Merge "Compute API Server Diagnostics Test."
diff --git a/doc/source/conf.py b/doc/source/conf.py
index d75a939..33c2cc3 100755
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -38,7 +38,7 @@
# General information about the project.
project = u'patrole'
-copyright = u'2016, OpenStack Foundation'
+copyright = u'2017, Patrole Developers'
# If true, '()' will be appended to :func: etc. cross-reference text.
add_function_parentheses = True
@@ -68,7 +68,7 @@
('index',
'%s.tex' % project,
u'%s Documentation' % project,
- u'OpenStack Foundation', 'manual'),
+ u'Patrole Developers', 'manual'),
]
# Example configuration for intersphinx: refer to the Python standard library.
diff --git a/patrole_tempest_plugin/tests/api/compute/rbac_base.py b/patrole_tempest_plugin/tests/api/compute/rbac_base.py
index 7e41fa9..ca24204 100644
--- a/patrole_tempest_plugin/tests/api/compute/rbac_base.py
+++ b/patrole_tempest_plugin/tests/api/compute/rbac_base.py
@@ -35,3 +35,24 @@
super(BaseV2ComputeRbacTest, cls).setup_clients()
cls.admin_client = cls.os_admin.agents_client
cls.auth_provider = cls.os.auth_provider
+
+
+class BaseV2ComputeAdminRbacTest(compute_base.BaseV2ComputeAdminTest):
+
+ credentials = ['primary', 'admin']
+
+ @classmethod
+ def skip_checks(cls):
+ super(BaseV2ComputeAdminRbacTest, cls).skip_checks()
+ if not CONF.rbac.rbac_flag:
+ raise cls.skipException(
+ '%s skipped as RBAC flag not enabled' % cls.__name__)
+ if 'admin' not in CONF.auth.tempest_roles:
+ raise cls.skipException(
+ "%s skipped because tempest roles is not admin" % cls.__name__)
+
+ @classmethod
+ def setup_clients(cls):
+ super(BaseV2ComputeAdminRbacTest, cls).setup_clients()
+ cls.admin_client = cls.os_admin.agents_client
+ cls.auth_provider = cls.os.auth_provider
diff --git a/patrole_tempest_plugin/tests/api/compute/test_server_usage_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_server_usage_rbac.py
new file mode 100644
index 0000000..486a023
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/compute/test_server_usage_rbac.py
@@ -0,0 +1,55 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest import config
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.compute import rbac_base
+
+CONF = config.CONF
+
+
+class ServerUsageRbacTest(rbac_base.BaseV2ComputeRbacTest):
+
+ @classmethod
+ def setup_clients(cls):
+ super(ServerUsageRbacTest, cls).setup_clients()
+ cls.client = cls.servers_client
+
+ @classmethod
+ def skip_checks(cls):
+ super(ServerUsageRbacTest, cls).skip_checks()
+ if not CONF.compute_feature_enabled.api_extensions:
+ raise cls.skipException(
+ '%s skipped as no compute extensions enabled' % cls.__name__)
+
+ @classmethod
+ def resource_setup(cls):
+ super(ServerUsageRbacTest, cls).resource_setup()
+ cls.server = cls.create_test_server(wait_until='ACTIVE')
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(ServerUsageRbacTest, self).tearDown()
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-server-usage")
+ @decorators.idempotent_id('f0437ead-b9fb-462a-9f3d-ce53fac9d57a')
+ def test_show_server_diagnostics(self):
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.show_server(self.server['id'])
diff --git a/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py
new file mode 100644
index 0000000..d5897d3
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py
@@ -0,0 +1,131 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest.common import waiters
+from tempest import config
+from tempest.lib.common.utils import test_utils
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.compute import rbac_base
+
+CONF = config.CONF
+
+
+class ServerVolumeAttachmentRbacTest(rbac_base.BaseV2ComputeRbacTest):
+
+ @classmethod
+ def setup_clients(cls):
+ super(ServerVolumeAttachmentRbacTest, cls).setup_clients()
+ cls.client = cls.servers_client
+ cls.volumes_client = cls.os.volumes_client
+
+ @classmethod
+ def skip_checks(cls):
+ super(ServerVolumeAttachmentRbacTest, cls).skip_checks()
+ if not CONF.compute_feature_enabled.api_extensions:
+ raise cls.skipException(
+ '%s skipped as no compute extensions enabled' % cls.__name__)
+
+ @classmethod
+ def resource_setup(cls):
+ super(ServerVolumeAttachmentRbacTest, cls).resource_setup()
+ cls.server = cls.create_test_server(wait_until='ACTIVE')
+
+ @classmethod
+ def resource_cleanup(cls):
+ test_utils.call_and_ignore_notfound_exc(cls.delete_server,
+ cls.server['id'])
+ super(ServerVolumeAttachmentRbacTest, cls).resource_cleanup()
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(ServerVolumeAttachmentRbacTest, self).tearDown()
+
+ def _create_and_attach(self):
+ self.volume = self.create_volume()
+ self.attachment = self._attach(self.server, self.volume)
+
+ def _attach(self, server, volume):
+ attachment = self.client.attach_volume(
+ server['id'],
+ volumeId=volume['id'])['volumeAttachment']
+ self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+ self._detach, server['id'], volume['id'])
+ waiters.wait_for_volume_status(self.volumes_client, volume['id'],
+ 'in-use')
+ return attachment
+
+ def _detach(self, server_id, volume_id):
+ # For test_update_volume_attachment, an addCleanup is called with
+ # a stale volume, because a new volume is attached, so only detach
+ # the new volume to avoid a bad request error.
