tree 43340d3f87dfa58c227690451306f078f6b157c7
parent 1a0b1262460604112530dee18d133370ce4db7da
author Lance Bragstad <lbragstad@gmail.com> 1613492833 +0000
committer Luigi Toscano <ltoscano@redhat.com> 1619194314 +0200

Implement basic protection testing jobs

This commit lays down a basic structure for protection tests. These are
useful for testing various secure RBAC personas, but leveraging all the
dynamic credential work in tempest's authentication libraries to
provision clients for testing. We're also adding a non-voting protection
test job so that we can integrate protection testing into the cinder
gate as we work through policy changes.

This commit also adds some basic tests exercising the capabilities
admin-only API. These tests ensure that only operators (e.g.,
system-administrators) or formally known as project-administrators, can
access the capabilities API. Assertions and functionality in these tests
may expand in the future to accomodate system-scope when cinder can
properly consume system-scoped tokens from keystone.

For now, the tests assume project-administrators are deployment
operators, which is the legacy way of denoting "admin-ness" in OpenStack
deployments.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/778753

Change-Id: I6d4ae6d516f4c2dda4dcb6b974857b34f2ef2254