Congress is an open policy framework for the cloud. With Congress, a cloud operator can declare, monitor, enforce, and audit “policy” in a heterogeneous cloud environment. Congress gets inputs from a cloud’s various cloud services; for example in OpenStack, Congress fetches information about VMs from Nova, and network state from Neutron, etc. Congress then feeds input data from those services into its policy engine where Congress verifies that the cloud’s actual state abides by the cloud operator’s policies. Congress is designed to work with any policy and any cloud service.
The cloud is a collection of autonomous services that constantly change the state of the cloud, and it can be challenging for the cloud operator to know whether the cloud is even configured correctly. For example,
Congress’s job is to help people manage that plethora of state across all cloud services with a succinct policy language.
Setting up Congress involves writing policies and configuring Congress to fetch input data from the cloud services. The cloud operator writes policy in the Congress policy language, which receives input from the cloud services in the form of tables. The language itself resembles datalog. For more detail about the policy language and data format see Policy.
To add a service as an input data source, the cloud operator configures a Congress “driver,” and the driver queries the service. Congress already has drivers for several types of service, but if a cloud operator needs to use an unsupported service, she can write a new driver without much effort and probably contribute the driver to the Congress project so that no one else needs to write the same driver.
Finally, when using Congress, the cloud operator must choose what Congress should do with the policy it has been given:
In the future, Congress will also help the cloud operator audit policy (analyze the history of policy and policy violations).
Congress is free software and is licensed with Apache.
There are 2 ways to install Congress.
For integrating Congress with DevStack:
$ git clone https://git.openstack.org/openstack-dev/devstack.git
$ cd devstack
[[local|localrc]]
enable_plugin congress http://git.openstack.org/openstack/congress
enable_plugin heat http://git.openstack.org/openstack/heat
enable_plugin aodh http://git.openstack.org/openstack/aodh
enable_plugin ceilometer http://git.openstack.org/openstack/ceilometer
enable_service s-proxy s-object s-container s-account
$ ./stack.sh
Install the following software, if you haven’t already.
$ sudo apt-get install git gcc python-dev python-antlr3 libxml2 libxslt1-dev libzip-dev build-essential libssl-dev libffi-dev
$ sudo apt install python-setuptools
$ sudo pip install --upgrade pip virtualenv pbr tox
Clone Congress
$ git clone https://github.com/openstack/congress.git
$ cd congress
Install requirements
$ sudo pip install .
Install Source code
$ sudo python setup.py install
Configure Congress (Assume you put config files in /etc/congress)
$ sudo mkdir -p /etc/congress
$ sudo mkdir -p /etc/congress/snapshot
$ sudo cp etc/api-paste.ini /etc/congress
$ sudo cp etc/policy.json /etc/congress
Generate a configuration file as outlined in the Configuration Options section of the Deployment document. Note: you may have to run the command with sudo.
There are several sections in the congress/etc/congress.conf.sample file you may want to change:
Add drivers:
drivers = congress.datasources.neutronv2_driver.NeutronV2Driver,congress.datasources.glancev2_driver.GlanceV2Driver,congress.datasources.nova_driver.NovaDriver,congress.datasources.keystone_driver.KeystoneDriver,congress.datasources.ceilometer_driver.CeilometerDriver,congress.datasources.cinder_driver.CinderDriver,congress.datasources.swift_driver.SwiftDriver,congress.datasources.plexxi_driver.PlexxiDriver,congress.datasources.vCenter_driver.VCenterDriver,congress.datasources.murano_driver.MuranoDriver,congress.datasources.ironic_driver.IronicDriver
The default auth_strategy is keystone. To set Congress to use no authorization strategy:
auth_strategy = noauth
If you use noauth, you might want to delete or comment out the [keystone_authtoken] section.
