Deprecate enable_rbac configuration option
The ``[patrole].enable_rbac`` option is deprecated and will be removed
during the "S" release. This is a legacy option that was meaningful
downstream when Patrole was a suite of tests inside Tempest itself. Now
that Patrole exists upstream as a Tempest plugin, it is paradoxical to
install the Patrole plugin yet have an option that allows all Patrole
tests to be skipped. This option is at odds with current Patrole
architecture.
To skip RBAC tests going forward, with Patrole Tempest plugin already
installed, use an appropriate regex.
Change-Id: I0cc39184c7891fb9133a45488a36ba220592915f
diff --git a/patrole_tempest_plugin/config.py b/patrole_tempest_plugin/config.py
index 9eed5ab..ebc8a1d 100644
--- a/patrole_tempest_plugin/config.py
+++ b/patrole_tempest_plugin/config.py
@@ -22,11 +22,18 @@
PatroleGroup = [
cfg.StrOpt('rbac_test_role',
default='admin',
- help="""The current RBAC role against which to run Patrole
-tests."""),
+ help="""The current RBAC role against which to run
+Patrole tests."""),
cfg.BoolOpt('enable_rbac',
default=True,
- help="Enables RBAC tests."),
+ deprecated_for_removal=True,
+ deprecated_reason="""This is a legacy option that was
+meaningful when Patrole existed downstream as a suite of tests inside Tempest.
+Installing the Patrole plugin necessarily means that RBAC tests should be run.
+This option is paradoxical with the Tempest plugin architecture.
+""",
+ deprecated_since='R',
+ help="Enables Patrole RBAC tests."),
cfg.ListOpt('custom_policy_files',
default=['/etc/%s/policy.json'],
help="""List of the paths to search for policy files. Each
diff --git a/patrole_tempest_plugin/rbac_utils.py b/patrole_tempest_plugin/rbac_utils.py
index 6c40aa1..02b9297 100644
--- a/patrole_tempest_plugin/rbac_utils.py
+++ b/patrole_tempest_plugin/rbac_utils.py
@@ -17,6 +17,7 @@
import time
from oslo_log import log as logging
+from oslo_log import versionutils
from oslo_utils import excutils
from tempest import clients
@@ -220,6 +221,12 @@
@classmethod
def skip_rbac_checks(cls):
if not CONF.patrole.enable_rbac:
+ deprecation_msg = ("The `[patrole].enable_rbac` option is "
+ "deprecated and will be removed in the S "
+ "release. Patrole tests will always be enabled "
+ "following installation of the Patrole Tempest "
+ "plugin. Use a regex to skip tests.")
+ versionutils.report_deprecated_feature(LOG, deprecation_msg)
raise cls.skipException(
'Patrole testing not enabled so skipping %s.' % cls.__name__)
diff --git a/releasenotes/notes/deprecate-enable-rbac-option-1e499bb0914cdee8.yaml b/releasenotes/notes/deprecate-enable-rbac-option-1e499bb0914cdee8.yaml
new file mode 100644
index 0000000..7354c4f
--- /dev/null
+++ b/releasenotes/notes/deprecate-enable-rbac-option-1e499bb0914cdee8.yaml
@@ -0,0 +1,13 @@
+---
+deprecations:
+ - |
+ The ``[patrole].enable_rbac`` option is deprecated and will be removed
+ during the "S" release. This is a legacy option that was meaningful
+ downstream when Patrole was a suite of tests inside Tempest itself. Now
+ that Patrole exists upstream as a Tempest plugin, it is paradoxical to
+ install the Patrole plugin yet have an option that allows all Patrole
+ tests to be skipped. This option is at odds with current Patrole
+ architecture.
+
+ To skip RBAC tests going forward, with Patrole Tempest plugin already
+ installed, use an appropriate regex.