Add the moon_orchestrator element.

Change-Id: I09712c0b6e8e7d17a765829a981280ca5fd8af75

39 files changed, 1069 insertions, 0 deletions

diff --git a/moonv4/moon_orchestrator/conf/dockers/template.dockerfile b/moonv4/moon_orchestrator/conf/dockers/template.dockerfile
new file mode 100644
index 00000000..6bb8a0c6
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/dockers/template.dockerfile
@@ -0,0 +1,25 @@
+# Pull base image.
+FROM ubuntu:latest
+
+{{ proxy }}
+
+RUN apt-get update && apt-get install python3.5 python3-pip -y
+
+ADD dist/moon_utilities-0.1.0.tar.gz /root
+WORKDIR /root/moon_utilities-0.1.0
+RUN pip3 install pip --upgrade
+RUN pip3 install --upgrade -r requirements.txt
+RUN pip3 install --upgrade .
+
+ADD dist/moon_db-0.1.0.tar.gz /root
+WORKDIR /root/moon_db-0.1.0
+RUN pip3 install --upgrade -r requirements.txt
+RUN pip3 install --upgrade .
+
+{{ run }}
+
+{% for port in ports %}
+EXPOSE {{ port }}
+{% endfor %}
+
+CMD {{ cmd }}
diff --git a/moonv4/moon_orchestrator/conf/moon.conf b/moonv4/moon_orchestrator/conf/moon.conf
new file mode 100644
index 00000000..c0d1d14c
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/moon.conf
@@ -0,0 +1,87 @@
+[DEFAULT]
+# proxy URL
+#proxy=http://172.28.16.30:3128
+proxy=
+transport_url=rabbit://moon:p4sswOrd1@messenger:5672/moon
+#transport_url=rabbit://moon:p4sswOrd@localhost:5672/moon
+
+debug=True
+
+# directory where the python packages can be found
+dist_dir=/home/vdsq3226/projets/opnfv/moonv4/moon_orchestrator/dist
+plugin_dir=/etc/moon/plugins
+
+docker_url=unix://var/run/docker.sock
+
+root_policy_directory=policy_root
+policy_directory=/etc/moon/policies
+
+[slave]
+
+# name of the slave
+# example slave_name=slave1
+slave_name=
+
+# URL of the RabbitMQ bus of the Master
+# example: master_url=rabbit://moon:p4sswOrd1@master_messenger:5672/moon
+master_url=
+
+# login name of the master administrator
+# example: master_login=admin
+master_login=
+
+# password of the master administrator
+# example: master_password=p4ssw0rd
+master_password=
+
+[database]
+
+# Database for that server (may be different from master to slave)
+url=mysql+pymysql://moon:p4sswOrd1@db/moon
+driver=sql
+
+[database_configuration]
+
+# Database for configuration elements (may be different from master to slave)
+driver=memory
+url=
+
+[orchestrator]
+host=127.0.0.1
+port=38002
+container=
+
+[security_router]
+host=172.18.0.10
+
+# Name of the container to download (if empty build from scratch)
+# example: container=moon/moon_secrouter:latest
+container=
+
+[security_manager]
+host=172.18.0.10
+
+# Name of the container to download (if empty build from scratch)
+# example: container=moon/moon_manager:latest
+container=
+
+[interface]
+host=172.18.0.11
+port=38001
+# Name of the container to download (if empty build from scratch)
+# example: container=moon/moon_interface:latest
+container=
+
+[security_function]
+# Name of the container to download (if empty build from scratch)
+# example: container=moon/moon_secfunction:latest
+container=
+
+[keystone]
+url=http://keystone:5000/v3
+user=admin
+password=p4ssw0rd
+domain=default
+project=admin
+check_token=False
+server_crt=False
diff --git a/moonv4/moon_orchestrator/conf/plugins/authz.py b/moonv4/moon_orchestrator/conf/plugins/authz.py
new file mode 100644
index 00000000..c472b36a
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/plugins/authz.py
@@ -0,0 +1,66 @@
+# Copyright 2015 Open Platform for NFV Project, Inc. and its contributors
+# This software is distributed under the terms and conditions of the 'Apache-2.0'
+# license which can be found in the file 'LICENSE' in this package distribution
+# or at 'http://www.apache.org/licenses/LICENSE-2.0'.
+
+import os
+import time
+import hashlib
+from oslo_config import cfg
+from oslo_log import log as logging
+import oslo_messaging
+from moon_orchestrator.dockers import DockerBase
+
+LOG = logging.getLogger(__name__)
+CONF = cfg.CONF
+DOMAIN = "moon_orchestrator"
+
+__CWD__ = os.path.dirname(os.path.abspath(__file__))
+# TODO (asteroide): select the right template folder
+TEMPLATES_FOLDER = os.path.join(__CWD__, "..", "conf", "dockers")
+# TODO (asteroide): add specific configuration options for that plugin
+
+
+class AuthzFunction(DockerBase):
+
+    id = "moon_authz_function"
+    __build = """RUN mkdir -p /etc/moon/
+COPY conf /etc/moon/
+ADD dist/{py_pkg}.tar.gz /root
+WORKDIR /root/{py_pkg}
+RUN pip3 install -r requirements.txt
+RUN pip3 install .
