Policy Composition Language

• US 20170031956A1
• Filed: 08/17/2015
• Published: 02/02/2017
• Est. Priority Date: 07/31/2015
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Burk, Gregory T., Coote, Lachlan T.
• Granted Patent: US 10,025,810 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 15/161 Computing infrastructure, e.g. computer clusters, blade chassis or hardware partitioning casings, cabinets, racks or drawers for data centers H05K5/00
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/762 triggered by the network
• CPC Class Codes: H04L 47/827 Aggregation of resource allocation or reservation requests

Abstract

Some embodiments provide, for a policy framework, a method for managing policies for a set of resources in a computing environment. The method stores several imported policy rules as primitive policies, each of which includes a policy data structure that includes a set of fields. One of the fields of each primitive policy stores the imported policy rule for the primitive policy. The method defines several composite policies based at least in part on the primitive policies. The method stores the defined composite policies as policy data structures. Each policy data structure for a composite policy includes a set of fields and references at least one additional policy data structure.

Claims

1. For a policy framework, a method for managing policies for a set of resources in a computing environment, the method comprising:

storing a plurality of imported policy rules as primitive policies, each primitive policy comprising a policy data structure that comprises a set of fields, wherein one of the fields of each primitive policy stores the imported policy rule for the primitive policy; and

defining a plurality of composite policies based at least in part on the primitive policies; and

storing the defined composite policies as policy data structures, wherein each policy data structure for a composite policy comprises a set of fields and references at least one additional policy data structure.

2. The method of claim 1, wherein the set of fields for each policy data structure comprises a name field, a namespace field, and a version field.

3. The method of claim 2, wherein the references to additional policy data structures in the composite policy data structures use the name, namespace, and version fields of the additional policy data structures.

4. The method of claim 3, wherein a reference to a policy data structure without using a version field references a most recent version of the policy data structure having the referenced name and namespace fields.

5. The method of claim 1, wherein a policy data structure for a particular composite policy references multiple primitive policy data structures, wherein when the particular composite policy is bound to a particular computing resource by a binding rule, the method further comprises binding each of the primitive policies of the referenced policy data structures to the particular computing resource.

6. The method of claim 1, wherein a first policy data structure for a first composite policy references at least a second policy data structure for a second composite policy that references multiple policy data structures, wherein when the first composite policy is bound to a particular computing resource by a binding rule, the method further comprises binding each of the primitive policies of the policy data structures referenced by the second composite policy to the particular computing resource.

7. The method of claim 1, wherein a particular policy data structure for a particular primitive policy exposes at least one parameter to be provided during a compilation process for binding the particular primitive policy to computing resources.

8. The method of claim 7, wherein the data structure for a first composite policy references the particular policy data structure and provides a first value for the parameter.

9. The method of claim 8, wherein the data structure for a second composite policy references the particular policy data structure and provides a second, different value for the parameter.

10. The method of claim 7, wherein the particular primitive policy has a first parameter value when bound to a first computing resource and a second parameter value when bound to a second computing resource.

11. The method of claim 7, wherein the data structure for a particular composite policy references the particular policy data structure and calls a function to calculate a value to provide for the parameter.

12. The method of claim 11, wherein the function calculates the value based on a parameter provided by a data structure for another composite policy that references the data structure for the particular composite policy.

13. The method of claim 7, wherein a policy data structure for a particular composite policy (i) references the particular policy data structure and provides a first value for the parameter if a conditional statement is met and (ii) references the particular policy data structure and provides a second value for the parameter if the conditional statement is not met.

14. The method of claim 1, wherein a policy data structure for a particular composite policy references a first policy data structure if a conditional statement is met and a second policy data structure if a conditional statement is not met.

15. A machine readable medium storing a program which when executed manages policies for a set of resources in a computing environment, the program comprising sets of instructions for:

storing a plurality of imported policy rules as primitive policies, each primitive policy comprising a policy data structure that comprises a set of fields, wherein one of the fields of each primitive policy stores the imported policy rule for the primitive policy; and

defining a plurality of composite policies based at least in part on the primitive policies; and

storing the defined composite policies as policy data structures, wherein each policy data structure for a composite policy comprises a set of fields and references at least one additional policy data structure.

16. The machine readable medium of claim 15, wherein the set of fields for each policy data structure comprises a name field, a namespace field, and a version field, wherein the references to additional policy data structures in the composite policy data structures use the name, namespace, and version fields of the additional policy data structures, wherein a reference to a policy data structure without using a version field references a most recent version of the policy data structure having the referenced name and namespace fields.

17. The machine readable medium of claim 15, wherein a policy data structure for a particular composite policy references multiple primitive policy data structures, wherein the program further comprises a set of instructions for binding each of the primitive policies of the referenced policy data structures to a particular computing resource when the particular composite policy is bound to the particular computing resource by a binding rule.

18. The machine readable medium of claim 15, wherein a first policy data structure for a first composite policy references at least a second policy data structure for a second composite policy that references multiple policy data structures, wherein the program comprises a set of instructions for binding each of the primitive policies of the policy data structures referenced by the second composite policy to a particular computing resource when the first composite policy is bound to the particular computing resource by a binding rule.

19. The machine readable medium of claim 15, wherein a particular policy data structure for a particular primitive policy exposes at least one parameter to be provided during a compilation process for binding the particular primitive policy to computing resources.

20. The machine readable medium of claim 19, wherein the data structure for a first composite policy references the particular policy data structure and provides a first value for the parameter, wherein the data structure for a second composite policy references the particular policy data structure and provides a second, different value for the parameter.

21. The machine readable medium of claim 19, wherein the particular primitive policy has a first parameter value when bound to a first computing resource and a second parameter value when bound to a second computing resource.

22. The machine readable medium of claim 19, wherein the data structure for a particular composite policy references the particular policy data structure and calls a function to calculate a value to provide for the parameter.

23. The machine readable medium of claim 22, wherein the function calculates the value based on a parameter provided by a data structure for another composite policy that references the data structure for the particular composite policy.

24. The machine readable medium of claim 19, wherein a policy data structure for a particular composite policy (i) references the particular policy data structure and provides a first value for the parameter if a conditional statement is met and (ii) references the particular policy data structure and provides a second value for the parameter if the conditional statement is not met.

25. The machine readable medium of claim 15, wherein a policy data structure for a particular composite policy references a first policy data structure if a conditional statement is met and a second policy data structure if a conditional statement is not met.