+ if hasattr(self, 'volume') and self.volume['id'] == volume_id:
+ self.client.detach_volume(server_id, volume_id)
+ waiters.wait_for_volume_status(self.volumes_client, volume_id,
+ 'available')
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-volumes-attachments:index")
+ @decorators.idempotent_id('529b668b-6edb-41d5-8886-d7dbd0614678')
+ def test_list_volume_attachments(self):
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.list_volume_attachments(self.server['id'])
+ ['volumeAttachments']
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-volumes-attachments:create")
+ @decorators.idempotent_id('21c2c3fd-fbe8-41b1-8ef8-115ec47d54c1')
+ def test_create_volume_attachment(self):
+ self.volume = self.create_volume()
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self._attach(self.server, self.volume)
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-volumes-attachments:show")
+ @decorators.idempotent_id('997df9c2-6e54-47b6-ab74-e4fdb500f385')
+ def test_show_volume_attachment(self):
+ self._create_and_attach()
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.show_volume_attachment(
+ self.server['id'], self.attachment['id'])
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-volumes-attachments:update")
+ @decorators.idempotent_id('bd667186-eca6-4b78-ab6a-3e2fabcb971f')
+ def test_update_volume_attachment(self):
+ self._create_and_attach()
+ self.volume = self.create_volume()
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.update_attached_volume(
+ self.server['id'], self.attachment['id'],
+ volumeId=self.volume['id'])
+ self.addCleanup(self._detach, self.server['id'], self.volume['id'])
+ waiters.wait_for_volume_status(self.volumes_client, self.volume['id'],
+ 'in-use')
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-volumes-attachments:delete")
+ @decorators.idempotent_id('12b03e90-d087-46af-9c4d-507d021c4984')
+ def test_delete_volume_attachment(self):
+ self._create_and_attach()
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self._detach(self.server['id'], self.volume['id'])
diff --git a/patrole_tempest_plugin/tests/api/compute/test_services_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_services_rbac.py
new file mode 100644
index 0000000..a2f6409
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/compute/test_services_rbac.py
@@ -0,0 +1,50 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest import config
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.compute import rbac_base
+
+CONF = config.CONF
+
+
+class ServicesAdminRbacTest(rbac_base.BaseV2ComputeAdminRbacTest):
+
+ @classmethod
+ def setup_clients(cls):
+ super(ServicesAdminRbacTest, cls).setup_clients()
+ cls.client = cls.services_client
+
+ @classmethod
+ def skip_checks(cls):
+ super(ServicesAdminRbacTest, cls).skip_checks()
+ if not CONF.compute_feature_enabled.api_extensions:
+ raise cls.skipException(
+ '%s skipped as no compute extensions enabled' % cls.__name__)
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(ServicesAdminRbacTest, self).tearDown()
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-services")
+ @decorators.idempotent_id('7472261b-9c6d-453a-bcb3-aecaa29ad281')
+ def test_list_services(self):
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.list_services()['services']
diff --git a/patrole_tempest_plugin/tests/api/image/v2/test_image_namespace_property_rbac.py b/patrole_tempest_plugin/tests/api/image/v2/test_image_namespace_property_rbac.py
new file mode 100644
index 0000000..6804fa3
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/image/v2/test_image_namespace_property_rbac.py
@@ -0,0 +1,102 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest import config
+from tempest.lib.common.utils import data_utils
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.image import rbac_base
+
+CONF = config.CONF
+
+
+class NamespacesPropertyRbacTest(rbac_base.BaseV2ImageRbacTest):
+
+ @classmethod
+ def resource_setup(cls):
+ super(NamespacesPropertyRbacTest, cls).resource_setup()
+ body = cls.resource_types_client.list_resource_types()
+ cls.resource_name = body['resource_types'][0]['name']
