Merge "Add test to create policy with multiple rules"
diff --git a/.zuul.yaml b/.zuul.yaml
index e9d28c9..0d22083 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -238,6 +238,79 @@
         TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
 
 - job:
+    name: neutron-tempest-plugin-api-rocky
+    nodeset: openstack-single-node-xenial
+    parent: neutron-tempest-plugin-api
+    override-checkout: stable/rocky
+    vars:
+      branch_override: stable/rocky
+      # TODO(slaweq): find a way to put this list of extensions in
+      # neutron repository and keep it different per branch,
+      # then it could be removed from here
+      network_api_extensions_common: &api_extensions_rocky
+        - address-scope
+        - agent
+        - allowed-address-pairs
+        - auto-allocated-topology
+        - availability_zone
+        - binding
+        - default-subnetpools
+        - dhcp_agent_scheduler
+        - dns-domain-ports
+        - dns-integration
+        - empty-string-filtering
+        - expose-port-forwarding-in-fip
+        - ext-gw-mode
+        - external-net
+        - extra_dhcp_opt
+        - extraroute
+        - fip-port-details
+        - flavors
+        - floating-ip-port-forwarding
+        - ip-substring-filtering
+        - l3-flavors
+        - l3-ha
+        - l3_agent_scheduler
+        - logging
+        - metering
+        - multi-provider
+        - net-mtu
+        - net-mtu-writable
+        - network-ip-availability
+        - network_availability_zone
+        - pagination
+        - port-mac-address-regenerate
+        - port-security
+        - port-security-groups-filtering
+        - project-id
+        - provider
+        - qos
+        - qos-fip
+        - quotas
+        - quota_details
+        - rbac-policies
+        - router
+        - router_availability_zone
+        - security-group
+        - segment
+        - service-type
+        - sorting
+        - standard-attr-description
+        - standard-attr-revisions
+        - standard-attr-segment
+        - standard-attr-timestamp
+        - standard-attr-tag
+        - subnet_allocation
+        - trunk
+        - trunk-details
+      network_api_extensions_tempest:
+        - dvr
+      devstack_localrc:
+        USE_PYTHON3: false
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+
+- job:
     name: neutron-tempest-plugin-api-stein
     parent: neutron-tempest-plugin-api
     override-checkout: stable/stein
@@ -315,16 +388,15 @@
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
 
 - job:
-    name: neutron-tempest-plugin-api-rocky
-    nodeset: openstack-single-node-xenial
+    name: neutron-tempest-plugin-api-train
     parent: neutron-tempest-plugin-api
-    override-checkout: stable/rocky
+    override-checkout: stable/train
     vars:
-      branch_override: stable/rocky
+      branch_override: stable/train
       # TODO(slaweq): find a way to put this list of extensions in
       # neutron repository and keep it different per branch,
       # then it could be removed from here
-      network_api_extensions_common: &api_extensions_rocky
+      network_api_extensions_common: &api_extensions_train
         - address-scope
         - agent
         - allowed-address-pairs
@@ -337,14 +409,19 @@
         - dns-integration
         - empty-string-filtering
         - expose-port-forwarding-in-fip
+        - expose-l3-conntrack-helper
         - ext-gw-mode
         - external-net
         - extra_dhcp_opt
         - extraroute
+        - extraroute-atomic
+        - filter-validation
         - fip-port-details
         - flavors
         - floating-ip-port-forwarding
+        - floatingip-pools
         - ip-substring-filtering
+        - l3-conntrack-helper
         - l3-flavors
         - l3-ha
         - l3_agent_scheduler
@@ -355,18 +432,23 @@
         - net-mtu-writable
         - network-ip-availability
         - network_availability_zone
+        - network-segment-range
         - pagination
+        - port-resource-request
         - port-mac-address-regenerate
         - port-security
         - port-security-groups-filtering
         - project-id
         - provider
         - qos
+        - qos-bw-minimum-ingress
         - qos-fip
         - quotas
         - quota_details
         - rbac-policies
+        - rbac-security-groups
         - router
+        - router-admin-state-down-before-update
         - router_availability_zone
         - security-group
         - segment
@@ -375,17 +457,17 @@
         - standard-attr-description
         - standard-attr-revisions
         - standard-attr-segment
-        - standard-attr-timestamp
         - standard-attr-tag
+        - standard-attr-timestamp
         - subnet_allocation
+        - subnetpool-prefix-ops
         - trunk
         - trunk-details
+        - uplink-status-propagation
       network_api_extensions_tempest:
         - dvr
       devstack_localrc:
-        USE_PYTHON3: false
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
 