+"""
+
+    def __init__(self, uuid, conf_file="", docker=None, network_config=None):
+        self.id = "authz_"+hashlib.sha224(uuid.encode("utf-8")).hexdigest()
+        super(AuthzFunction, self).__init__(
+            name="moon_authz",
+            run_cmd=["python3", "-m", "moon_authz", uuid],
+            conf_file=conf_file,
+            docker=docker,
+            network_config=network_config,
+            build_cmd=self.__build,
+            id=self.id,
+            tag=""
+            # tag=CONF.security_function.container
+        )
+        # note(asteroide): time to let the new docker boot
+        time.sleep(3)
+        self.get_status()
+
+    def get_status(self):
+        transport = oslo_messaging.get_transport(CONF)
+        target = oslo_messaging.Target(topic=self.id, version='1.0')
+        client = oslo_messaging.RPCClient(transport, target)
+        LOG.info("Calling Status on {}".format(self.id))
+        ret = client.call({"component_id": self.id}, 'get_status', args=None)
+        LOG.info(ret)
+        return ret
+
+
+def run(uuid, conf_file="", docker=None, network_config=None):
+    return AuthzFunction(uuid,
+                         conf_file=conf_file,
+                         docker=docker,
+                         network_config=network_config)
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/assignment.json
new file mode 100644
index 00000000..7a6c722e
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/assignment.json
@@ -0,0 +1,55 @@
+{
+    "subject_assignments": {
+        "subject_security_level":{
+			"admin": ["high"],
+			"demo": ["medium"]
+        },
+		"domain":{
+			"admin": ["ft"],
+			"demo": ["xx"]
+        },
+		"role": {
+			"admin": ["admin"],
+			"demo": ["dev"]
+		}
+    },
+
+    "action_assignments": {
+        "resource_action":{
+			"pause": ["vm_admin"],
+			"unpause": ["vm_admin"],
+			"start": ["vm_admin"],
+			"stop": ["vm_admin"],
+			"list": ["vm_access", "vm_admin"],
+			"create": ["vm_admin"],
+			"storage_list": ["storage_access"],
+			"download": ["storage_access"],
+			"post": ["storage_admin"],
+			"upload": ["storage_admin"]
+        },
+		"access": {
+			"pause": ["write"],
+			"unpause": ["write"],
+			"start": ["write"],
+			"stop": ["write"],
+			"list": ["read"],
+			"create": ["write"],
+			"storage_list": ["read"],
+			"download": ["read"],
+			"post": ["write"],
+			"upload": ["write"]
+		}
+    },
+
+    "object_assignments": {
+        "object_security_level": {
+            "servers": ["low"]
+        },
+		"type": {
+			"servers": ["computing"]
+		},
+		"object_id": {
+			"servers": ["servers"]
+		}
+    }
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/metadata.json
new file mode 100644
index 00000000..21a99eb2
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/metadata.json
@@ -0,0 +1,23 @@
+{
+    "name": "Simple_Policy",
+    "genre": "authz",
+    "description": "Simple Security Policy",
+    "pdp_pipeline": ["authz:rbac_rule", "authz:mls_rule"],
+
+    "subject_categories": [
+        "subject_security_level",
+		"domain",
+		"role"
+    ],
+
+    "action_categories": [
+        "resource_action",
+        "access"
+    ],
+
+    "object_categories": [
+        "object_security_level",
+		"type",
+		"object_id"
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/metarule.json
new file mode 100644
index 00000000..c9afd6c2
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/metarule.json
@@ -0,0 +1,24 @@
+{
+    "sub_meta_rules": {
+		"mls_rule": {
+			"subject_categories": ["subject_security_level"],
+			"action_categories": ["resource_action"],
+			"object_categories": ["object_security_level"],
+			"algorithm": "inclusion"
+		},
+		"dte_rule": {
+			"subject_categories": ["domain"],
+			"action_categories": ["access"],
+			"object_categories": ["type"],
+			"algorithm": "inclusion"
+		},
+		"rbac_rule": {
+			"subject_categories": ["role", "domain"],
+			"action_categories": ["access"],
+			"object_categories": ["object_id"],
+			"algorithm": "inclusion"
+		}
+	},
+	"aggregation": "all_true"
+}
+
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/perimeter.json
new file mode 100644
index 00000000..47a8ee45
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/perimeter.json
@@ -0,0 +1,21 @@
+{
+    "subjects": [
+        "admin",
+        "demo"
+    ],
+    "actions": [
+        "pause",
+        "unpause",
+        "start",
+        "stop",
+        "create",
+        "list",
+        "upload",
+        "download",
+        "post",
+        "storage_list"
+    ],
+    "objects": [
+        "servers"
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/rule.json
new file mode 100644
index 00000000..25f9d93a
