Merge "Add encryption types test"
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_endpoint_filter_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_endpoint_filter_rbac.py
new file mode 100644
index 0000000..2892b17
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_endpoint_filter_rbac.py
@@ -0,0 +1,91 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest.lib.common.utils import test_utils
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.tests.api.identity.v3 import rbac_base
+
+
+class IdentityEndpointsFilterV3RbacTest(
+ rbac_base.BaseIdentityV3RbacTest):
+
+ @classmethod
+ def setup_clients(cls):
+ super(IdentityEndpointsFilterV3RbacTest, cls).setup_clients()
+ cls.ep_api_client = cls.os.endpoint_filter_client
+
+ @classmethod
+ def resource_setup(cls):
+ super(IdentityEndpointsFilterV3RbacTest, cls).resource_setup()
+ cls.project = cls.setup_test_project()
+ cls.service = cls.setup_test_service()
+ cls.endpoint = cls.setup_test_endpoint(service=cls.service)
+
+ def _add_endpoint_to_project(self):
+ # Adding and cleaning up endpoints to projects
+ self.ep_api_client.add_endpoint_to_project(
+ self.project['id'], self.endpoint['id'])
+ self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+ self.ep_api_client.delete_endpoint_from_project,
+ self.project['id'], self.endpoint['id'])
+
+ @rbac_rule_validation.action(
+ service="keystone",
+ rule="identity:add_endpoint_to_project")
+ @decorators.idempotent_id('9199ec13-816d-4efe-b8b1-e1cd026b9747')
+ def test_add_endpoint_to_project(self):
+ # Adding endpoints to projects
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self._add_endpoint_to_project()
+
+ @rbac_rule_validation.action(
+ service="keystone",
+ rule="identity:list_projects_for_endpoint")
+ @decorators.idempotent_id('f53dca42-ec8a-48e9-924b-0bbe6c99727f')
+ def test_list_projects_for_endpoint(self):
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self.ep_api_client.list_projects_for_endpoint(
+ self.endpoint['id'])
+
+ @rbac_rule_validation.action(
+ service="keystone",
+ rule="identity:check_endpoint_in_project")
+ @decorators.idempotent_id('0c1425eb-833c-4aa1-a21d-52ffa41fdc6a')
+ def test_check_endpoint_in_project(self):
+ self._add_endpoint_to_project()
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self.ep_api_client.check_endpoint_in_project(
+ self.project['id'], self.endpoint['id'])
+
+ @rbac_rule_validation.action(
+ service="keystone",
+ rule="identity:list_endpoints_for_project")
+ @decorators.idempotent_id('5d86c659-c6ad-41e0-854e-3823e95c7cc2')
+ def test_list_endpoints_in_project(self):
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self.ep_api_client.list_endpoints_in_project(
+ self.project['id'])
+
+ @rbac_rule_validation.action(
+ service="keystone",
+ rule="identity:remove_endpoint_from_project")
+ @decorators.idempotent_id('b4e21c10-4f47-427b-9b8a-f5b5601adfda')
+ def test_remove_endpoint_from_project(self):
+ self._add_endpoint_to_project()
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self.ep_api_client.delete_endpoint_from_project(
+ self.project['id'], self.endpoint['id'])
diff --git a/patrole_tempest_plugin/tests/api/image/v2/test_images_rbac.py b/patrole_tempest_plugin/tests/api/image/v2/test_images_rbac.py
index fa492bb..e7fe87f 100644
--- a/patrole_tempest_plugin/tests/api/image/v2/test_images_rbac.py
+++ b/patrole_tempest_plugin/tests/api/image/v2/test_images_rbac.py
@@ -29,6 +29,18 @@
super(BasicOperationsImagesRbacTest, cls).setup_clients()
cls.client = cls.os.image_client_v2
+ def _create_image(self, **kwargs):
+ image_name = data_utils.rand_name('image')
+ image = self.create_image(name=image_name,
+ container_format='bare',
+ disk_format='raw',
+ **kwargs)
+ return image
+
+ def _upload_image(self, image_id):
+ image_file = moves.cStringIO(data_utils.random_bytes())
+ return self.client.store_image_file(image_id, image_file)
+
@rbac_rule_validation.action(service="glance",
rule="add_image")
@decorators.idempotent_id('0f148510-63bf-11e6-b348-080027d0d606')
@@ -38,14 +50,8 @@
RBAC test for the glance create_image endpoint
"""
- uuid = '00000000-1111-2222-3333-444455556666'
- image_name = data_utils.rand_name('image')
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- self.create_image(name=image_name,
- container_format='bare',
- disk_format='raw',
- visibility='private',
- ramdisk_id=uuid)
+ self._create_image()
@rbac_rule_validation.action(service="glance",
rule="upload_image")
@@ -56,18 +62,25 @@
RBAC test for the glance upload_image endpoint
"""
- uuid = '00000000-1111-2222-3333-444455556666'
