enhance authz interface for policies #1

mapuri · 2016-01-16T00:47:37Z

This patch contains changes to:

introduce a policy map (as discussed in our earlier meetings and inline with discussion here Proposal: Policy Extension Point moby/moby#18647 (comment))
the authz plugin interface to allow passing policies from plugin to daemon
- additionally, since multiple authz plugins can be chained, the policies are also passed to subsequent plugins in the chain giving them a chance to update the policy, if needed
add the policies returned by the authz plugin to the container's config. This is visible when we do docker inspect.

Next steps:

review this PR and see if it is inline with what we want to propose to docker folks
update the documentation on authz plugins
I will continue to work on implementing a authz plugin (in contiv/policyengine repo) that adheres to the updated interface
- and possibly incorporate the structures from @jainvipin 's (soon to be sent) PR on concrete policy structures, discussion for which is already undergoing I believe on github-gist
make changes to libnetwork and volume driver interface to accept and pass policies down to drivers
see if we can implement the authz interface in volplugin and docknetplugin itself to avoid having a yet another daemon for storage and network policies.

Note: some of the changes are in vendor directory which implies this will possibly be merged as separate PRs in docker, if it get's accepted that is :).

/cc @shaleman @jainvipin @erikh @unclejack

jainvipin · 2016-01-16T02:01:34Z

@mapuri - basic structure looks right to me - thanks! Some comments:

test cases would be added soon after
Ref to the full-policy proposal: https://gist.github.com/jainvipin/8b1677f041534df576b2
Makefile changes for http_proxy, while not specific to an environment, may not be needed in the final checkin

jainvipin · 2016-01-16T02:09:05Z

api/server/router/container/container_routes.go

+	// set container policies associated by authz plugin(s)
+	policies, ok := ctx.Value("policies").(map[container.PolicyType]string)
+	if !ok {
+		logrus.Warnf("incorrect type for policy map %T, expected %T", ctx.Value("policies"), config.Policies)


curious why warn here? if policies are not associated with the ctx, then it is ok right?

this is just a log message for type assertion failure.

Yes, it is ok for no policies to be associated. If policies are not associated then we just set the map as empty on the next line so that it is not nil.

mapuri · 2016-01-16T05:25:26Z

@jainvipin thanks for the review.

I will update the documentation and test cases as well and push them in this PR.

mapuri · 2016-01-23T00:29:05Z

@jainvipin @shaleman

I have updated the policy related structure to be in line with the proposal here https://gist.github.com/jainvipin/8b1677f041534df576b2

PTAL when you get a chance.

jainvipin · 2016-01-31T05:00:01Z

vendor/src/github.com/docker/engine-api/types/container/network_policy_attribute.go

+}
+
+type firewallRule struct {
+	action   string


can we incorporate direction and PeerGroupId to the code? Ref the updated doc in the link below...

…o daemon Also hooked container create handler to set the policies in container config. Signed-off-by: Madhav Puri <[email protected]>

https://gist.github.com/jainvipin/8b1677f041534df576b2 Signed-off-by: Madhav Puri <[email protected]>

mapuri force-pushed the authz_work branch 3 times, most recently from 7105dbc to d176624 Compare January 16, 2016 01:57

jainvipin reviewed Jan 16, 2016
View reviewed changes

mapuri force-pushed the authz_work branch 7 times, most recently from e5534df to 124246d Compare January 23, 2016 00:26

jainvipin reviewed Jan 31, 2016
View reviewed changes

mapuri force-pushed the authz_work branch 2 times, most recently from 483a48d to d9c25e5 Compare February 2, 2016 02:15

mapuri force-pushed the authz_work branch 2 times, most recently from 8399cb4 to 47346b8 Compare February 29, 2016 20:29

modify authz plugin interface to allow passing policies from plugin t…

839ce2d

…o daemon Also hooked container create handler to set the policies in container config. Signed-off-by: Madhav Puri <[email protected]>

mapuri force-pushed the authz_work branch 3 times, most recently from 8d94690 to bafd8e6 Compare March 8, 2016 23:16

Add policy constructs based on jainvipin's gist

d380239

https://gist.github.com/jainvipin/8b1677f041534df576b2 Signed-off-by: Madhav Puri <[email protected]>

mapuri force-pushed the authz_work branch from bafd8e6 to d380239 Compare March 9, 2016 23:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

enhance authz interface for policies #1

enhance authz interface for policies #1

mapuri commented Jan 16, 2016

jainvipin commented Jan 16, 2016

jainvipin Jan 16, 2016

mapuri Jan 16, 2016

mapuri commented Jan 16, 2016

mapuri commented Jan 23, 2016

jainvipin Jan 31, 2016

enhance authz interface for policies #1

Are you sure you want to change the base?

enhance authz interface for policies #1

Conversation

mapuri commented Jan 16, 2016

jainvipin commented Jan 16, 2016

jainvipin Jan 16, 2016

Choose a reason for hiding this comment

mapuri Jan 16, 2016

Choose a reason for hiding this comment

mapuri commented Jan 16, 2016

mapuri commented Jan 23, 2016

jainvipin Jan 31, 2016

Choose a reason for hiding this comment