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/rule.json
@@ -0,0 +1,25 @@
+{
+	"mls_rule":[
+		["high", "vm_admin", "medium"],
+		["high", "vm_admin", "low"],
+		["medium", "vm_admin", "low"],
+		["high", "vm_access", "high"],
+		["high", "vm_access", "medium"],
+		["high", "vm_access", "low"],
+		["medium", "vm_access", "medium"],
+		["medium", "vm_access", "low"],
+		["low", "vm_access", "low"]
+	],
+	"dte_rule":[
+		["ft", "read", "computing"],
+		["ft", "write", "computing"],
+		["ft", "read", "storage"],
+		["ft", "write", "storage"],
+		["xx", "read", "storage"]
+	],
+	"rbac_rule":[
+		["dev", "xx", "read", "servers"],
+		["admin", "xx", "read", "servers"],
+		["admin", "ft", "read", "servers"]
+	]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/scope.json
new file mode 100644
index 00000000..9b313daf
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/scope.json
@@ -0,0 +1,49 @@
+{
+  "subject_scopes": {
+    "role": [
+      "admin",
+      "dev"
+    ],
+    "subject_security_level": [
+      "high",
+      "medium",
+      "low"
+    ],
+    "domain": [
+      "ft",
+      "xx"
+    ]
+  },
+
+  "action_scopes": {
+    "resource_action": [
+      "vm_admin",
+      "vm_access",
+      "storage_admin",
+      "storage_access"
+    ],
+    "access": [
+      "write",
+      "read"
+    ]
+  },
+
+  "object_scopes": {
+    "object_security_level": [
+      "high",
+      "medium",
+      "low"
+      ],
+    "type": [
+      "computing",
+      "storage"
+    ],
+    "object_id": [
+      "servers",
+      "vm1",
+      "vm2",
+      "file1",
+      "file2"
+    ]
+  }
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/assignment.json
new file mode 100644
index 00000000..24018a09
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/assignment.json
@@ -0,0 +1,7 @@
+{
+    "subject_assignments": {},
+
+    "action_assignments": {},
+
+    "object_assignments": {}
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metadata.json
new file mode 100644
index 00000000..3c9be2e5
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metadata.json
@@ -0,0 +1,12 @@
+{
+    "name": "Empty_Policy",
+    "model": "",
+    "genre": "admin",
+    "description": "Empty Policy",
+
+    "subject_categories": [],
+
+    "action_categories": [],
+
+    "object_categories": []
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metarule.json
new file mode 100644
index 00000000..7acd8848
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metarule.json
@@ -0,0 +1,12 @@
+{
+    "sub_meta_rules": {
+		"mls_rule": {
+			"subject_categories": [],
+			"action_categories": [],
+			"object_categories": [],
+			"algorithm": ""
+		}
+	},
+	"aggregation": ""
+}
+
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/perimeter.json
new file mode 100644
index 00000000..54dbfc31
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/perimeter.json
@@ -0,0 +1,39 @@
+{
+    "subjects": [],
+    "actions": [
+        "read",
+        "write"
+    ],
+    "objects": [
+        "authz.subjects",
+        "authz.objects",
+        "authz.actions",
+        "authz.subject_categories",
+        "authz.object_categories",
+        "authz.action_categories",
+        "authz.subject_scopes",
+        "authz.object_scopes",
+        "authz.action_scopes",
+        "authz.subject_assignments",
+        "authz.object_assignments",
+        "authz.action_assignments",
+        "authz.aggregation_algorithm",
+        "authz.sub_meta_rules",
+        "authz.rules",
+        "admin.subjects",
+        "admin.objects",
+        "admin.actions",
+        "admin.subject_categories",
+        "admin.object_categories",
+        "admin.action_categories",
+        "admin.subject_scopes",
+        "admin.object_scopes",
+        "admin.action_scopes",
+        "admin.subject_assignments",
+        "admin.object_assignments",
+        "admin.action_assignments",
+        "admin.aggregation_algorithm",
+        "admin.sub_meta_rules",
+        "admin.rules"
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/rule.json
new file mode 100644
index 00000000..fe4fae5a
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/rule.json
@@ -0,0 +1,3 @@
+{
+	"mls_rule":[]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/scope.json
new file mode 100644
index 00000000..1efebe6f
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/scope.json
@@ -0,0 +1,7 @@
+{
+  "subject_scopes": {},
+
+  "action_scopes": {},
+
+  "object_scopes": {}
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/assignment.json
new file mode 100644
index 00000000..24018a09
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/assignment.json
@@ -0,0 +1,7 @@
+{
+    "subject_assignments": {},
+
+    "action_assignments": {},
+
