Chu
368
GBP is a policy framework specifically focused on networking and network‐based
security services. It is otherwise general and has been utilized in Openstack on top
of Neutron [34], and in OpenDaylight [35], in addition to commercial products from
several networking vendors.
Next, let us look at an example of a policy framework that is more general‐purpose by
design, beyond just networking.
15.7.2.2 Openstack Congress
The analogy of policy management in a data center to that of a government was not lost
on the team developing a policy system for Openstack. They aptly named their system
Congress.
Congress is a general‐purpose policy framework that is implemented within Openstack as a service, although it could live outside of Openstack. The main com ponents of
Congress are:
● A policy language: Datalog [36];
● Data source: all main services in Openstack such as Nova, Neutron, Cinder, Glance,
Swift, Keystone, other data collection services like Ceilometer/aodh, and non‐
Openstack systems, can all be its data sources; and
● An implementation of policy services: for monitoring, enforcement and audit of the
policy.
Although the policy language, Datalog, is syntax‐wise a subset of Prolog and is
evaluated as first‐order logic (therefore always consistent), it is closer to a query
language like SQL. Congress can support many modes of policy services. For example,
in reactive mode, Congress reports a policy violation after the fact, and can also trigger
a corrective action. In proactive mode, Congress can check if a violation would occur
if an action were taken and therefore prevent the violation from occurring in the first
place. A consumer of Congress’s service could consult Congress for pre‐clearance.
Congress can also be used for monitoring and reporting, and provide audit trails for
compliance.
Because Datalog is a general language used for deductive reasoning, Congress can be
used to express any policy, for example, environmental policy, power usage – or for our
purposes, security and data center operations. Here is a simple example taken from
OPNFV Copper project [37] that should be self‐explanatory.
Apache
Classifer
Firewall
IDS
Load
Balancer
APP
Server
mySQL
Service chain
App-group
Db-group
Redirect
Port 80
Web-group
Deny
C opy
Figure 15.9 Example of GBP with NFV service chaining.
368
GBP is a policy framework specifically focused on networking and network‐based
security services. It is otherwise general and has been utilized in Openstack on top
of Neutron [34], and in OpenDaylight [35], in addition to commercial products from
several networking vendors.
Next, let us look at an example of a policy framework that is more general‐purpose by
design, beyond just networking.
15.7.2.2 Openstack Congress
The analogy of policy management in a data center to that of a government was not lost
on the team developing a policy system for Openstack. They aptly named their system
Congress.
Congress is a general‐purpose policy framework that is implemented within Openstack as a service, although it could live outside of Openstack. The main com ponents of
Congress are:
● A policy language: Datalog [36];
● Data source: all main services in Openstack such as Nova, Neutron, Cinder, Glance,
Swift, Keystone, other data collection services like Ceilometer/aodh, and non‐
Openstack systems, can all be its data sources; and
● An implementation of policy services: for monitoring, enforcement and audit of the
policy.
Although the policy language, Datalog, is syntax‐wise a subset of Prolog and is
evaluated as first‐order logic (therefore always consistent), it is closer to a query
language like SQL. Congress can support many modes of policy services. For example,
in reactive mode, Congress reports a policy violation after the fact, and can also trigger
a corrective action. In proactive mode, Congress can check if a violation would occur
if an action were taken and therefore prevent the violation from occurring in the first
place. A consumer of Congress’s service could consult Congress for pre‐clearance.
Congress can also be used for monitoring and reporting, and provide audit trails for
compliance.
Because Datalog is a general language used for deductive reasoning, Congress can be
used to express any policy, for example, environmental policy, power usage – or for our
purposes, security and data center operations. Here is a simple example taken from
OPNFV Copper project [37] that should be self‐explanatory.
Apache
Classifer
Firewall
IDS
Load
Balancer
APP
Server
mySQL
Service chain
App-group
Db-group
Redirect
Port 80
Web-group
Deny
C opy
Figure 15.9 Example of GBP with NFV service chaining.