Approach (brief)
Group hosts by their tags from CSV, produce JSON policy with groups as source/destination, and allow rules for predefined service ports. Ensure idempotency by using deterministic IDs (hashes) and merging existing policy file if present.
Sample Python (idempotent)
python
#!/usr/bin/env python3
import csv, json, hashlib, os
PORTS = [{"name":"ssh","port":22},{"name":"http","port":80},{"name":"https","port":443}]
POLICY_FILE = "microseg_policy.json"
def id_for(name):
return hashlib.sha1(name.encode()).hexdigest()[:8]
def load_inventory(path):
tags = {}
with open(path) as f:
reader = csv.DictReader(f)
for r in reader:
for t in r['tags'].split(';'):
tags.setdefault(t.strip(), []).append({"hostname":r['hostname'],"ip":r['ip']})
return tags
def build_policy(groups):
policy = {"groups":[], "rules":[]}
for gname, hosts in sorted(groups.items()):
policy['groups'].append({"id": id_for(gname), "name": gname, "members": [h['ip'] for h in hosts]})
for src in policy['groups']:
for dst in policy['groups']:
if src['id']==dst['id']: continue
for p in PORTS:
rid = id_for(src['id']+dst['id']+p['name'])
policy['rules'].append({"id":rid,"src":src['id'],"dst":dst['id'],"port":p['port'],"protocol":"tcp","action":"allow"})
return policy
inv = load_inventory("assets.csv")
new = build_policy(inv)
# idempotent write/merge: if file exists, only replace rules/groups when changed
if os.path.exists(POLICY_FILE):
with open(POLICY_FILE) as f: old = json.load(f)
else:
old = {}
if old != new:
with open(POLICY_FILE,'w') as f: json.dump(new,f,indent=2)
print("Policy updated")
else:
print("No changes")
Idempotency reasoning
Deterministic IDs and sorted iteration guarantee same output for same input; merge/compare avoids unnecessary writes.
Staging tests before enforcement
- Run script in staging with realistic CSV; verify JSON diff against expected (git, unit tests).
- Deploy read-only into policy engine (simulation mode) to validate no unintended denies.
- Run connectivity tests (nmap, service checks) from representative VMs to ensure allowed flows work and others remain blocked in a non-production sandbox.
- Peer review and run automated CI checks that validate ID stability and schema.
