Skip to content

Policies

Overview

A policy (or a policy template) in VCF Automation is a set of rules or parameters that are applied to VCF Automation projects to govern deployment requests from entitled users and impose guardrails around provisioning requests.

In VCF Automation All Apps organizations, there are four types of policy templates.

  • Approval policies allow you to exercise control over deployment and day-2 action requests before they are run by reviewing requests before resources are consumed or destroyed.
  • Day 2 Actions policies allow you to control what changes users can make to deployments and their component resources.
  • IaaS Resource policies allow you to validate and control what namespace resources deployments can consume when users request catalog items or create resources using the services console in VCF Automation.
  • Lease policies allow you to control the amount of time that a deployment is available to your users and help you reduce the need to intervene manually to reclaim resources.

Project Structure

Build Tools for VMware Aria stores a policy template object in a single JSON file that contain the full policy template definition. For ease of management, Build Tools for VMware Aria stores the JSON definition files from each policy type in a separate directory with the name of the policy type under the src/main/resources/policies directory in the project on the local filesystem. The name of each JSON file is the name of the policy template that is configured in the project and is used only for filtering purposes in push and pull operations. The actual policy name as it appears in VCF Automation is an attribute in the file contents.

Note

Since VCF Automation allows you to configure multiple policy templates with the same name, when you are exporting policy templates from the remote server, Build Tools for VMware Aria stores the policy template definition on your local filesystem as a JSON file that uses the format policyName[-index].json, where -index is an optional numerical index that Build Tools for VMware Aria adds only if there are multiple policy templates with the same name.

Following is a sample listing of the local filesystem for a four policies (one of each supported type).

Local Project Content
src/
└── main/
    └── resources/
        └── policies/
            └── approval/
                └── vm_resize_approval.json
            └── day2-actions/
                └── vm_remove_disk.json
            └── iaas-resource/
                └── large-namespace-policy.json
            └── lease/
                └── short_lease.json

Sample Project File Content

This section contains sample listings of the content of the policy template definition files from each type as they are stored in the src/main/resources/policies/ directory in the project content on the local filesystem.

Following is a sample listing of the content of the vm_resize_approval.json file for the vm_resize_approval approval policy (as defined in the project archetype).

src/main/resources/policies/approval/vm_resize_approval.json 
{
  "id" : "0697ce31-1f66-4fd3-97b9-e45f36d3de56",
  "name" : "vm_resize_approval",
  "typeId" : "com.vmware.policy.approval",
  "enforcementType" : "HARD",
  "description" : "Sample Approval policy",
  "definition" : {
    "level" : 1,
    "actions" : [ "CCI.Supervisor.Resource.VirtualMachine.Resize" ],
    "approvers" : [ "ROLE:PROJECT_ADMINISTRATORS" ],
    "approvalMode" : "ANY_OF",
    "approverType" : "ROLE",
    "autoApprovalExpiry" : 3,
    "autoApprovalDecision" : "REJECT"
  },
  "criteria" : {
    "matchExpression" : [ {
      "key" : "requestedBy",
      "operator" : "contains",
      "value" : "dummy"
    } ]
  }
}

Following is a sample listing of the content of the vm_remove_disk.json file for the vm_remove_disk day-2 action policy (as defined in the project archetype).

src/main/resources/policies/day2-actions/vm_remove_disk.json 
{
  "id" : "eb9dbf29-9f57-4256-878c-3e5dac591ff5",
  "name" : "vm_remove_disk",
  "typeId" : "com.vmware.policy.deployment.action",
  "enforcementType" : "HARD",
  "description" : "Sample Day 2 Actions policy",
  "definition" : {
    "allowedActions" : [ {
      "actions" : [ "CCI.Supervisor.Resource.VirtualMachine.Remove.Disk" ],
      "authorities" : [ "ROLE:administrator" ]
    } ]
  },
  "criteria" : {
    "matchExpression" : [ {
      "key" : "ownedBy",
      "operator" : "contains",
      "value" : "dummy"
    } ]
  }
}

