Policy files contain the access control rules for an OpenStack deployment. The upstream policy files are conservative and restrictive; they are designed to be customized on the end users system. However, poorly written changes can potentially break security, their deployment should be carefully managed and monitored.

Since RBAC Policy controls access to the Keystone server, the Keystone policy files themselves are not served from a database in the Keystone server. They are, instead, configuration files, and managed via the deployment’s content management system. In a Tripleo based deployment, none of the other services use the policy storage in Keystone, either.

In Tripleo, the deployment of the overcloud is managed via Heat. the OpenStack Tripleo Heat templates have support for deploying files at the end of the install, and this matches how we need to deploy policy.

Steps:

1. Create a directory structure that mimics the policy file layout in the overcloud.  For this example, I will limit it to just Keystone.  Create a directory called policy (making this a git repository is reasonable) and under it create etc/keystone.
2. Inside that Directory, copy the either the default policy.json file or the overcloudv3sample.json to be named policy.json.
   1.  keystone:keystone as the owner,
   2. rw-r—– are the permissions
3. Modify the policy files to reflect organizational rules
4. Use the offline tool to check policy access control.  Confirm that the policy behaves as desired.
5. create a tarball of the files.
   1. cd policy
   2. tar -zxf openstack-policy.tar.gz etc
6. Use the Script to upload to undercloud swift:
   1. https://raw.githubusercontent.com/openstack/tripleo-common/master/scripts/upload-swift-artifacts
   2. . ./stackrc;  ./upload-swift-artifacts  openstack-policy.tar.gz
7. Confirm the upload with swift list -l overcloud
   1. 1298 2016-08-04 16:34:22 application/x-tar openstack-policy.tar.gz
8. Redeploy the overcloud
9. Confirm that the policy file contains the modifications made in development