- job:
    name: patrole-base
    parent: devstack-tempest
    description: |
      Patrole base job for admin and member roles. This job executes RBAC tests
      for all the "core" services that Tempest covers, excluding Swift.
    required-projects:
      - name: openstack/tempest
      - name: openstack/patrole
    timeout: 7800
    roles:
      - zuul: openstack/devstack
    # Define common irrelevant files to use everywhere else
    irrelevant-files: &patrole-irrelevant-files
      - ^(test-|)requirements.txt$
      - ^.*\.rst$
      - ^doc/.*
      - ^etc/.*$
      - ^patrole_tempest_plugin/tests/unit/.*$
      - ^patrole_tempest_plugin/hacking/.*$
      - ^releasenotes/.*
      - ^setup.cfg$
    vars:
      tempest_plugins:
        - patrole
      devstack_plugins:
        patrole: https://opendev.org/openstack/patrole.git
      devstack_services:
        tempest: true
        neutron: true
        neutron-trunk: true
      tempest_concurrency: 2
      tempest_test_regex: (?!.*\[.*\bslow\b.*\])(^patrole_tempest_plugin\.tests\.api)
      tox_envlist: all
      tox_extra_args: --sitepackages

- job:
    name: patrole-base-multinode
    parent: tempest-multinode-full-py3
    description: |-
      Patrole base job for multinode and "slow" tests where "slow" tests include:

      * Tests that take more than ~30 seconds to run.
      * Tests that experience spurious failures related to servers, volumes,
        backups and similar resources failing to build.
    timeout: 7800
    branches:
      - master
    required-projects:
      - openstack/devstack-gate
      - openstack/tempest
      - openstack/patrole
    irrelevant-files: *patrole-irrelevant-files
    vars:
      tempest_plugins:
        - patrole
      devstack_plugins:
        patrole: https://opendev.org/openstack/patrole.git
      devstack_services:
        tempest: true
        neutron: true
      tempest_concurrency: 1
      tempest_test_regex: (?=.*\[.*\bslow\b.*\])(^patrole_tempest_plugin\.tests\.api)
      tox_envlist: all
      tox_extra_args: --sitepackages

- job:
    name: patrole-admin
    parent: patrole-base
    description: Patrole job for admin role.
    vars:
      devstack_localrc:
        RBAC_TEST_ROLES: admin

- job:
    name: patrole-member
    parent: patrole-base
    description: Patrole job for member role.
    # This currently works from stable/pike onward.
    branches: ^(?!stable/ocata).*$
    vars:
      devstack_localrc:
        RBAC_TEST_ROLES: member

- job:
    name: patrole-reader
    parent: patrole-base
    description: Patrole job for reader role.
    # This currently works from stable/stein onward.
    branches: ^(?!stable/(ocata|pike|queens|rocky)).*$
    voting: false
    vars:
      devstack_localrc:
        RBAC_TEST_ROLES: reader

- job:
    name: patrole-member-train
    parent: patrole-member
    override-checkout: stable/train
    vars:
      devstack_localrc:
        USE_PYTHON3: True

- job:
    name: patrole-member-stein
    parent: patrole-member
    override-checkout: stable/stein
    vars:
      devstack_localrc:
        USE_PYTHON3: True

- job:
    name: patrole-multinode-admin
    parent: patrole-base-multinode
    voting: false
    vars:
      devstack_localrc:
        RBAC_TEST_ROLES: admin

- job:
    name: patrole-multinode-member
    parent: patrole-base-multinode
    voting: false
    vars:
      devstack_localrc:
        RBAC_TEST_ROLES: member

- job:
    name: patrole-py35-member
    parent: patrole-base
    description: Patrole py35 job for member role.
    vars:
      devstack_localrc:
        # Use member for py35 because arguably negative testing is more
        # important than admin, which is already covered by patrole-admin job.
        RBAC_TEST_ROLES: member
        USE_PYTHON3: true
      devstack_services:
        s-account: false
        s-container: false
        s-object: false
        s-proxy: false
        # Without Swift, c-bak cannot run (in the gate at least).
        c-bak: false

- job:
    name: patrole-extension-base
    parent: patrole-base
    description: |
      Patrole plugin job for admin and member roles which runs RBAC tests for
      neutron-tempest-plugin APIs (if the plugin is installed).

      Covers Neutron extension functionality only. Should not be used for
      supporting Neutron plugins like fwaas.
    required-projects:
      - name: openstack/tempest
      - name: openstack/patrole
      - name: openstack/neutron-tempest-plugin
    vars:
      tempest_plugins:
        - patrole
        - neutron-tempest-plugin
      devstack_plugins:
        neutron: https://opendev.org/openstack/neutron.git
        patrole: https://opendev.org/openstack/patrole.git
        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
      devstack_services:
        tempest: true
        neutron: true
        neutron-segments: true
        neutron-qos: true
      tempest_test_regex: (?=.*ExtRbacTest)(^patrole_tempest_plugin\.tests\.api)

- job:
    name: patrole-extension-admin
    parent: patrole-extension-base
    voting: false
    vars:
      devstack_localrc:
        RBAC_TEST_ROLES: admin

- job:
    name: patrole-extension-member
    parent: patrole-extension-base
    voting: false
    vars:
      devstack_localrc:
        RBAC_TEST_ROLES: member

- project:
    templates:
      - openstack-cover-jobs
      - openstack-lower-constraints-jobs
      - openstack-python3-victoria-jobs
      - check-requirements
      - publish-openstack-docs-pti
      - release-notes-jobs-python3
    check:
      jobs:
        - patrole-admin
        - patrole-member
        - patrole-reader
        - patrole-member-train
        - patrole-member-stein
        - patrole-multinode-admin
        - patrole-multinode-member
        - patrole-extension-admin
        - patrole-extension-member
    gate:
      jobs:
        - patrole-admin
        - patrole-member
    periodic-stable:
      jobs:
        - patrole-member-train
        - patrole-member-stein