+    "object_assignments": {}
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metadata.json
new file mode 100644
index 00000000..4f300d78
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metadata.json
@@ -0,0 +1,12 @@
+{
+    "name": "MLS_Policy",
+    "model": "MLS",
+    "genre": "authz",
+    "description": "Multi Level Security Policy",
+
+    "subject_categories": [],
+
+    "action_categories": [],
+
+    "object_categories": []
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metarule.json
new file mode 100644
index 00000000..7acd8848
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metarule.json
@@ -0,0 +1,12 @@
+{
+    "sub_meta_rules": {
+		"mls_rule": {
+			"subject_categories": [],
+			"action_categories": [],
+			"object_categories": [],
+			"algorithm": ""
+		}
+	},
+	"aggregation": ""
+}
+
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/perimeter.json
new file mode 100644
index 00000000..9da8a8c0
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/perimeter.json
@@ -0,0 +1,5 @@
+{
+    "subjects": [],
+    "actions": [],
+    "objects": []
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/rule.json
new file mode 100644
index 00000000..fe4fae5a
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/rule.json
@@ -0,0 +1,3 @@
+{
+	"mls_rule":[]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/scope.json
new file mode 100644
index 00000000..1efebe6f
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/scope.json
@@ -0,0 +1,7 @@
+{
+  "subject_scopes": {},
+
+  "action_scopes": {},
+
+  "object_scopes": {}
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/assignment.json
new file mode 100644
index 00000000..0712dfbc
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/assignment.json
@@ -0,0 +1,29 @@
+{
+    "subject_assignments": {
+        "subject_security_level":{
+			"admin": ["high"],
+			"demo": ["medium"]
+        }
+	},
+
+    "action_assignments": {
+        "resource_action":{
+			"pause": ["vm_admin"],
+			"unpause": ["vm_admin"],
+			"start": ["vm_admin"],
+			"stop": ["vm_admin"],
+			"list": ["vm_access", "vm_admin"],
+			"create": ["vm_admin"],
+			"storage_list": ["storage_access"],
+			"download": ["storage_access"],
+			"post": ["storage_admin"],
+			"upload": ["storage_admin"]
+        }
+	},
+
+    "object_assignments": {
+        "object_security_level": {
+            "servers": ["low"]
+        }
+    }
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metadata.json
new file mode 100644
index 00000000..c419c815
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metadata.json
@@ -0,0 +1,18 @@
+{
+    "name": "MLS_Policy",
+    "model": "MLS",
+    "genre": "authz",
+    "description": "Multi Level Security Policy",
+
+    "subject_categories": [
+        "subject_security_level"
+    ],
+
+    "action_categories": [
+        "resource_action"
+    ],
+
+    "object_categories": [
+        "object_security_level"
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metarule.json
new file mode 100644
index 00000000..e068927c
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metarule.json
@@ -0,0 +1,12 @@
+{
+    "sub_meta_rules": {
+		"mls_rule": {
+			"subject_categories": ["subject_security_level"],
+			"action_categories": ["resource_action"],
+			"object_categories": ["object_security_level"],
+			"algorithm": "inclusion"
+		}
+	},
+	"aggregation": "all_true"
+}
+
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/perimeter.json
new file mode 100644
index 00000000..47a8ee45
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/perimeter.json
@@ -0,0 +1,21 @@
+{
+    "subjects": [
+        "admin",
+        "demo"
+    ],
+    "actions": [
+        "pause",
+        "unpause",
+        "start",
+        "stop",
+        "create",
+        "list",
+        "upload",
+        "download",
+        "post",
+        "storage_list"
+    ],
+    "objects": [
+        "servers"
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/rule.json
new file mode 100644
index 00000000..b17dc822
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/rule.json
@@ -0,0 +1,16 @@
+{
+	"mls_rule":[
+		["high", "vm_admin", "medium"],
+		["high", "vm_admin", "low"],
+		["medium", "vm_admin", "low"],
+		["high", "vm_access", "medium"],
+		["high", "vm_access", "low"],
+		["medium", "vm_access", "low"],
+	  	["high", "storage_admin", "medium"],
+		["high", "storage_admin", "low"],
+		["medium", "storage_admin", "low"],
+		["high", "storage_access", "medium"],
+		["high", "storage_access", "low"],
+		["medium", "storage_access", "low"]
+	]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/scope.json
new file mode 100644
index 00000000..6cc1c28e
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/scope.json
