``murano:properties(object_id, property_name, property_value)``
|
|
- ``murano:relationships(source, target, name)``
|
|
- ``murano:parent_types(object_id, parent_name)``
|
|
- ``murano:states(environment_id, state)``
|
|
|
|
``murano:objects(environment_id, object_id, type_name)``
|
|
""""""""""""""""""""""""""""""""""""""""""""""""""""""""
|
|
|
|
This rule is used for representation of all objects in murano model (environment, applications, instances, ...).
|
|
Value of property ``type`` is used as ``type_name`` parameter:
|
|
|
|
.. code-block:: yaml
|
|
|
|
name: wordpress-env
|
|
'?': {type: io.murano.Environment, id: 83bff5ac}
|
|
applications:
|
|
- '?': {id: e7a13d3c, type: io.murano.databases.MySql}
|
|
..
|
|
|
|
Transformed to these rules:
|
|
|
|
- ``murano:objects+("83bff5ac", "tenant_id", "io.murano.Environment")``
|
|
- ``murano:objects+("83bff5ac", "e7a13d3c", "io.murano.databases.MySql")``
|
|
|
|
.. note:: The owner of the environment is a tenant
|
|
|
|
|
|
``murano:properties(object_id, property_name, property_value)``
|
|
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
|
|
|
|
Each object can have properties. In this example we have application with one property:
|
|
|
|
.. code-block:: yaml
|
|
|
|
applications:
|
|
- '?': {id: e7a13d3c, type: io.murano.databases.MySql}
|
|
database: wordpress
|
|
..
|
|
|
|
Transformed to this rule:
|
|
|
|
- ``murano:properties+("e7a13d3c", "database", "wordpress")``
|
|
|
|
Inner properties are also supported using dot notation:
|
|
|
|
.. code-block:: yaml
|
|
|
|
instance:
|
|
'?': {id: 825dc61d, type: io.murano.resources.LinuxMuranoInstance}
|
|
networks:
|
|
useFlatNetwork: false
|
|
..
|
|
|
|
Transformed to this rule:
|
|
|
|
- ``murano:properties+("825dc61d", "networks.useFlatNetwork", "False")``
|
|
|
|
If model contains list of values it is represented as set of multiple rules:
|
|
|
|
.. code-block:: yaml
|
|
|
|
instances:
|
|
- '?': {id: be3c5155, type: io.murano.resources.LinuxMuranoInstance}
|
|
networks:
|
|
customNetworks: [10.0.1.0, 10.0.2.0]
|
|
..
|
|
|
|
Transformed to these rules:
|
|
|
|
- ``murano:properties+("be3c5155", "networks.customNetworks", "10.0.1.0")``
|
|
- ``murano:properties+("be3c5155", "networks.customNetworks", "10.0.2.0")``
|
|
|
|
``murano:relationships(source, target, name)``
|
|
""""""""""""""""""""""""""""""""""""""""""""""
|
|
|
|
Murano app models can contain references to other applications. In this example WordPress application references MySQL in property "database":
|
|
|
|
.. code-block:: yaml
|
|
|
|
applications:
|
|
- '?':
|
|
id: 0aafd67e
|
|
type: io.murano.databases.MySql
|
|
- '?':
|
|
id: 50fa68ff
|
|
type: io.murano.apps.WordPress
|
|
database: 0aafd67e
|
|
..
|
|
|
|
Transformed to this rule:
|
|
|
|
- ``murano:relationships+("50fa68ff", "0aafd67e", "database")``
|
|
|
|
.. note:: For property "database" we do not create rule ``murano:properties+``.
|
|
|
|
Also if we define inner object inside other object, they will have relationship between them:
|
|
|
|
.. code-block:: yaml
|
|
|
|
applications:
|
|
- '?':
|
|
id: 0aafd67e
|
|
type: io.murano.databases.MySql
|
|
instance:
|
|
'?': {id: ed8df2b0, type: io.murano.resources.LinuxMuranoInstance}
|
|
..
|
|
|
|
Transformed to this rule:
|
|
|
|
- ``murano:relationships+("0aafd67e", "ed8df2b0", "instance")``
|
|
|
|
There are special relationships "services" from the environment to its applications:
|
|
|
|
- ``murano:relationships+("env_id", "app_id", "services")``
|
|
|
|
|
|
``murano:parent_types(object_id, parent_name)``
|
|
"""""""""""""""""""""""""""""""""""""""""""""""
|
|
|
|
Each object in murano has class type and these classes can inherit from one or more parents:
|
|
|
|
e.g. ``LinuxMuranoInstance`` > ``LinuxInstance`` > ``Instance``
|
|
|
|
So this model:
|
|
|
|
.. code-block:: yaml
|
|
|
|
instances:
|
|
- '?': {id: be3c5155, type: LinuxMuranoInstance}
|
|
..
|
|
|
|
Transformed to these rules:
|
|
|
|
- ``murano:objects+("...", "be3c5155", "LinuxMuranoInstance")``
|
|
- ``murano:parent_types+("be3c5155", "LinuxMuranoInstance")``
|
|
- ``murano:parent_types+("be3c5155", "LinuxInstance")``
|
|
- ``murano:parent_types+("be3c5155", "Instance")``
|
|
|
|
.. note:: Type of object is also repeated among parent types (``LinuxMuranoInstance`` in example) for easier handling of user-created rules.
|
|
|
|
.. note:: If type inherits from more than one parent and those parents inherit from one common type, ``parent_type`` rule is included only once for common type.
|
|
|
|
``murano:states(environment_id, state)``
|
|
""""""""""""""""""""""""""""""""""""""""
|
|
|
|
Currently only one record for environment is created:
|
|
|
|
- ``murano:states+("uugi324", "pending")`` |