Merge "Compute API Server Volume Attachments Test."
diff --git a/doc/source/conf.py b/doc/source/conf.py
index d75a939..33c2cc3 100755
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -38,7 +38,7 @@
# General information about the project.
project = u'patrole'
-copyright = u'2016, OpenStack Foundation'
+copyright = u'2017, Patrole Developers'
# If true, '()' will be appended to :func: etc. cross-reference text.
add_function_parentheses = True
@@ -68,7 +68,7 @@
('index',
'%s.tex' % project,
u'%s Documentation' % project,
- u'OpenStack Foundation', 'manual'),
+ u'Patrole Developers', 'manual'),
]
# Example configuration for intersphinx: refer to the Python standard library.
diff --git a/patrole_tempest_plugin/tests/api/compute/rbac_base.py b/patrole_tempest_plugin/tests/api/compute/rbac_base.py
index 030ee5c..ca24204 100644
--- a/patrole_tempest_plugin/tests/api/compute/rbac_base.py
+++ b/patrole_tempest_plugin/tests/api/compute/rbac_base.py
@@ -18,7 +18,6 @@
class BaseV2ComputeRbacTest(compute_base.BaseV2ComputeTest):
-
credentials = ['primary', 'admin']
@classmethod
@@ -36,3 +35,24 @@
super(BaseV2ComputeRbacTest, cls).setup_clients()
cls.admin_client = cls.os_admin.agents_client
cls.auth_provider = cls.os.auth_provider
+
+
+class BaseV2ComputeAdminRbacTest(compute_base.BaseV2ComputeAdminTest):
+
+ credentials = ['primary', 'admin']
+
+ @classmethod
+ def skip_checks(cls):
+ super(BaseV2ComputeAdminRbacTest, cls).skip_checks()
+ if not CONF.rbac.rbac_flag:
+ raise cls.skipException(
+ '%s skipped as RBAC flag not enabled' % cls.__name__)
+ if 'admin' not in CONF.auth.tempest_roles:
+ raise cls.skipException(
+ "%s skipped because tempest roles is not admin" % cls.__name__)
+
+ @classmethod
+ def setup_clients(cls):
+ super(BaseV2ComputeAdminRbacTest, cls).setup_clients()
+ cls.admin_client = cls.os_admin.agents_client
+ cls.auth_provider = cls.os.auth_provider
diff --git a/patrole_tempest_plugin/tests/api/compute/test_absolute_limits_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_absolute_limits_rbac.py
index 3da3bd8..8e1f6ee 100644
--- a/patrole_tempest_plugin/tests/api/compute/test_absolute_limits_rbac.py
+++ b/patrole_tempest_plugin/tests/api/compute/test_absolute_limits_rbac.py
@@ -11,30 +11,31 @@
# License for the specific language governing permissions and limitations
# under the License.
+from tempest import config
+from tempest.lib import decorators
+
from patrole_tempest_plugin import rbac_rule_validation
from patrole_tempest_plugin.rbac_utils import rbac_utils
from patrole_tempest_plugin.tests.api.compute import rbac_base
-from tempest import config
-from tempest.lib import decorators
CONF = config.CONF
-class RBACAbsoluteLimitsTestJSON(rbac_base.BaseV2ComputeRbacTest):
+class AbsoluteLimitsRbacTest(rbac_base.BaseV2ComputeRbacTest):
def tearDown(self):
rbac_utils.switch_role(self, switchToRbacRole=False)
- super(RBACAbsoluteLimitsTestJSON, self).tearDown()
+ super(AbsoluteLimitsRbacTest, self).tearDown()
@classmethod
def setup_clients(cls):
- super(RBACAbsoluteLimitsTestJSON, cls).setup_clients()
+ super(AbsoluteLimitsRbacTest, cls).setup_clients()
cls.identity_client = cls.os_adm.identity_client
cls.tenants_client = cls.os_adm.tenants_client
@classmethod
def skip_checks(cls):
- super(RBACAbsoluteLimitsTestJSON, cls).skip_checks()
+ super(AbsoluteLimitsRbacTest, cls).skip_checks()
if not CONF.compute_feature_enabled.api_extensions:
raise cls.skipException(
'%s skipped as no compute extensions enabled' % cls.__name__)
diff --git a/patrole_tempest_plugin/tests/api/compute/test_access_ips_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_access_ips_rbac.py
new file mode 100644
index 0000000..ffeebc9
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/compute/test_access_ips_rbac.py
@@ -0,0 +1,45 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest import config
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.compute import rbac_base
+
+CONF = config.CONF
+
+
+class AccessIpsRbacTest(rbac_base.BaseV2ComputeRbacTest):
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ super(AccessIpsRbacTest, self).tearDown()
+
+ @classmethod
+ def skip_checks(cls):
+ super(AccessIpsRbacTest, cls).skip_checks()
+ if not CONF.compute_feature_enabled.api_extensions:
+ raise cls.skipException(
+ '%s skipped as no compute extensions enabled' % cls.__name__)
+
+ @rbac_rule_validation.action(service="nova",
+ rule="os_compute_api:os-access-ips")
+ @decorators.idempotent_id('f5811ed1-95d4-4085-a69e-87e6bd958738')
+ def test_access_ip(self):
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ ipv4 = '127.0.0.1'
+ self.create_test_server(accessIPv4=ipv4)
diff --git a/patrole_tempest_plugin/tests/api/compute/test_services_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_services_rbac.py
new file mode 100644
index 0000000..a2f6409
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/compute/test_services_rbac.py