@@ -0,0 +1,26 @@
+{
+  "subject_scopes": {
+    "subject_security_level": [
+      "high",
+      "medium",
+      "low"
+    ]
+  },
+
+  "action_scopes": {
+    "resource_action": [
+      "vm_admin",
+      "vm_access",
+      "storage_admin",
+      "storage_access"
+    ]
+  },
+
+  "object_scopes": {
+    "object_security_level": [
+      "high",
+      "medium",
+      "low"
+      ]
+  }
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/assignment.json
new file mode 100644
index 00000000..f2378333
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/assignment.json
@@ -0,0 +1,48 @@
+{
+    "subject_assignments": {
+        "role": {
+			"admin": ["root_role"],
+            "demo": ["dev_role"]
+		}
+    },
+    "action_assignments": {
+        "action_id": {
+			"read": ["read"],
+			"write": ["write"]
+		}
+    },
+    "object_assignments": {
+        "object_id": {	
+		  	"authz.subjects": ["authz.subjects"],
+            "authz.objects": ["authz.objects"],
+            "authz.actions": ["authz.actions"],
+            "authz.subject_categories": ["authz.subject_categories"],
+            "authz.object_categories": ["authz.object_categories"],
+            "authz.action_categories": ["authz.action_categories"],
+            "authz.subject_scopes": ["authz.subject_scopes"],
+            "authz.object_scopes": ["authz.object_scopes"],
+            "authz.action_scopes": ["authz.action_scopes"],
+            "authz.subject_assignments": ["authz.subject_assignments"],
+            "authz.object_assignments": ["authz.object_assignments"],
+            "authz.action_assignments": ["authz.action_assignments"],
+            "authz.aggregation_algorithm": ["authz.aggregation_algorithm"],
+            "authz.sub_meta_rules": ["authz.sub_meta_rules"],
+            "authz.rules": ["authz.rules"],
+		  	"admin.subjects": ["admin.subjects"],
+            "admin.objects": ["admin.objects"],
+            "admin.actions": ["admin.actions"],
+            "admin.subject_categories": ["admin.subject_categories"],
+            "admin.object_categories": ["admin.object_categories"],
+            "admin.action_categories": ["admin.action_categories"],
+            "admin.subject_scopes": ["admin.subject_scopes"],
+            "admin.object_scopes": ["admin.object_scopes"],
+            "admin.action_scopes": ["admin.action_scopes"],
+            "admin.subject_assignments": ["admin.subject_assignments"],
+            "admin.object_assignments": ["admin.object_assignments"],
+            "admin.action_assignments": ["admin.action_assignments"],
+            "admin.aggregation_algorithm": ["admin.aggregation_algorithm"],
+            "admin.sub_meta_rules": ["admin.sub_meta_rules"],
+            "admin.rules": ["admin.rules"]
+		}
+    }
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metadata.json
new file mode 100644
index 00000000..9ee8a11d
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metadata.json
@@ -0,0 +1,18 @@
+{
+    "name": "RBAC Admin Policy",
+    "model": "RBAC",
+    "genre": "admin",
+    "description": "",
+
+    "subject_categories": [
+        "role"
+    ],
+
+    "action_categories": [
+        "action_id"
+    ],
+
+    "object_categories": [
+        "object_id"
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metarule.json
new file mode 100644
index 00000000..86dbfad2
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metarule.json
@@ -0,0 +1,12 @@
+{
+    "sub_meta_rules": {
+		"rbac_rule": {
+			"subject_categories": ["role"],
+			"action_categories": ["action_id"],
+			"object_categories": ["object_id"],
+			"algorithm": "inclusion"
+		}
+	},
+	"aggregation": "all_true"
+}
+
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/perimeter.json
new file mode 100644
index 00000000..1155533e
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/perimeter.json
@@ -0,0 +1,42 @@
+{
+    "subjects": [
+        "admin",
+        "demo"
+    ],
+    "actions": [
+        "read",
+        "write"
+    ],
+    "objects": [
+        "authz.subjects",
+        "authz.objects",
+        "authz.actions",
+        "authz.subject_categories",
+        "authz.object_categories",
+        "authz.action_categories",
+        "authz.subject_scopes",
+        "authz.object_scopes",
+        "authz.action_scopes",
+        "authz.subject_assignments",
+        "authz.object_assignments",
+        "authz.action_assignments",
+        "authz.aggregation_algorithm",
+        "authz.sub_meta_rules",
+        "authz.rules",
+        "admin.subjects",
+        "admin.objects",
+        "admin.actions",
+        "admin.subject_categories",
+        "admin.object_categories",
+        "admin.action_categories",
+        "admin.subject_scopes",
