Policy Sync

This page serves as an implementation for the Policy sync container described in the wiki

Policy Sync utility is a python based utility that interfaces with the ONAP/ECOMP policy websocket and REST APIs. It is designed to keep a local listing of policies in sync with an environment's policy distribution point (PDP). It functions well as a Kubernetes sidecar container which can pull down the latest policies for consumption by an application container.

The sync utility primarily utilizes the PDP's websocket notification API to receive policy update notifications. It also includes a periodic check of the PDP for resilliency purposes in the event of websocket API issues.

Build and Run

Easiest way to use is via docker by building the provided docker file

docker build . -t policy-puller

If you want to run it in a non containerized environment, an easy way is to use python virtual environments.

# Create a virtual environment in venv folder and activate it
python3 -m venv venv
source venv/bin/activate

# install the utility
pip install .

# Utility is now installed and usable in your virtual environment. Test it with:
policysync -h

Configuration

Configuration is currently done via either env variables or by flag. Flags take precedence env variables, env variables take precedence over default

General configuration

General configuration that is used regardless of which PDP API you are using.

ENV Variable	Flag	Description	Default
POLICY_SYNC_PDP_URL	--pdp-url	PDP URL to query	None (must be set in env or flag)
POLICY_SYNC_FILTER	--filters	yaml list of regex of policies to match	[]
POLICY_SYNC_ID	--ids	yaml list of ids of policies to match	[]
POLICY_SYNC_DURATION	--duration	duration in seconds for periodic checks	2600
POLICY_SYNC_OUTFILE	--outfile	File to output policies to	./policies.json
POLICY_SYNC_PDP_USER	--pdp-user	Set user if you need basic auth for PDP	None
POLICY_SYNC_PDP_PASS	--pdp-password	Set pass if you need basic auth for PDP	None
POLICY_SYNC_HTTP_METRICS	--http-metrics	Whether to expose prometheus metrics	True
POLICY_SYNC_HTTP_BIND	--http-bind	host:port for exporting prometheus metrics	localhost:8000
POLICY_SYNC_LOGGING_CONFIG	--logging-config	Path to a python formatted logging file	None (logs will write to stderr)
POLICY_SYNC_V0_ENABLE	--use-v0	Set to true to enable usage of legacy v0 API	False

V1 Specific Configuration (Used as of the Dublin release)

Configurable variables used for the V1 API used in the ONAP Dublin Release.

Note: Policy filters are not currently supported in the current policy release but will be eventually.

ENV Variable	Flag	Description	Default
POLICY_SYNC_V1_DECISION_ENDPOINT	--v1-decision-endpoint	Endpoint to query for PDP decisions	policy/pdpx/v1/decision
POLICY_SYNC_V1_DMAAP_URL	--v1-dmaap-topic	Dmaap url with topic for notifications	None
POLICY_SYNC_V1_DMAAP_USER	--v1-dmaap-user	User to use for DMaaP notifications	None
POLICY_SYNC_V1_DMAAP_PASS	--v1-dmaap-pass	Password to use for DMaaP notifications	None

V0 Specific Configuration (Legacy Policy API)

Configurable variables used for the legacy V0 API Prior to the ONAP release. Only valid when --use-v0 is set to True

ENV Variable	Flag	Description	Default
POLICY_SYNC_V0_NOTIFIY_ENDPOINT	--v0-notifiy-endpoint	websock endpoint for pdp notifications	pdp/notifications
POLICY_SYNC_V0_DECISION_ENDPOINT	--v0-decision-endpoint	rest endpoint for pdp decisions	pdp/api

Usage

You can run in a pure docker setup:

# Run the container
docker run 
    --env POLICY_SYNC_PDP_USER=<username> \
    --env POLICY_SYNC_PDP_PASS=<password> \
    --env POLICY_SYNC_PDP_URL=<path_to_pdp> \
    --env POLICY_SYNC_V1_DMAAP_URL='https://<dmaap_host>:3905/events/<dmaap_topic>' \
    --env POLICY_SYNC_V1_DMAAP_PASS='<user>' \
    --env POLICY_SYNC_V1_DMAAP_USER='<pass>' \
    --env POLICY_SYNC_ID=['DCAE.Config_MS_AGING_UVERSE_PROD'] \
    -v $(pwd)/policy-volume:/etc/policy \
    nexus3.onap.org:10001/onap/org.onap.dcaegen2.deployments.policy-sync:1.0.0

Or on Kubernetes:

# policy-config-map
apiVersion: v1
kind: policy-config-map
metadata:
  name: special-config
  namespace: default
data:
  POLICY_SYNC_PDP_USER: myusername
  POLICY_SYNC_PDP_PASS: mypassword
  POLICY_SYNC_PDP_URL: <path_to_pdp>
  POLICY_SYNC_V1_DMAAP_URL: 'https://<dmaap_host>:3905/events/<dmaap_topic>' \
  POLICY_SYNC_V1_DMAAP_PASS: '<user>' \
  POLICY_SYNC_V1_DMAAP_USER: '<pass>' \
  POLICY_SYNC_FILTER: '["DCAE.Config_MS_AGING_UVERSE_PROD"]'
  
  
---

apiVersion: v1
kind: Pod
metadata:
  name: Sidecar sample app
spec:
  restartPolicy: Never
 
 
  # The shared volume that the two containers use to communicate...empty dir for simplicity
  volumes:
  - name: policy-shared
    emptyDir: {}
 
  containers:
 
  # Sample app that uses inotifyd (part of busybox/alpine). For demonstration purposes only...
  - name: main
    image: nexus3.onap.org:10001/onap/org.onap.dcaegen2.deployments.policy-sync:1.0.0
    volumeMounts:
    - name: policy-shared
      mountPath: /etc/policies.json
      subPath: policies.json
    # For details on what this does see: https://wiki.alpinelinux.org/wiki/Inotifyd
    # you can replace '-' arg below with a shell script to do more interesting
    cmd: [ "inotifyd", "-", "/etc/policies.json:c" ]
 
 
    # The sidecar app which keeps the policies in sync
  - name: policy-sync
    image: nexus3.onap.org:10001/onap/org.onap.dcaegen2.deployments.policy-sync:1.0.0
    envFrom:
      - configMapRef:
          name: special-config
    
    volumeMounts:
    - name: policy-shared
      mountPath: /etc/policies