Set the database connection string in the [database] section (adapt MySQL root password):
connection = mysql+pymysql://root:password@127.0.0.1/congress?charset=utf8
To use RabbitMQ with Congress, set the transport_url in the “From oslo.messaging” section according to your setup:
transport_url = rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST:5672
A bare-bones congress.conf is as follows:
[DEFAULT]
auth_strategy = noauth
drivers = congress.datasources.neutronv2_driver.NeutronV2Driver,congress.datasources.glancev2_driver.GlanceV2Driver,congress.datasources.nova_driver.NovaDriver,congress.datasources.keystone_driver.KeystoneDriver,congress.datasources.ceilometer_driver.CeilometerDriver,congress.datasources.cinder_driver.CinderDriver,congress.datasources.swift_driver.SwiftDriver,congress.datasources.plexxi_driver.PlexxiDriver,congress.datasources.vCenter_driver.VCenterDriver,congress.datasources.murano_driver.MuranoDriver,congress.datasources.ironic_driver.IronicDriver
log_file=congress.log
log_dir=/var/log/congress
[database]
connection = mysql+pymysql://root:password@127.0.0.1/congress?charset=utf8
When you are finished editing congress.conf.sample, copy it to the /etc/congress directory.
sudo cp etc/congress.conf.sample /etc/congress/congress.conf
Create database
$ mysql -u root -p
$ mysql> CREATE DATABASE congress;
$ mysql> GRANT ALL PRIVILEGES ON congress.* TO 'congress'@'localhost' IDENTIFIED BY 'CONGRESS_DBPASS';
$ mysql> GRANT ALL PRIVILEGES ON congress.* TO 'congress'@'%' IDENTIFIED BY 'CONGRESS_DBPASS';
Push down schema
$ sudo congress-db-manage --config-file /etc/congress/congress.conf upgrade head
Use your OpenStack RC file to set and export required environment variables: OS_USERNAME, OS_PASSWORD, OS_PROJECT_NAME, OS_TENANT_NAME, OS_AUTH_URL.
(Adapt parameters according to your environment)
$ ADMIN_ROLE=$(openstack role list | awk "/ admin / { print \$2 }")
$ SERVICE_TENANT=$(openstack project list | awk "/ service / { print \$2 }")
$ CONGRESS_USER=$(openstack user create --password password --project service --email "congress@example.com" congress | awk "/ id / {print \$4 }")
$ openstack role add $ADMIN_ROLE --user $CONGRESS_USER --project $SERVICE_TENANT
$ CONGRESS_SERVICE=$(openstack service create policy --name congress --description "Congress Service" | awk "/ id / { print \$4 }")
Identity v2:
$ openstack endpoint create $CONGRESS_SERVICE --region RegionOne --publicurl http://127.0.0.1:1789/ --adminurl http://127.0.0.1:1789/ --internalurl http://127.0.0.1:1789/
Identity v3:
$ openstack endpoint create --region $OS_REGION_NAME $CONGRESS_SERVICE public http://$SERVICE_HOST:1789
$ openstack endpoint create --region $OS_REGION_NAME $CONGRESS_SERVICE admin http://$SERVICE_HOST:1789
$ openstack endpoint create --region $OS_REGION_NAME $CONGRESS_SERVICE internal http://$SERVICE_HOST:1789
$ sudo /usr/local/bin/congress-server --debug
$ openstack congress datasource create $SERVICE $"SERVICE" \
--config username=$OS_USERNAME \
--config tenant_name=$OS_TENANT_NAME
--config password=$OS_PASSWORD
--config auth_url=http://$SERVICE_HOST:5000/v2.0
$ cd /opt/stack/horizon
$ python manage.py compress
$ sudo service apache2 restart
$ sudo pip install sphinx
$ sudo pip install oslosphinx
$ make docs
If you are not familiar with using the OpenStack command-line clients, please read the OpenStack documentation before proceeding.
Once you have set up or obtained credentials to use the OpenStack command-line clients, you may begin testing Congress. During installation a number of policies are created.
To view policies: $ openstack congress policy list
To view installed datasources: $ openstack congress datasource list
To list available commands: $ openstack congress –help
Run unit tests in the Congress directory
$ tox -epy27
In order to break into the debugger from a unit test we need to insert a break point to the code:
import pdb; pdb.set_trace()
Then run tox with the debug environment as one of the following:
tox -e debug
tox -e debug test_file_name.TestClass.test_name
For more information see the oslotest documentation.
Here are the instructions for upgrading to a new release of the Congress server.
$ cd /path/to/congress
$ git fetch origin
3. Checkout the release you are interested in, say Mitaka. Note that this step will not succeed if you have any uncommitted changes in the repo.
$ git checkout origin/stable/mitaka
If you have changes committed locally that are not merged into the public repository, you now need to cherry-pick those changes onto the new branch.
$ sudo pip install
$ sudo python setup.py install
$ sudo congress-db-manage --config-file /etc/congress/congress.conf upgrade head
$ tox -egenconfig
$ sudo /usr/local/bin/congress-server --debug