- image_name = data_utils.rand_name('image')
- body = self.create_image(name=image_name,
- container_format='bare',
- disk_format='raw',
- visibility='private',
- ramdisk_id=uuid)
+ image = self._create_image()
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- # Try uploading an image file
- image_file = moves.cStringIO(data_utils.random_bytes())
- self.client.store_image_file(body['id'], image_file)
+ self._upload_image(image['id'])
+
+ @decorators.idempotent_id('f0c268f3-cb51-49aa-9bd5-d30cf647322f')
+ @rbac_rule_validation.action(service="glance",
+ rule="download_image")
+ def test_download_image(self):
+
+ """Download Image Test
+
+ RBAC test for the glance download_image endpoint
+ """
+ image = self._create_image()
+ self._upload_image(image['id'])
+
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self.client.show_image_file(image['id'])
@rbac_rule_validation.action(service="glance",
rule="delete_image")
@@ -78,16 +91,11 @@
RBAC test for the glance delete_image endpoint
"""
- image_name = data_utils.rand_name('image')
- body = self.create_image(name=image_name,
- container_format='bare',
- disk_format='raw',
- visibility='public')
- image_id = body.get('id')
- # Toggle role and delete created image
+ image = self._create_image()
+
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- self.client.delete_image(image_id)
- self.client.wait_for_resource_deletion(image_id)
+ self.client.delete_image(image['id'])
+ self.client.wait_for_resource_deletion(image['id'])
@rbac_rule_validation.action(service="glance",
rule="get_image")
@@ -98,16 +106,10 @@
RBAC test for the glance create_image endpoint
"""
+ image = self._create_image()
- image_name = data_utils.rand_name('image')
- body = self.create_image(name=image_name,
- container_format='bare',
- disk_format='raw',
- visibility='private')
- image_id = body.get('id')
- # Toggle role and get created image
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- self.client.show_image(image_id)
+ self.client.show_image(image['id'])
@rbac_rule_validation.action(service="glance",
rule="get_images")
@@ -118,10 +120,8 @@
RBAC test for the glance list_images endpoint
"""
-
- # Toggle role and get created image
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- self.client.list_images()
+ self.client.list_images()['images']
@rbac_rule_validation.action(service="glance",
rule="modify_image")
@@ -132,22 +132,42 @@
RBAC test for the glance update_image endpoint
"""
- image_name = data_utils.rand_name('image')
- body = self.create_image(name=image_name,
- container_format='bare',
- disk_format='raw',
- visibility='private')
- image_id = body.get('id')
+ image = self._create_image()
- # Now try uploading an image file
- image_file = moves.cStringIO(data_utils.random_bytes())
- self.client.store_image_file(image_id, image_file)
-
- # Toggle role and update created image
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- new_image_name = data_utils.rand_name('new-image')
- body = self.client.update_image(image_id, [
- dict(replace='/name', value=new_image_name)])
+ updated_image_name = data_utils.rand_name('image')
+ self.client.update_image(image['id'], [
+ dict(replace='/name', value=updated_image_name)])
+
+ @decorators.idempotent_id('244050d9-1b9a-446a-b3c5-f26f3ba8eb75')
+ @rbac_rule_validation.action(service="glance",
+ rule="modify_image")
+ def test_create_image_tag(self):
+
+ """Create image tag
+
+ RBAC test for the glance add_image_tag endpoint
+ """
+ image = self._create_image()
+
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self.client.add_image_tag(image['id'], data_utils.rand_name('tag'))
+
+ @decorators.idempotent_id('c4a0bf9c-b78b-48c6-a31f-72c95f943c6e')
+ @rbac_rule_validation.action(service="glance",
+ rule="modify_image")
+ def test_delete_image_tag(self):
+
+ """Delete image tag
+
+ RBAC test for the glance delete_image_tag endpoint
+ """
+ image = self._create_image()
+ tag_name = data_utils.rand_name('tag')
+ self.client.add_image_tag(image['id'], tag_name)
+
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self.client.delete_image_tag(image['id'], tag_name)
@rbac_rule_validation.action(service="glance",
rule="publicize_image")
@@ -158,12 +178,8 @@
RBAC test for the glance publicize_image endpoint
"""
- image_name = data_utils.rand_name('image')
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- self.create_image(name=image_name,
- container_format='bare',
- disk_format='raw',
- visibility='public')
+ self._create_image(visibility='public')
@rbac_rule_validation.action(service="glance",
rule="deactivate")
