Merge "Remove misleading todo from config.py"
diff --git a/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py b/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py
index 5506d90..72674f6 100644
--- a/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py
@@ -110,6 +110,25 @@
@rbac_rule_validation.action(service="neutron",
rules=["create_network",
+ "create_network:is_default"],
+ expected_error_codes=[403, 403])
+ @decorators.idempotent_id('28602661-5ac7-407e-b739-e393f619f5e3')
+ def test_create_network_is_default(self):
+
+ """Create Is Default Network Test
+
+ RBAC test for the neutron create_network:is_default policy
+ """
+ try:
+ with self.rbac_utils.override_role(self):
+ self._create_network(is_default=True)
+ except lib_exc.Conflict as exc:
+ # A default network might already exist
+ self.assertIn('A default external network already exists',
+ str(exc))
+
+ @rbac_rule_validation.action(service="neutron",
+ rules=["create_network",
"create_network:shared"],
expected_error_codes=[403, 403])
@decorators.idempotent_id('ccabf2a9-28c8-44b2-80e6-ffd65d43eef2')
@@ -141,6 +160,30 @@
@rbac_rule_validation.action(
service="neutron",
rules=["create_network",
+ "create_network:provider:physical_network"],
+ expected_error_codes=[403, 403])
+ @decorators.idempotent_id('76783fed-9ff3-4499-a0d1-82d99eec364e')
+ def test_create_network_provider_physical_network(self):
+
+ """Create Network Physical Network Provider Test
+
+ RBAC test for neutron create_network:provider:physical_network policy
+ """
+ try:
+ with self.rbac_utils.override_role(self):
+ self._create_network(provider_physical_network='provider',
+ provider_network_type='flat')
+ except lib_exc.BadRequest as exc:
+ # There probably won't be a physical network called 'provider', but
+ # we aren't testing state of the network
+ self.assertIn("Invalid input for operation: physical_network " +
+ "'provider' unknown for flat provider network.",
+ str(exc))
+
+ @utils.requires_ext(extension='provider', service='network')
+ @rbac_rule_validation.action(
+ service="neutron",
+ rules=["create_network",
"create_network:provider:network_type"],
expected_error_codes=[403, 403])
@decorators.idempotent_id('3c42f7b8-b80c-44ef-8fa4-69ec4b1836bc')
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volumes_backup_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volumes_backup_rbac.py
index 5aff7a9..1e0a17d 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volumes_backup_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volumes_backup_rbac.py
@@ -176,6 +176,11 @@
class VolumesBackupsV318RbacTest(rbac_base.BaseVolumeRbacTest):
+ """Validates that the ``GET /backups/{backup_id}`` and
+ ``GET /backups/details`` APIs inject the expected attribute
+ 'os-backup-project-attr:project_id' into the response body following
+ successful authorization.
+ """
_api_version = 3
# The minimum microversion for showing 'os-backup-project-attr:project_id'
# is 3.18.
@@ -208,6 +213,17 @@
raise rbac_exceptions.RbacMalformedResponse(
attribute=self.expected_attr)
+ @decorators.idempotent_id('aa40b7c0-5974-48be-8cbc-e23cc61c4c68')
+ @rbac_rule_validation.action(service="cinder",
+ rule="backup:backup_project_attribute")
+ def test_list_backup_details_project_attribute(self):
+ with self.rbac_utils.override_role(self):
+ body = self.backups_client.list_backups(detail=True)['backups']
+
+ if self.expected_attr not in body[0]:
+ raise rbac_exceptions.RbacMalformedResponse(
+ attribute=self.expected_attr)
+
class VolumesBackupsV39RbacTest(rbac_base.BaseVolumeRbacTest):
_api_version = 3