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(NamespacesPropertyRbacTest, self).tearDown()
+
+ @rbac_rule_validation.action(service="glance",
+ rule="add_metadef_property")
+ @decorators.idempotent_id('383555ca-677b-43e9-b809-acc2b5a0176c')
+ def test_add_md_properties(self):
+ """Create Image Metadef Namespace Property Test
+
+ RBAC test for the glance add_metadef_property policy
+ """
+ namespace = self.create_namespace()
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ property_name = data_utils.rand_name('test-ns-property')
+ self.namespace_properties_client.create_namespace_property(
+ namespace=namespace['namespace'], type="string",
+ title=property_name, name=self.resource_name)
+
+ @rbac_rule_validation.action(service="glance",
+ rule="get_metadef_properties")
+ @decorators.idempotent_id('d5177611-c2b5-4000-bd9c-1987af9222ea')
+ def test_get_md_properties(self):
+ """List Image Metadef Namespace Properties Test
+
+ RBAC test for the glance get_metadef_properties policy
+ """
+ namespace = self.create_namespace()
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.namespace_properties_client.list_namespace_properties(
+ namespace=namespace['namespace'])
+
+ @rbac_rule_validation.action(service="glance",
+ rule="get_metadef_property")
+ @decorators.idempotent_id('cfeda2af-bcab-433e-80c7-4b40c774aed5')
+ def test_get_md_property(self):
+ """Get Image Metadef Namespace Property Test
+
+ RBAC test for the glance get_metadef_property policy
+ """
+ namespace = self.create_namespace()
+ property_name = data_utils.rand_name('test-ns-property')
+ self.namespace_properties_client.create_namespace_property(
+ namespace=namespace['namespace'], type="string",
+ title=property_name, name=self.resource_name)
+
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.namespace_properties_client.show_namespace_properties(
+ namespace['namespace'], self.resource_name)
+
+ @rbac_rule_validation.action(service="glance",
+ rule="modify_metadef_property")
+ @decorators.idempotent_id('fdaf9363-4010-4f2f-8192-1b28f6b22e69')
+ def test_modify_md_properties(self):
+ """Modify Image Metadef Namespace Policy Test
+
+ RBAC test for the glance modify_metadef_property policy
+ """
+ namespace = self.create_namespace()
+ property_name = data_utils.rand_name('test-ns-property')
+ self.namespace_properties_client.create_namespace_property(
+ namespace=namespace['namespace'], type="string",
+ title=property_name, name=self.resource_name)
+
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.namespace_properties_client.update_namespace_properties(
+ namespace['namespace'], self.resource_name, type="string",
+ title=property_name, name=self.resource_name)
diff --git a/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py
new file mode 100644
index 0000000..d650177
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py
@@ -0,0 +1,90 @@
+# Copyright 2016 AT&T Corp
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest import config
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.volume import rbac_base
+
+CONF = config.CONF
+
+
+class SnapshotMetadataRbacTest(rbac_base.BaseVolumeRbacTest):
+
+ @classmethod
+ def skip_checks(cls):
+ super(SnapshotMetadataRbacTest, cls).skip_checks()
+ if not CONF.volume_feature_enabled.snapshot:
+ raise cls.skipException("Cinder snapshot feature disabled")
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(SnapshotMetadataRbacTest, self).tearDown()
+
+ @classmethod
+ def resource_setup(cls):
+ super(SnapshotMetadataRbacTest, cls).resource_setup()
+ cls.volume = cls.create_volume()
+ # Create a snapshot
+ cls.snapshot = cls.create_snapshot(volume_id=cls.volume['id'])
+ cls.snapshot_id = cls.snapshot['id']
+
+ @classmethod
+ def _create_test_snapshot_metadata(self):
+ # Create test snapshot metadata
+ metadata = {"key1": "value1",
+ "key2": "value2",
+ "key3": "value3"}
+ self.snapshots_client.create_snapshot_metadata(
+ self.snapshot_id, metadata)['metadata']
+
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume_extension:extended_snapshot_attributes")
+ @decorators.idempotent_id('c9cbec1c-edfe-46b8-825b-7b6ac0a58c25')