 - job:
     name: neutron-tempest-plugin-scenario
@@ -475,6 +557,16 @@
         NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
 
 - job:
+    name: neutron-tempest-plugin-scenario-openvswitch-train
+    parent: neutron-tempest-plugin-scenario-openvswitch
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions: *api_extensions_train
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
     name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
     parent: neutron-tempest-plugin-scenario
     timeout: 10000
@@ -531,6 +623,16 @@
         NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
 
 - job:
+    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-train
+    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions: *api_extensions_train
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
     name: neutron-tempest-plugin-scenario-linuxbridge
     parent: neutron-tempest-plugin-scenario
     timeout: 10000
@@ -611,6 +713,16 @@
         NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
 
 - job:
+    name: neutron-tempest-plugin-scenario-linuxbridge-train
+    parent: neutron-tempest-plugin-scenario-linuxbridge
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions: *api_extensions_train
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
     name: neutron-tempest-plugin-dvr-multinode-scenario
     parent: tempest-multinode-full
     description: |
@@ -749,6 +861,7 @@
     override-checkout: stable/queens
     vars:
       branch_override: stable/queens
+      network_api_extensions_common: *api_extensions_queens
       # TODO(slaweq): remove trunks subport_connectivity test from blacklist
       # when bug https://bugs.launchpad.net/neutron/+bug/1838760 will be fixed
       tempest_black_regex: "(^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)"
@@ -763,6 +876,7 @@
     override-checkout: stable/rocky
     vars:
       branch_override: stable/rocky
+      network_api_extensions_common: *api_extensions_rocky
       devstack_localrc:
         USE_PYTHON3: false
         TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
@@ -772,9 +886,18 @@
     parent: neutron-tempest-plugin-dvr-multinode-scenario
     override-checkout: stable/stein
     vars:
+      network_api_extensions_common: *api_extensions_stein
       branch_override: stable/stein
 
 - job:
+    name: neutron-tempest-plugin-dvr-multinode-scenario-train
+    parent: neutron-tempest-plugin-dvr-multinode-scenario
+    override-checkout: stable/train
+    vars:
+      network_api_extensions_common: *api_extensions_train
+      branch_override: stable/train
+
+- job:
     name: neutron-tempest-plugin-designate-scenario
     parent: neutron-tempest-plugin-scenario
     description: Neutron designate integration scenario
@@ -788,9 +911,24 @@
         DESIGNATE_BACKEND_DRIVER: bind9
         DOWNLOAD_DEFAULT_IMAGES: false
         IMAGE_URLS: http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-i386-disk.img,
+        Q_AGENT: openvswitch
         # In this job advanced image is not needed, so it's name should be
         # empty
         ADVANCED_IMAGE_NAME: ""
+      devstack_local_conf:
+        post-config:
+          $NEUTRON_CONF:
+            DEFAULT:
+              enable_dvr: false
+          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
+          # devstack-tempest job will be switched to use lib/neutron instead of
+          # lib/neutron-legacy
+          /$NEUTRON_CORE_PLUGIN_CONF:
+            agent:
+              tunnel_types: vxlan,gre
+            ovs:
+              tunnel_bridge: br-tun
+              bridge_mappings: public:br-ex
       devstack_plugins:
         designate: https://opendev.org/openstack/designate.git
       devstack_services:
@@ -809,6 +947,7 @@
     override-checkout: stable/queens
     vars:
       branch_override: stable/queens
+      network_api_extensions_common: *api_extensions_queens
       devstack_localrc:
         USE_PYTHON3: false
         TEMPEST_PLUGINS: '"/opt/stack/designate-tempest-plugin /opt/stack/neutron-tempest-plugin"'
@@ -820,6 +959,7 @@
     override-checkout: stable/rocky
     vars:
       branch_override: stable/rocky
+      network_api_extensions_common: *api_extensions_rocky
       devstack_localrc:
         USE_PYTHON3: false
         TEMPEST_PLUGINS: '"/opt/stack/designate-tempest-plugin /opt/stack/neutron-tempest-plugin"'
@@ -829,9 +969,18 @@
     parent: neutron-tempest-plugin-designate-scenario
     override-checkout: stable/stein
     vars:
+      network_api_extensions_common: *api_extensions_stein
       branch_override: stable/stein
 