+        "admin.object_scopes",
+        "admin.action_scopes",
+        "admin.subject_assignments",
+        "admin.object_assignments",
+        "admin.action_assignments",
+        "admin.aggregation_algorithm",
+        "admin.sub_meta_rules",
+        "admin.rules"
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/rule.json
new file mode 100644
index 00000000..c89ceff3
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/rule.json
@@ -0,0 +1,94 @@
+{
+  "rbac_rule":[
+    ["root_role" , "read", "authz.subjects"],
+    ["root_role" , "read", "authz.objects"],
+    ["root_role" , "read", "authz.actions"],
+    ["root_role" , "read", "authz.subject_categories"],
+    ["root_role" , "read", "authz.object_categories"],
+    ["root_role" , "read", "authz.action_categories"],
+    ["root_role" , "read", "authz.subject_scopes"],
+    ["root_role" , "read", "authz.object_scopes"],
+    ["root_role" , "read", "authz.action_scopes"],
+    ["root_role" , "read", "authz.subject_assignments"],
+    ["root_role" , "read", "authz.object_assignments"],
+    ["root_role" , "read", "authz.action_assignments"],
+    ["root_role" , "read", "authz.aggregation_algorithm"],
+    ["root_role" , "read", "authz.sub_meta_rules"],    
+    ["root_role" , "read", "authz.rules"],
+    ["root_role" , "write", "authz.subjects"],
+    ["root_role" , "write", "authz.objects"],
+    ["root_role" , "write", "authz.actions"],
+    ["root_role" , "write", "authz.subject_categories"],
+    ["root_role" , "write", "authz.object_categories"],
+    ["root_role" , "write", "authz.action_categories"],
+    ["root_role" , "write", "authz.subject_scopes"],
+    ["root_role" , "write", "authz.object_scopes"],
+    ["root_role" , "write", "authz.action_scopes"],
+    ["root_role" , "write", "authz.subject_assignments"],
+    ["root_role" , "write", "authz.object_assignments"],
+    ["root_role" , "write", "authz.action_assignments"],
+    ["root_role" , "write", "authz.aggregation_algorithm"],
+    ["root_role" , "write", "authz.sub_meta_rules"],    
+    ["root_role" , "write", "authz.rules"], 
+    ["root_role" , "read", "admin.subjects"],
+    ["root_role" , "read", "admin.objects"],
+    ["root_role" , "read", "admin.actions"],
+    ["root_role" , "read", "admin.subject_categories"],
+    ["root_role" , "read", "admin.object_categories"],
+    ["root_role" , "read", "admin.action_categories"],
+    ["root_role" , "read", "admin.subject_scopes"],
+    ["root_role" , "read", "admin.object_scopes"],
+    ["root_role" , "read", "admin.action_scopes"],
+    ["root_role" , "read", "admin.subject_assignments"],
+    ["root_role" , "read", "admin.object_assignments"],
+    ["root_role" , "read", "admin.action_assignments"],
+    ["root_role" , "read", "admin.aggregation_algorithm"],
+    ["root_role" , "read", "admin.sub_meta_rules"],    
+    ["root_role" , "read", "admin.rules"],
+    ["root_role" , "write", "admin.subjects"],
+    ["root_role" , "write", "admin.objects"],
+    ["root_role" , "write", "admin.actions"],
+    ["root_role" , "write", "admin.subject_categories"],
+    ["root_role" , "write", "admin.object_categories"],
+    ["root_role" , "write", "admin.action_categories"],
+    ["root_role" , "write", "admin.subject_scopes"],
+    ["root_role" , "write", "admin.object_scopes"],
+    ["root_role" , "write", "admin.action_scopes"],
+    ["root_role" , "write", "admin.subject_assignments"],
+    ["root_role" , "write", "admin.object_assignments"],
+    ["root_role" , "write", "admin.action_assignments"],
+    ["root_role" , "write", "admin.aggregation_algorithm"],
+    ["root_role" , "write", "admin.sub_meta_rules"],    
+    ["root_role" , "write", "admin.rules"],
+    ["dev_role" , "read", "authz.subjects"],
+    ["dev_role" , "read", "authz.objects"],
+    ["dev_role" , "read", "authz.actions"],
+    ["dev_role" , "read", "authz.subject_categories"],
+    ["dev_role" , "read", "authz.object_categories"],
+    ["dev_role" , "read", "authz.action_categories"],
+    ["dev_role" , "read", "authz.subject_scopes"],
+    ["dev_role" , "read", "authz.object_scopes"],
+    ["dev_role" , "read", "authz.action_scopes"],
+    ["dev_role" , "read", "authz.subject_assignments"],
+    ["dev_role" , "read", "authz.object_assignments"],
+    ["dev_role" , "read", "authz.action_assignments"],
+    ["dev_role" , "read", "authz.aggregation_algorithm"],
+    ["dev_role" , "read", "authz.sub_meta_rules"],
+    ["dev_role" , "read", "authz.rules"],
+    ["dev_role" , "read", "admin.subjects"],
+    ["dev_role" , "read", "admin.objects"],
+    ["dev_role" , "read", "admin.actions"],
+    ["dev_role" , "read", "admin.subject_categories"],
+    ["dev_role" , "read", "admin.object_categories"],