Following is a sample listing of the content of the large-namespace-policy.json file for the large-namespace-policy day-2 action policy (as defined in the project archetype).

src/main/resources/policies/iaas-resource/large-namespace-policy.json 
{
  "id" : "741000a4-3a2f-4680-b4e8-1653e075eef7",
  "name" : "large-namespace-policy",
  "typeId" : "com.vmware.policy.supervisor.iaas",
  "enforcementType" : "HARD",
  "description" : "Sample IaaS Resource policy",
  "definition" : {
    "automationPolicy" : {
      "validations" : [ {
        "reason" : "",
        "message" : "",
        "expression" : "false"
      } ],
      "failurePolicy" : "Fail",
      "matchConstraints" : {
        "resourceRules" : [ {
          "apiGroups" : [ "blueprint" ],
          "resources" : [ "vm" ],
          "operations" : [ "CREATE", "UPDATE" ],
          "apiVersions" : [ "9.0.0" ]
        } ]
      },
      "validationActions" : [ "Deny" ]
    }
  },
  "criteria" : {
    "matchExpression" : [ {
      "key" : "object.spec.className",
      "operator" : "eq",
      "value" : "large"
    } ]
  }
}

Following is a sample listing of the content of the short_lease.json file for the short_lease day-2 action policy (as defined in the project archetype).

src/main/resources/policies/lease/short_lease.json 
{
  "id" : "658b8ebf-e7da-4edd-b2f9-9e3838e3255e",
  "name" : "short_lease",
  "typeId" : "com.vmware.policy.deployment.lease",
  "enforcementType" : "SOFT",
  "description" : "Sample Lease policy",
  "definition" : {
    "leaseGrace" : 3,
    "leaseTermMax" : 5,
    "leaseTotalTermMax" : 14
  },
  "criteria" : {
    "matchExpression" : [ {
      "key" : "ownedBy",
      "operator" : "contains",
      "value" : "dummy"
    } ]
  }
}

Export

To export a policy template from the VCF Automation server (pull the content), you need to add the name of the policy template definition file (the name of the JSON definition file without the extension) as a list item of the element with the name of the policy type under the policy element in the content.yaml content descriptor file for the project.

Tip

Alternatively, if you want to export all policy template objects from a specific type from the project on the VCF Automation server, you can configure the policy type element under the policy element with no value (i.e. its value is null). For details, see the Content Filtering section.

Following is a sample listing of the content.yaml file for a project that exports only the specified policy templates (one from each type) from the project on the VCF Automation server.

content.yaml
policy:
  approval:
    - vm_resize_approval
  day2-actions:
    - vm_remove_disk
  iaas-resource:
    - large-namespace-policy
  lease:
    - short_lease
# ...

Import

When you import policy templates from any type to a project on a VCF Automation server (push operation), Build Tools for VMware Aria uses the content filtering rules to create a list of policy templates to import to the project, matches each policy template object by its name and ID (the name and the UUID of the policy template that are configured as JSON attributes in the content of the definition file on the local filesystem), and performs one of the following operations.

Warning

Note that for push operations for VCF Automation projects for All Apps organizations, Build Tools for VMware Aria uses the content filtering rules that you define in the content.yaml content descriptor file. For details, see the Content Filtering section.

  • If a policy with the same name and ID does not exist on the server, Build Tools for VMware Aria creates a new policy template with the definition from the local project file.
  • If a policy with the same name and ID already exists on the server, Build Tools for VMware Aria checks if there are any differences between the local copy and the server copy and performs one of the following operations.
    • If there are no differences between the local copy and the server copy, BTVA skips the operation and does not update the policy template object on the server.
    • If there are differences between the local copy and the server copy, BTVA updates the existing policy template object on the server with the definition from the local project.