@@ -174,20 +190,11 @@
RBAC test for the glance deactivate_image endpoint
"""
- uuid = '00000000-1111-2222-3333-444455556666'
- image_name = data_utils.rand_name('image')
- body = self.create_image(name=image_name,
- container_format='bare',
- disk_format='raw',
- visibility='private',
- ramdisk_id=uuid)
- image_id = body.get('id')
- # Now try uploading an image file
- image_file = moves.cStringIO(data_utils.random_bytes())
- self.client.store_image_file(image_id=image_id, data=image_file)
- # Toggling role and deacivate image
+ image = self._create_image()
+ self._upload_image(image['id'])
+
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- self.client.deactivate_image(image_id)
+ self.client.deactivate_image(image['id'])
@rbac_rule_validation.action(service="glance",
rule="reactivate")
@@ -198,18 +205,8 @@
RBAC test for the glance reactivate_image endpoint
"""
- uuid = '00000000-1111-2222-3333-444455556666'
- image_name = data_utils.rand_name('image')
- body = self.create_image(name=image_name,
- container_format='bare',
- disk_format='raw',
- visibility='private',
- ramdisk_id=uuid)
+ image = self._create_image()
+ self._upload_image(image['id'])
- # Now try uploading an image file
- image_id = body.get('id')
- image_file = moves.cStringIO(data_utils.random_bytes())
- self.client.store_image_file(image_id=image_id, data=image_file)
- # Toggling role and reactivate image
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- self.client.reactivate_image(image_id)
+ self.client.reactivate_image(image['id'])
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py
index 70c73fc..d6c2d13 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py
@@ -13,8 +13,6 @@
# License for the specific language governing permissions and limitations
# under the License.
-import testtools
-
from tempest.common import compute
from tempest.common import waiters
from tempest import config
@@ -31,10 +29,18 @@
class VolumesActionsRbacTest(rbac_base.BaseVolumeRbacTest):
+ # TODO(felipemonteiro): "volume_extension:volume_actions:upload_public"
+ # test can be created once volumes v3 client is created in Tempest.
+
@classmethod
def setup_clients(cls):
super(VolumesActionsRbacTest, cls).setup_clients()
- cls.client = cls.os.volumes_client
+ cls.client = cls.volumes_client
+ if CONF.image_feature_enabled.api_v1:
+ cls.image_client = cls.os.image_client
+ elif CONF.image_feature_enabled.api_v2:
+ cls.image_client = cls.os.image_client_v2
+ cls.image_id = CONF.compute.image_ref
@classmethod
def resource_setup(cls):
@@ -42,10 +48,10 @@
cls.volume = cls.create_volume()
def _create_server(self):
- body, _ = compute.create_test_server(self.os, wait_until='ACTIVE')
+ server, _ = compute.create_test_server(self.os, wait_until='ACTIVE')
self.addCleanup(test_utils.call_and_ignore_notfound_exc,
- self.servers_client.delete_server, body['id'])
- return body
+ self.servers_client.delete_server, server['id'])
+ return server
def _attach_volume(self, server):
self.servers_client.attach_volume(
@@ -60,52 +66,89 @@
waiters.wait_for_volume_resource_status(
self.client, self.volume['id'], 'available')
- @testtools.skipUnless(CONF.service_available.nova,
- "Nova is required to create a server")
+ @test.services('compute')
@rbac_rule_validation.action(service="cinder", rule="volume:attach")
@decorators.idempotent_id('f97b10e4-2eed-4f8b-8632-71c02cb9fe42')
def test_attach_volume_to_instance(self):
server = self._create_server()
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- # Attach the volume
self._attach_volume(server)
- @test.attr(type="slow")
+ @test.attr(type=["slow"])
+ @test.services('compute')
@rbac_rule_validation.action(service="cinder", rule="volume:detach")
@decorators.idempotent_id('5a042f6a-688b-42e6-a02e-fe5c47b89b07')
def test_detach_volume_from_instance(self):
- # Attach the volume
server = self._create_server()
self._attach_volume(server)
+
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- # Detach the volume
self._detach_volume()
- @testtools.skipIf(True, "Patrole bug #1672799")
- @rbac_rule_validation.action(service="cinder",
- rule="volume:copy_volume_to_image")
+ @test.services('image')
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume_extension:volume_actions:upload_image")
@decorators.idempotent_id('b0d0da46-903c-4445-893e-20e680d68b50')
def test_volume_upload(self):
- self.image_client = self.os.image_client
- image_name = data_utils.rand_name('image')
+ # TODO(felipemonteiro): The ``upload_volume`` endpoint also enforces
+ # "volume:copy_volume_to_image" but is not currently contained in
+ # Cinder's policy.json.