+    ["dev_role" , "read", "admin.action_categories"],
+    ["dev_role" , "read", "admin.subject_scopes"],
+    ["dev_role" , "read", "admin.object_scopes"],
+    ["dev_role" , "read", "admin.action_scopes"],
+    ["dev_role" , "read", "admin.subject_assignments"],
+    ["dev_role" , "read", "admin.object_assignments"],
+    ["dev_role" , "read", "admin.action_assignments"],
+    ["dev_role" , "read", "admin.aggregation_algorithm"],
+    ["dev_role" , "read", "admin.sub_meta_rules"],
+    ["dev_role" , "read", "admin.rules"]
+  ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/scope.json
new file mode 100644
index 00000000..149056a6
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/scope.json
@@ -0,0 +1,48 @@
+{
+    "subject_scopes": {
+        "role": [
+            "root_role",
+            "dev_role"
+        ]
+    },
+    "action_scopes": {
+        "action_id": [
+            "read",
+            "write"
+        ]
+    },
+    "object_scopes": {
+        "object_id": [
+            "authz.subjects",
+            "authz.objects",
+            "authz.actions",
+            "authz.subject_categories",
+            "authz.object_categories",
+            "authz.action_categories",
+            "authz.subject_scopes",
+            "authz.object_scopes",
+            "authz.action_scopes",
+            "authz.subject_assignments",
+            "authz.object_assignments",
+            "authz.action_assignments",
+            "authz.aggregation_algorithm",
+            "authz.sub_meta_rules",
+            "authz.rules",
+            "admin.subjects",
+            "admin.objects",
+            "admin.actions",
+            "admin.subject_categories",
+            "admin.object_categories",
+            "admin.action_categories",
+            "admin.subject_scopes",
+            "admin.object_scopes",
+            "admin.action_scopes",
+            "admin.subject_assignments",
+            "admin.object_assignments",
+            "admin.action_assignments",
+            "admin.aggregation_algorithm",
+            "admin.sub_meta_rules",
+            "admin.rules"
+        ]
+    }
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_root/assignment.json
new file mode 100644
index 00000000..e849ae13
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_root/assignment.json
@@ -0,0 +1,39 @@
+{
+    "subject_assignments": {
+        "role": {
+			"admin": ["root_role"]
+		}
+    },
+
+    "action_assignments": {
+        "action_id": {
+			"read": ["read"],
+			"write": ["write"]
+		}
+    },
+
+    "object_assignments": {
+        "object_id": {
+            "templates": ["templates"],
+		    "sub_meta_rule_algorithms": ["sub_meta_rule_algorithms"],
+		    "aggregation_algorithms": ["aggregation_algorithms"],
+            "tenants": ["tenants"],
+            "intra_extensions": ["intra_extensions"],
+            "admin.subjects": ["admin.subjects"],
+            "admin.objects": ["admin.objects"],
+            "admin.actions": ["admin.actions"],
+            "admin.subject_categories": ["admin.subject_categories"],
+            "admin.object_categories": ["admin.object_categories"],
+            "admin.action_categories": ["admin.action_categories"],
+            "admin.subject_category_scopes": ["admin.subject_category_scopes"],
+            "admin.object_category_scopes": ["admin.object_category_scopes"],
+            "admin.action_category_scopes": ["admin.action_category_scopes"],
+            "admin.subject_assignments": ["admin.subject_assignments"],
+            "admin.object_assignments": ["admin.object_assignments"],
+            "admin.action_assignments": ["admin.action_assignments"],
+            "admin.aggregation_algorithm": ["admin.aggregation_algorithm"],
+            "admin.sub_meta_rules": ["admin.sub_meta_rules"],
+            "admin.rules": ["admin.rules"]
+		}
+    }
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_root/metadata.json
new file mode 100644
index 00000000..9dd7a928
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_root/metadata.json
@@ -0,0 +1,19 @@
+{
+    "name": "Root Policy",
+    "model": "RBAC",
+    "genre": "admin",
+    "description": "root extension",
+    "pdp_pipeline": ["authz:rbac_rule"],
+
+    "subject_categories": [
+        "role"
+    ],
+
+    "action_categories": [
+        "action_id"
+    ],
+
+    "object_categories": [
+        "object_id"
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_root/metarule.json
new file mode 100644
index 00000000..86dbfad2
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_root/metarule.json
@@ -0,0 +1,12 @@
+{
+    "sub_meta_rules": {
+		"rbac_rule": {
+			"subject_categories": ["role"],
+			"action_categories": ["action_id"],
