Power Co (TEPCO), School of Computer Science at Carnegie Mellon University, Ascend Communications, CoSine Communications, Proxim, Fivefront, Nicira, VMware 2
generic policy engine so it works as standalone (i.e. without OpenStack) • That said, in order to define a meaningful / useful policy, some sort of information (“data source”) upon which policy can be defined is needed. • OpenStack has a rich set of data sources that can be consumed by Congress, so it is a great place for Congress to live! 4
of it as something that dictates how the system should behave in order to conform to: – Law / Regulations – Business rule – Application requirement – Geographical constraint – Security requirement – … 5 A generic language that can dictates these policies is needed!
Often used as a query language • Syntactically it is similar to Prolog but it has different semantics : – No Function Symbols – Guarantee to terminate – Order of rule definition is irrelevant – No “List” construct – No Cut （!) and fail operators 6
the head must also appear in the body in the rule as non-arithmetic positive literal. • All variables that appear in the body as negative literal must also appear in other positive literals. • Example of non-Safety rules – q(X, Y, Z) :- r1(X,Y), X < Z. – q(X, Y, Z) :- r1(X,Y), not r2(X, Y, Z). • Example of Safety rules – q(X, Y, Z) :- r1(X, Y), r2(Y, Z), X < Z. – q(X, Y, Z) :- r1(X,Y), not r2(X, Y, Z), r3(Y, Z). 8
Monitoring – Check the current status of Cloud against policy and report error if there’s a mismatch • Enforcement – Take an action in order to avoid policy violation – Proactively / Reactively / Interactively • Auditing – History management of policy and policy violation 11
have many number of columns. When writing policy using such a table it is cumbersome to write all those columns explicitly. • Full form: • Simplified form: 13 port(id) :- neutron:ports(id, tenant_id, name, network_id, mac_address, admin_state_up, status, device_owner, fixed_ips, security_groups). port(id) :- neutron:ports(id=id).
mshindo
nishiuma
shingo_kawahara
taichinakamura
muziyoshiz
magisystem0408
coosuke
nullpo_head
murashotaro
hakubishin3
nenonaninu
rssytems
marsee101
irinanazarova
smashingmag
wjessup
vanstee
malarkey
morganepeng
orderedlist
danielanewman
shpigford
stephaniewalter
holman
garrettdimon
![Example 2: Congress Policy (for enforcement) 16 Execute[neutron:disconnectNetwork(vm, network)] :-](https://files.speakerdeck.com/presentations/7c110fe84d9f4affab89ac81bfa9a3ff/slide_15.jpg){kind=link}