@@ -0,0 +1,50 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest import config
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.compute import rbac_base
+
+CONF = config.CONF
+
+
+class ServicesAdminRbacTest(rbac_base.BaseV2ComputeAdminRbacTest):
+
+ @classmethod
+ def setup_clients(cls):
+ super(ServicesAdminRbacTest, cls).setup_clients()
+ cls.client = cls.services_client
+
+ @classmethod
+ def skip_checks(cls):
+ super(ServicesAdminRbacTest, cls).skip_checks()
+ if not CONF.compute_feature_enabled.api_extensions:
+ raise cls.skipException(
+ '%s skipped as no compute extensions enabled' % cls.__name__)
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(ServicesAdminRbacTest, self).tearDown()
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-services")
+ @decorators.idempotent_id('7472261b-9c6d-453a-bcb3-aecaa29ad281')
+ def test_list_services(self):
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.list_services()['services']
diff --git a/patrole_tempest_plugin/tests/api/compute/test_simple_tenant_usage_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_simple_tenant_usage_rbac.py
new file mode 100644
index 0000000..eb7a91f
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/compute/test_simple_tenant_usage_rbac.py
@@ -0,0 +1,62 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest import config
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.compute import rbac_base
+
+CONF = config.CONF
+
+
+class SimpleTenantUsageRbacTest(rbac_base.BaseV2ComputeRbacTest):
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(SimpleTenantUsageRbacTest, self).tearDown()
+
+ @classmethod
+ def setup_clients(cls):
+ super(SimpleTenantUsageRbacTest, cls).setup_clients()
+ cls.client = cls.os.tenant_usages_client
+
+ @classmethod
+ def skip_checks(cls):
+ super(SimpleTenantUsageRbacTest, cls).skip_checks()
+ if not CONF.compute_feature_enabled.api_extensions:
+ raise cls.skipException(
+ '%s skipped as no compute extensions enabled' % cls.__name__)
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-simple-tenant-usage:list")
+ @decorators.idempotent_id('2aef094f-0452-4df6-a66a-0ec22a92b16e')
+ def test_simple_tenant_usage_list(self):
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.list_tenant_usages()
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:os-simple-tenant-usage:show")
+ @decorators.idempotent_id('fe7eacda-15c4-4bf7-93ef-1091c4546a9d')
+ def test_simple_tenant_usage_show(self):
+ # A server must be created in order for usage activity to exist; else
+ # the validation method in the API call throws an error.
+ self.create_test_server(wait_until='ACTIVE')['id']
+ tenant_id = self.auth_provider.credentials.tenant_id
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.show_tenant_usage(tenant_id=tenant_id)
diff --git a/patrole_tempest_plugin/tests/api/image/v2/test_image_namespace_property_rbac.py b/patrole_tempest_plugin/tests/api/image/v2/test_image_namespace_property_rbac.py
new file mode 100644
index 0000000..6804fa3
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/image/v2/test_image_namespace_property_rbac.py
@@ -0,0 +1,102 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest import config
+from tempest.lib.common.utils import data_utils
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.image import rbac_base
+
+CONF = config.CONF
+
+
+class NamespacesPropertyRbacTest(rbac_base.BaseV2ImageRbacTest):
+
+ @classmethod
+ def resource_setup(cls):
+ super(NamespacesPropertyRbacTest, cls).resource_setup()
+ body = cls.resource_types_client.list_resource_types()
+ cls.resource_name = body['resource_types'][0]['name']
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(NamespacesPropertyRbacTest, self).tearDown()
+
+ @rbac_rule_validation.action(service="glance",
+ rule="add_metadef_property")
+ @decorators.idempotent_id('383555ca-677b-43e9-b809-acc2b5a0176c')
+ def test_add_md_properties(self):
+ """Create Image Metadef Namespace Property Test
+
+ RBAC test for the glance add_metadef_property policy
+ """
+ namespace = self.create_namespace()
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ property_name = data_utils.rand_name('test-ns-property')
+ self.namespace_properties_client.create_namespace_property(
+ namespace=namespace['namespace'], type="string",
+ title=property_name, name=self.resource_name)
+
+ @rbac_rule_validation.action(service="glance",
+ rule="get_metadef_properties")
+ @decorators.idempotent_id('d5177611-c2b5-4000-bd9c-1987af9222ea')
+ def test_get_md_properties(self):
+ """List Image Metadef Namespace Properties Test
+
+ RBAC test for the glance get_metadef_properties policy
+ """
+ namespace = self.create_namespace()
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.namespace_properties_client.list_namespace_properties(
+ namespace=namespace['namespace'])
+
+ @rbac_rule_validation.action(service="glance",
+ rule="get_metadef_property")
