Policy Training

Supported Policy Implementations

Policy Training

Supported Policy Implementations

Jason Coposky

@jason_coposky

Executive Director, iRODS Consortium

August 3-6, 2020

KU Leuven Training

Webinar Presentation

Consortium Supported Policy

The consortium gathers requirements from the community and reflects them back a supported policy implementations

  • AMQP Audit Trail
  • Logical Quotas
  • Hard Links
  • Metadata Guard
  • Storage Tiering
  • Indexing
  • Publishing

Current Policy Implementations:

(referred to as Capabilities)

AMQP Audit Plugin

A packaged plugin that emits an AMQP message with a JSON payload for every event within the system

{
  "instance_name": "irods_rule_engine_plugin-audit_amqp-instance",
  "plugin_name": "irods_rule_engine_plugin-audit_amqp",
  "plugin_specific_configuration" : {
  "amqp_location" : "ANONYMOUS@localhost:5672",
  "amqp_options" : "",
  "amqp_topic" : "audit_messages",
  "pep_regex_to_match" : "audit_.*"
  }
},

...

"rule_engine_namespaces": [
  "", 
  "audit_"
], 

The event stream can be ingested by infrastructure like the Elastic Stack for dashboards as well as provenance

Example Configuration:

Logical Quotas

Allows administrators to track and enforce limits on the number of bytes and data objects in a collection using metadata

"rule_engines": [
    {
        "instance_name": "irods_rule_engine_plugin-logical_quotas-instance",
        "plugin_name": "irods_rule_engine_plugin-logical_quotas",
        "plugin_specific_configuration": {
            "namespace": "irods::logical_quotas",
            "metadata_attribute_names": {
                "maximum_number_of_data_objects": "maximum_number_of_data_objects",
                "maximum_size_in_bytes": "maximum_size_in_bytes",
                "total_number_of_data_objects": "total_number_of_data_objects",
                "total_size_in_bytes": "total_size_in_bytes"
            }
        }
    },
    
    // ... Previously installed rule engine plugin configs ...
]

Example Configuration:

Logical Quotas

The following operations are supported:

  • logical_quotas_count_total_number_of_data_objects
  • logical_quotas_count_total_size_in_bytes
  • logical_quotas_recalculate_totals
  • logical_quotas_set_maximum_number_of_data_objects
  • logical_quotas_set_maximum_size_in_bytes
  • logical_quotas_start_monitoring_collection
  • logical_quotas_stop_monitoring_collection
  • logical_quotas_unset_maximum_number_of_data_objects
  • logical_quotas_unset_maximum_size_in_bytes
  • logical_quotas_unset_total_number_of_data_objects
  • logical_quotas_unset_total_size_in_bytes

 

Which can be used with irule to invoke policy controls for collections

Logical Quotas

irule -r irods_rule_engine_plugin-logical_quotas-instance '{"operation": "logical_quotas_set_maximum_number_of_data_objects", "collection": "/tempZone/home/rods", "value": "100"}' null ruleExecOut

Set a maximum limit on the number of data objects:

irule -r irods_rule_engine_plugin-logical_quotas-instance '{"operation": "logical_quotas_start_monitoring_collection", "collection": "/tempZone/home/rods"}' null ruleExecOut

Start monitoring a collection:

Hard Links

Provides hard link support within iRODS

"rule_engines": [
    {
        "instance_name": "irods_rule_engine_plugin-hard_links-instance",
        "plugin_name": "irods_rule_engine_plugin-hard_links",
        "plugin_specific_configuration": {}
    },
    
    // ... Previously installed rule engine plugin configs ...
]

Configuration

Hard Links

irule -r irods_rule_engine_plugin-hard_links-instance '{"operation": "hard_link_create", "logical_path": "/tempZone/home/rods/foo", "replica_number": "0", "link_name": "/tempZone/home/rods/bar.hl"}' null ruleExecOut

Creating a hard link:

Provides hard link support within iRODS

{
    // One of the operations listed above.
    // Because there is only one operation at this time, this should
    // be set to "hard_link_create".
    "operation": "<value>",

    // The absolute path of the source data object.
    "logical_path": "<value>",

    // The replica number identifying a specific replica under the
    // source data object.
    "replica_number": "<value>",

    // The absolute logical path to use for the new hard linked data object.
    // This path will point to the physical path identified by
    // tuple (logical_path, replica_number).
    "link_name": "<value>"
}

Metadata Guard

Provides access control around metadata

"rule_engines": [
    {
        "instance_name": "irods_rule_engine_plugin-metadata_guard-instance",
        "plugin_name": "irods_rule_engine_plugin-metadata_guard",
        "plugin_specific_configuration": {}
    },
    
    // ... Previously installed Rule Engine Plugin configs ...
]

Configuration:

Metadata Guard

{
    // The list of strings that represent metadata that should be guarded.
    // In this example, any metadata beginning with "irods::" will be treated special
    // and require that the user be an administrator or classified as an editor depending
    // on the configuration.
    "prefixes": ["irods::"],

    // Only administrators are allowed to modify metadata.
    // This option supersedes the "editors" option.
    "admin_only": true,

    // The list of editors that can modify guarded metadata.
    "editors": [
        {
            // The type of entity that is allowed to modify metadata.
            // The following options are available:
            // - "user"
            // - "group"
            "type": "group",

            // The name of the iRODS entity.
            // For remote users, you must include the zone (e.g. "rods#tempZone").
            "name": "rodsadmin"
        }
    ]
}

JSON schema for collection metadata

Metadata Guard

imeta set -C /tempZone irods::metadata_guard '{"prefixes": ["irods::"], "admin_only": true}'

Usage

Anytime a request to modify metadata is detected by the server, the Rule Engine Plugin will read the JSON config and determine whether the user should be allowed to continue 

Capabilities

Storage Tiering

Indexing

Publishing

Packaged collections of policy which meet specific outcomes

Integrity will be the final packaged capability

Questions?

KU Leuven Policy Training - Supported Policy Implementations

By jason coposky

KU Leuven Policy Training - Supported Policy Implementations

  • 1,057