+ image_name = data_utils.rand_name(self.__class__.__name__ + '-Image')
+
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
body = self.client.upload_volume(
- self.volume['id'], image_name=image_name,
+ self.volume['id'], image_name=image_name, visibility="private",
disk_format=CONF.volume.disk_format)['os-volume_upload_image']
+ image_id = body["image_id"]
self.addCleanup(test_utils.call_and_ignore_notfound_exc,
self.image_client.delete_image,
- body['image_id'])
- waiters.wait_for_volume_resource_status(
- self.client, self.volume['id'], 'available')
+ image_id)
+ waiters.wait_for_image_status(self.image_client, image_id, 'active')
+ waiters.wait_for_volume_resource_status(self.os_adm.volumes_client,
+ self.volume['id'], 'available')
@rbac_rule_validation.action(service="cinder",
rule="volume:update_readonly_flag")
@decorators.idempotent_id('2750717a-f250-4e41-9e09-02624aad6ff8')
def test_volume_readonly_update(self):
- volume = self.create_volume()
self.rbac_utils.switch_role(self, toggle_rbac_role=True)
- # Update volume readonly
- self.client.update_volume_readonly(volume['id'], readonly=True)
+
+ self.client.update_volume_readonly(self.volume['id'], readonly=True)
+ self.addCleanup(self.client.update_volume_readonly,
+ self.volume['id'], readonly=False)
+
+ @decorators.idempotent_id('a9d9e825-5ea3-42e6-96f3-7ac4e97b2ed0')
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume:update_volume_metadata")
+ def test_update_volume_image_metadata(self):
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+
+ self.volumes_client.update_volume_image_metadata(
+ self.volume['id'], image_id=self.image_id)
+
+ @decorators.idempotent_id('a41c8eed-2051-4a25-b401-df036faacbdc')
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume:delete_volume_metadata")
+ def test_delete_volume_image_metadata(self):
+ self.volumes_client.update_volume_image_metadata(
+ self.volume['id'], image_id=self.image_id)
+
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self.volumes_client.delete_volume_image_metadata(
+ self.volume['id'], 'image_id')
+
+ @decorators.idempotent_id('72bab13c-dfaf-4b6d-a132-c83a85fb1776')
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume_extension:volume_unmanage")
+ def test_unmanage_volume(self):
+ volume = self.create_volume()
+
+ self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+ self.volumes_client.unmanage_volume(volume['id'])
class VolumesActionsV3RbacTest(VolumesActionsRbacTest):
diff --git a/releasenotes/notes/endpoint-filter-projects-7f64c88659ef0c30.yaml b/releasenotes/notes/endpoint-filter-projects-7f64c88659ef0c30.yaml
new file mode 100644
index 0000000..1537618
--- /dev/null
+++ b/releasenotes/notes/endpoint-filter-projects-7f64c88659ef0c30.yaml
@@ -0,0 +1,5 @@
+---
+features:
+ - |
+ Adds RBAC tests for the project-related endpoints belonging to the
+ OS-EP-FILTER Keystone v3 extension API.