+			"object_categories": ["object_id"],
+			"algorithm": "inclusion"
+		}
+	},
+	"aggregation": "all_true"
+}
+
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_root/perimeter.json
new file mode 100644
index 00000000..788a27f2
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_root/perimeter.json
@@ -0,0 +1,31 @@
+{
+    "subjects": [
+        "admin"
+    ],
+    "actions": [
+        "read",
+        "write"
+    ],
+    "objects": [
+        "templates",
+        "aggregation_algorithms",
+        "sub_meta_rule_algorithms",
+        "tenants",
+        "intra_extensions",
+        "admin.subjects",
+        "admin.objects",
+        "admin.actions",
+        "admin.subject_categories",
+        "admin.object_categories",
+        "admin.action_categories",
+        "admin.subject_category_scopes",
+        "admin.object_category_scopes",
+        "admin.action_category_scopes",
+        "admin.subject_assignments",
+        "admin.object_assignments",
+        "admin.action_assignments",
+        "admin.aggregation_algorithm",
+        "admin.sub_meta_rules",
+        "admin.rules"
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_root/rule.json
new file mode 100644
index 00000000..9bbd5e4c
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_root/rule.json
@@ -0,0 +1,44 @@
+{
+    "rbac_rule":[
+        ["root_role" , "read", "templates"],
+        ["root_role" , "read", "aggregation_algorithms"],
+        ["root_role" , "read", "sub_meta_rule_algorithms"],
+        ["root_role" , "read", "tenants"],
+        ["root_role" , "read", "intra_extensions"],
+        ["root_role" , "write", "templates"],
+        ["root_role" , "write", "aggregation_algorithms"],
+        ["root_role" , "write", "sub_meta_rule_algorithms"],
+        ["root_role" , "write", "tenants"],
+        ["root_role" , "write", "intra_extensions"],
+        ["root_role" , "read", "admin.subjects"],
+        ["root_role" , "read", "admin.objects"],
+        ["root_role" , "read", "admin.actions"],
+        ["root_role" , "read", "admin.subject_categories"],
+        ["root_role" , "read", "admin.object_categories"],
+        ["root_role" , "read", "admin.action_categories"],
+        ["root_role" , "read", "admin.subject_category_scopes"],
+        ["root_role" , "read", "admin.object_category_scopes"],
+        ["root_role" , "read", "admin.action_category_scopes"],
+        ["root_role" , "read", "admin.subject_assignments"],
+        ["root_role" , "read", "admin.object_assignments"],
+        ["root_role" , "read", "admin.action_assignments"],
+        ["root_role" , "read", "admin.aggregation_algorithm"],
+        ["root_role" , "read", "admin.sub_meta_rules"],
+        ["root_role" , "read", "admin.rules"],
+        ["root_role" , "write", "admin.subjects"],
+        ["root_role" , "write", "admin.objects"],
+        ["root_role" , "write", "admin.actions"],
+        ["root_role" , "write", "admin.subject_categories"],
+        ["root_role" , "write", "admin.object_categories"],
+        ["root_role" , "write", "admin.action_categories"],
+        ["root_role" , "write", "admin.subject_category_scopes"],
+        ["root_role" , "write", "admin.object_category_scopes"],
+        ["root_role" , "write", "admin.action_category_scopes"],
+        ["root_role" , "write", "admin.subject_assignments"],
+        ["root_role" , "write", "admin.object_assignments"],
+        ["root_role" , "write", "admin.action_assignments"],
+        ["root_role" , "write", "admin.aggregation_algorithm"],
+        ["root_role" , "write", "admin.sub_meta_rules"],
+        ["root_role" , "write", "admin.rules"]
+    ]
+}
diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_root/scope.json
new file mode 100644
index 00000000..43f9ced8
--- /dev/null
+++ b/moonv4/moon_orchestrator/conf/policies/policy_root/scope.json
@@ -0,0 +1,39 @@
+{
+  "subject_scopes": {
+    "role": [
+      "root_role"
+    ]
+  },
+
+  "action_scopes": {
+    "action_id": [
+      "read",
+      "write"
+    ]
+  },
+
+  "object_scopes": {
+    "object_id": [
+        "templates",
+        "aggregation_algorithms",
+        "sub_meta_rule_algorithms",
+        "tenants",
+        "intra_extensions",
+        "admin.subjects",
+        "admin.objects",
+        "admin.actions",
+        "admin.subject_categories",
+        "admin.object_categories",
+        "admin.action_categories",
+        "admin.subject_category_scopes",
+        "admin.object_category_scopes",
+        "admin.action_category_scopes",
+        "admin.subject_assignments",
+        "admin.object_assignments",
+        "admin.action_assignments",
+        "admin.aggregation_algorithm",
+        "admin.sub_meta_rules",
+        "admin.rules"
+      ]
+    }
+}