 - job:
+    name: neutron-tempest-plugin-designate-scenario-train
+    parent: neutron-tempest-plugin-designate-scenario
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions_common: *api_extensions_train
+
+- job:
     name: neutron-tempest-plugin-sfc
     parent: neutron-tempest-plugin
     timeout: 10800
@@ -852,6 +1001,18 @@
         - sfc
       devstack_localrc:
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_sfc) | join(',') }}"
+      # TODO(bcafarel): tests still fail from time to time in parallel
+      # https://bugs.launchpad.net/neutron/+bug/1851500
+      # https://bugs.launchpad.net/networking-sfc/+bug/1660366
+      tempest_concurrency: 1
+
+- job:
+    name: neutron-tempest-plugin-sfc-train
+    parent: neutron-tempest-plugin-sfc
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions_common: *api_extensions_train
 
 - job:
     name: neutron-tempest-plugin-bgpvpn-bagpipe
@@ -875,6 +1036,14 @@
         networking-bagpipe: https://git.openstack.org/openstack/networking-bagpipe
 
 - job:
+    name: neutron-tempest-plugin-bgpvpn-bagpipe-train
+    parent: neutron-tempest-plugin-bgpvpn-bagpipe
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions: *api_extensions_train
+
+- job:
     name: neutron-tempest-plugin-fwaas
     parent: neutron-tempest-plugin
     timeout: 10800
@@ -897,6 +1066,14 @@
         NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_fwaas) | join(',') }}"
 
 - job:
+    name: neutron-tempest-plugin-fwaas-train
+    parent: neutron-tempest-plugin-fwaas
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions_common: *api_extensions_train
+
+- job:
     name: neutron-tempest-plugin-dynamic-routing
     parent: neutron-tempest-plugin
     description: |
@@ -983,6 +1160,20 @@
       jobs:
         - neutron-tempest-plugin-api-stein
 
+- project-template:
+    name: neutron-tempest-plugin-jobs-train
+    check:
+      jobs:
+        - neutron-tempest-plugin-api-train
+        - neutron-tempest-plugin-designate-scenario-train
+        - neutron-tempest-plugin-dvr-multinode-scenario-train
+        - neutron-tempest-plugin-scenario-linuxbridge-train
+        - neutron-tempest-plugin-scenario-openvswitch-train
+        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-train
+    gate:
+      jobs:
+        - neutron-tempest-plugin-api-train
+
 - project:
     templates:
       - build-openstack-docs-pti
@@ -990,18 +1181,28 @@
       - neutron-tempest-plugin-jobs-queens
       - neutron-tempest-plugin-jobs-rocky
       - neutron-tempest-plugin-jobs-stein
+      - neutron-tempest-plugin-jobs-train
       - check-requirements
       - tempest-plugin-jobs
       - release-notes-jobs-python3
     check:
       jobs:
         - neutron-tempest-plugin-sfc
+        - neutron-tempest-plugin-sfc-train
         - neutron-tempest-plugin-bgpvpn-bagpipe
+        - neutron-tempest-plugin-bgpvpn-bagpipe-train
         - neutron-tempest-plugin-fwaas
-        - neutron-tempest-plugin-dynamic-routing
+        - neutron-tempest-plugin-fwaas-train
+        - neutron-tempest-plugin-dynamic-routing:
+            # TODO(slaweq): switch it to be voting when bug
+            # https://bugs.launchpad.net/neutron/+bug/1850626 will be fixed
+            voting: false
+
     gate:
       jobs:
         - neutron-tempest-plugin-sfc
         - neutron-tempest-plugin-bgpvpn-bagpipe
         - neutron-tempest-plugin-fwaas
-        - neutron-tempest-plugin-dynamic-routing
+        # TODO(slaweq): bring it back to gate queue
+        # https://bugs.launchpad.net/neutron/+bug/1850626 will be fixed
+        # - neutron-tempest-plugin-dynamic-routing
diff --git a/neutron_tempest_plugin/neutron_dynamic_routing/api/test_bgp_speaker_extensions_negative.py b/neutron_tempest_plugin/neutron_dynamic_routing/api/test_bgp_speaker_extensions_negative.py
index 9d14536..78569ea 100644
--- a/neutron_tempest_plugin/neutron_dynamic_routing/api/test_bgp_speaker_extensions_negative.py
+++ b/neutron_tempest_plugin/neutron_dynamic_routing/api/test_bgp_speaker_extensions_negative.py
@@ -26,7 +26,7 @@
 
