Only attribute based policy + support for criteria in policies.

[khushboobhatia01]

Today Stackstorm provides a way to create policies on an action or combination of action and attributes. While working on a use case we discovered a need for an only attribute based policy.

Example: We have a host/server in our parameters and we want to control the concurrency of execution per host. In this case we don't have any specific action, but we have a specific hostname for which we want to achieve the concurrency.

To achieve this we implemented concurrency.attr_only policy type support along with an ability to define criteria. Similar to how we can define criteria for rule, we will be able to define criteria for policies with a difference that criteria in rule is based on trigger payload, criteria in policies will be based on action metadata. Since concurrency.attr_only policy type will be pretty generic, we wanted a way to control on which set of actions this policy should be applicable.

Below is an example for one such policy. Using this policy we can limit the action execution concurrency for mutating actions (Having role tag as RW) for a particular host to 1. This will be applicable for all actions having RW tag.

We already have POC implementation. However, we wanted some feedback if this will be helpful and useful feature. Thanks! :)

[cognifloyd]

In order to achieve the same thing today, you would need a separate policy for every action that has the target attribute, right?

With the action-based criteria, I'm not sure attr_only describes this policy type.

Should the criteria be required, so that policies are not overly broad?

Could you show an example of action metadata that matches your policy example? I'm having a hard time picturing what that criteria matches.

[khushboobhatia01]

Yes, to achieve same thing today we would need a separate policy for every action.
This is an example of action.yaml which would match the above policy.

Similar to this any other action matching the specified criteria would match the policy. This type of policy will be useful when we want to restrict the concurrency of ANY action based on parameters.

[cognifloyd]

I love the idea of policies that can affect more than one action.

I have a workflow that creates a policy for every action in a pack to prevent using it, then unloads/reinstalls the pack, and then removes the policies. If I could have just one policy that targeted all the actions in a pack, that would make things so much more simple.

With this criteria mechanism, is there a way to target all actions in a particular pack?

[khushboobhatia01]

Yes, as mentioned criteria can be defined on action metadata. So we can add a condition on pack name and the policy will be applied only the actions that matches the pack criteria.

[cognifloyd]

So maybe the name of this should be something like multi_action_policy.

With your current implementation can you make one of these policies without specifying an attribute?