+ def test_create_snapshot_metadata(self):
+ # Create metadata for the snapshot
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self._create_test_snapshot_metadata()
+
+ @rbac_rule_validation.action(service="cinder",
+ rule="volume:get_volume_image_metadata")
+ @decorators.idempotent_id('f6912bb1-62e6-483d-bcd0-e98c1641f4c3')
+ def test_get_snapshot_metadata(self):
+ # Create volume and snapshot metadata
+ self._create_test_snapshot_metadata()
+ # Get metadata for the snapshot
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.snapshots_client.show_snapshot_metadata(
+ self.snapshot_id)
+
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume_extension:volume_tenant_attribute")
+ @decorators.idempotent_id('e2c73b00-0c19-4bb7-8c61-d84b1a223ed1')
+ def test_get_snapshot_metadata_for_volume_tenant(self):
+ # Create volume and snapshot metadata
+ self._create_test_snapshot_metadata()
+ # Get metadata for the snapshot
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ # Get the metadata of the snapshot
+ self.snapshots_client.show_snapshot_metadata(
+ self.snapshot_id)['metadata']
+
+
+class SnapshotMetadataV3RbacTest(SnapshotMetadataRbacTest):
+ _api_version = 3
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volume_transfers_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volume_transfers_rbac.py
index aec39b4..f88d44f 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volume_transfers_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volume_transfers_rbac.py
@@ -1,4 +1,4 @@
-# Copyright 2016 AT&T Corp
+# Copyright 2017 AT&T Corporation.
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
diff --git a/releasenotes/source/conf.py b/releasenotes/source/conf.py
index 0fe31a5..d86d91c 100644
--- a/releasenotes/source/conf.py
+++ b/releasenotes/source/conf.py
@@ -12,8 +12,8 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-# Glance Release Notes documentation build configuration file, created by
-# sphinx-quickstart on Tue Nov 3 17:40:50 2015.
+# Patrole Release Notes documentation build configuration file, created by
+# sphinx-quickstart on Tue Jan 5 17:40:50 2017.
#
# This file is execfile()d with the current directory set to its
# containing dir.
@@ -56,7 +56,7 @@
# General information about the project.
project = u'patrole Release Notes'
-copyright = u'2016, OpenStack Foundation'
+copyright = u'2017, Patrole Developers'
# The version info for the project you're documenting, acts as replacement for
# |version| and |release|, also used in various other places throughout the
@@ -189,7 +189,7 @@
# html_file_suffix = None
# Output file base name for HTML help builder.
-htmlhelp_basename = 'GlanceReleaseNotesdoc'
+htmlhelp_basename = 'PatroleReleaseNotesdoc'
# -- Options for LaTeX output ---------------------------------------------
@@ -209,8 +209,9 @@
# (source start file, target name, title,
# author, documentclass [howto, manual, or own class]).
latex_documents = [
- ('index', 'GlanceReleaseNotes.tex', u'Glance Release Notes Documentation',
- u'Glance Developers', 'manual'),
+ ('index', 'PatroleReleaseNotes.tex',
+ u'Patrole Release Notes Documentation',
+ u'Patrole Developers', 'manual'),
]
# The name of an image file (relative to this directory) to place at the top of
@@ -239,8 +240,8 @@
# One entry per manual page. List of tuples
# (source start file, name, description, authors, manual section).
man_pages = [
- ('index', 'glancereleasenotes', u'Glance Release Notes Documentation',
- [u'Glance Developers'], 1)
+ ('index', 'patrolereleasenotes', u'Patrole Release Notes Documentation',
+ [u'Patrole Developers'], 1)
]
# If true, show URL addresses after external links.
@@ -253,8 +254,8 @@
# (source start file, target name, title, author,
# dir menu entry, description, category)
texinfo_documents = [
- ('index', 'GlanceReleaseNotes', u'Glance Release Notes Documentation',
- u'Glance Developers', 'GlanceReleaseNotes',
+ ('index', 'PatroleReleaseNotes', u'Patrole Release Notes Documentation',
+ u'Patrole Developers', 'PatroleReleaseNotes',
'One line description of project.',
'Miscellaneous'),
]