     """Negative test cases asserting proper behavior of BGP API extension"""
 
-    @decorators.attr(type=['negative', 'smoke'])
+    @decorators.attr(type=['negative'])
     @decorators.idempotent_id('75e9ee2f-6efd-4320-bff7-ae24741c8b06')
     def test_create_bgp_speaker_illegal_local_asn(self):
         wrong_asn = 65537
@@ -36,21 +36,21 @@
                           self.create_bgp_speaker,
                           local_as=wrong_asn)
 
-    @decorators.attr(type=['negative', 'smoke'])
+    @decorators.attr(type=['negative'])
     @decorators.idempotent_id('6742ec2e-382a-4453-8791-13a19b47cd13')
     def test_create_bgp_speaker_non_admin(self):
         self.assertRaises(lib_exc.Forbidden,
                           self.bgp_client.create_bgp_speaker,
                           {'bgp_speaker': self.default_bgp_speaker_args})
 
-    @decorators.attr(type=['negative', 'smoke'])
+    @decorators.attr(type=['negative'])
     @decorators.idempotent_id('33f7aaf0-9786-478b-b2d1-a51086a50eb4')
     def test_create_bgp_peer_non_admin(self):
         self.assertRaises(lib_exc.Forbidden,
                           self.bgp_client.create_bgp_peer,
                           {'bgp_peer': self.default_bgp_peer_args})
 
-    @decorators.attr(type=['negative', 'smoke'])
+    @decorators.attr(type=['negative'])
     @decorators.idempotent_id('39435932-0266-4358-899b-0e9b1e53c3e9')
     def test_update_bgp_speaker_local_asn(self):
         bgp_speaker = self.create_bgp_speaker(**self.default_bgp_speaker_args)
diff --git a/neutron_tempest_plugin/scenario/test_multicast.py b/neutron_tempest_plugin/scenario/test_multicast.py
index 9b79582..d511b3b 100644
--- a/neutron_tempest_plugin/scenario/test_multicast.py
+++ b/neutron_tempest_plugin/scenario/test_multicast.py
@@ -229,6 +229,7 @@
         server['ssh_client'].execute_script(
             'echo "%s" > ~/multicast_traffic_receiver.py' % check_script)
 
+    @utils.unstable_test("bug 1850288")
     @decorators.idempotent_id('113486fc-24c9-4be4-8361-03b1c9892867')
     def test_multicast_between_vms_on_same_network(self):
         """Test multicast messaging between two servers on the same network
diff --git a/neutron_tempest_plugin/scenario/test_port_forwardings.py b/neutron_tempest_plugin/scenario/test_port_forwardings.py
index 6d2239d..06f175b 100644
--- a/neutron_tempest_plugin/scenario/test_port_forwardings.py
+++ b/neutron_tempest_plugin/scenario/test_port_forwardings.py
@@ -19,6 +19,7 @@
 from tempest.lib import decorators
 
 from neutron_tempest_plugin.common import ssh
+from neutron_tempest_plugin.common import utils
 from neutron_tempest_plugin import config
 from neutron_tempest_plugin.scenario import base
 
@@ -100,6 +101,7 @@
                     server['port_forwarding_udp']['external_port'],
                     constants.PROTO_NAME_UDP))
 
+    @utils.unstable_test("bug 1850800")
     @decorators.idempotent_id('ab40fc48-ca8d-41a0-b2a3-f6679c847bfe')
     def test_port_forwarding_to_2_servers(self):
         udp_sg_rule = {'protocol': constants.PROTO_NAME_UDP,