.. _policy_enf_rules:

Creating policy enforcement rules
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This article illustrates how you can create policy enforcement rules.
For testing purposes, create rules that prohibit the creation
of instances with the flavor with over 2048 MB of RAM following
the procedure below.

**Procedure:**

#. Verify that you have configured your OpenStack environment as described
   in :ref:`policyenf_setup`.

#. To create the ``predeploy_errors`` rule, run:

   .. code-block:: console

      congress policy rule create murano_system "predeploy_errors(eid, obj_id, msg) :- murano:objects(obj_id, pid, type), murano:objects(eid, tid, \"io.murano.Environment\"), murano:connected(eid, pid), murano:properties(obj_id, \"flavor\", flavor_name), flavor_ram(flavor_name, ram), gt(ram, 2048), murano:properties(obj_id, \"name\", obj_name), concat(obj_name, \": instance flavor has RAM size over 2048MB\", msg)"

   The command above contains the following information:

   .. code-block:: console

       predeploy_errors(eid, obj_id, msg) :-
          murano:objects(obj_id, pid, type),
          murano:objects(eid, tid, "io.murano.Environment"),
          murano:connected(eid, pid),
          murano:properties(obj_id, "flavor", flavor_name),
          flavor_ram(flavor_name, ram),
          gt(ram, 2048),
          murano:properties(obj_id, "name", obj_name),
          concat(obj_name, ": instance flavor has RAM size over 2048MB", msg)

   Policy validation engine checks the ``predeploy_errors`` rule, and rules
   referenced within this rule are evaluated by the Congress engine.

   In this example, we create the rule that references the ``flavor_ram``
   rule we create afterwards. It disables flavors with RAM more than
   2048 MB and constructs the message returned to the user
   in the ``msg`` variable.

   In this example we use data from policy **murano** which is represented by
   ``murano:properties``. There are stored rows with decomposition of model
   representing murano application. We also use built-in functions of Congress:

   * ``gt`` stands for 'greater-than'
   * ``concat`` joins two strings into one variable

#. To create the ``flavor_ram`` rule, run:

   .. code-block:: console

      congress policy rule create murano_system "flavor_ram(flavor_name, ram) :- nova:flavors(id, flavor_name, cpus, ram)"

   This rule resolves parameters of flavor by flavor name and returns
   the ``ram`` parameter. It uses the ``flavors`` rule from ``nova`` policy.
   Data in this policy is filled by the ``nova`` datasource driver.

#. Check the rule usage.

   #. Create an environment with a simple application:

      - Select an application from the murano applications.
      - Create a ``m1.medium`` instance, which uses 4096 MB RAM.

      .. image:: /draft/admin-guide/policy_enforcement/new-inst.png
         :alt: Create new instance
         :width: 100 %

   #. Deploy the environment.

Deployment fails as the rule is violated: environment is in the ``Deploy
FAILURE`` status. Check the deployment logs for details:

.. image:: /draft/admin-guide/policy_enforcement/deploy-log.png
   :alt: Deployment log
   :width: 100 %


.. seealso::

   * :ref:`base_mod_rules`