+ @decorators.idempotent_id('cfeda2af-bcab-433e-80c7-4b40c774aed5')
+ def test_get_md_property(self):
+ """Get Image Metadef Namespace Property Test
+
+ RBAC test for the glance get_metadef_property policy
+ """
+ namespace = self.create_namespace()
+ property_name = data_utils.rand_name('test-ns-property')
+ self.namespace_properties_client.create_namespace_property(
+ namespace=namespace['namespace'], type="string",
+ title=property_name, name=self.resource_name)
+
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.namespace_properties_client.show_namespace_properties(
+ namespace['namespace'], self.resource_name)
+
+ @rbac_rule_validation.action(service="glance",
+ rule="modify_metadef_property")
+ @decorators.idempotent_id('fdaf9363-4010-4f2f-8192-1b28f6b22e69')
+ def test_modify_md_properties(self):
+ """Modify Image Metadef Namespace Policy Test
+
+ RBAC test for the glance modify_metadef_property policy
+ """
+ namespace = self.create_namespace()
+ property_name = data_utils.rand_name('test-ns-property')
+ self.namespace_properties_client.create_namespace_property(
+ namespace=namespace['namespace'], type="string",
+ title=property_name, name=self.resource_name)
+
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.namespace_properties_client.update_namespace_properties(
+ namespace['namespace'], self.resource_name, type="string",
+ title=property_name, name=self.resource_name)
diff --git a/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py
new file mode 100644
index 0000000..d650177
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py
@@ -0,0 +1,90 @@
+# Copyright 2016 AT&T Corp
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from tempest import config
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.volume import rbac_base
+
+CONF = config.CONF
+
+
+class SnapshotMetadataRbacTest(rbac_base.BaseVolumeRbacTest):
+
+ @classmethod
+ def skip_checks(cls):
+ super(SnapshotMetadataRbacTest, cls).skip_checks()
+ if not CONF.volume_feature_enabled.snapshot:
+ raise cls.skipException("Cinder snapshot feature disabled")
+
+ def tearDown(self):
+ rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(SnapshotMetadataRbacTest, self).tearDown()
+
+ @classmethod
+ def resource_setup(cls):
+ super(SnapshotMetadataRbacTest, cls).resource_setup()
+ cls.volume = cls.create_volume()
+ # Create a snapshot
+ cls.snapshot = cls.create_snapshot(volume_id=cls.volume['id'])
+ cls.snapshot_id = cls.snapshot['id']
+
+ @classmethod
+ def _create_test_snapshot_metadata(self):
+ # Create test snapshot metadata
+ metadata = {"key1": "value1",
+ "key2": "value2",
+ "key3": "value3"}
+ self.snapshots_client.create_snapshot_metadata(
+ self.snapshot_id, metadata)['metadata']
+
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume_extension:extended_snapshot_attributes")
+ @decorators.idempotent_id('c9cbec1c-edfe-46b8-825b-7b6ac0a58c25')
+ def test_create_snapshot_metadata(self):
+ # Create metadata for the snapshot
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self._create_test_snapshot_metadata()
+
+ @rbac_rule_validation.action(service="cinder",
+ rule="volume:get_volume_image_metadata")
+ @decorators.idempotent_id('f6912bb1-62e6-483d-bcd0-e98c1641f4c3')
+ def test_get_snapshot_metadata(self):
+ # Create volume and snapshot metadata
+ self._create_test_snapshot_metadata()
+ # Get metadata for the snapshot
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.snapshots_client.show_snapshot_metadata(
+ self.snapshot_id)
+
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume_extension:volume_tenant_attribute")
+ @decorators.idempotent_id('e2c73b00-0c19-4bb7-8c61-d84b1a223ed1')
+ def test_get_snapshot_metadata_for_volume_tenant(self):
+ # Create volume and snapshot metadata
+ self._create_test_snapshot_metadata()
+ # Get metadata for the snapshot
+ rbac_utils.switch_role(self, switchToRbacRole=True)
+ # Get the metadata of the snapshot
+ self.snapshots_client.show_snapshot_metadata(
+ self.snapshot_id)['metadata']
+
+
+class SnapshotMetadataV3RbacTest(SnapshotMetadataRbacTest):
+ _api_version = 3
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volume_transfers_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volume_transfers_rbac.py
index aec39b4..f88d44f 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volume_transfers_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volume_transfers_rbac.py
@@ -1,4 +1,4 @@
-# Copyright 2016 AT&T Corp
+# Copyright 2017 AT&T Corporation.
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
diff --git a/releasenotes/source/conf.py b/releasenotes/source/conf.py
index 0fe31a5..d86d91c 100644
--- a/releasenotes/source/conf.py
+++ b/releasenotes/source/conf.py
@@ -12,8 +12,8 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-# Glance Release Notes documentation build configuration file, created by
-# sphinx-quickstart on Tue Nov 3 17:40:50 2015.
+# Patrole Release Notes documentation build configuration file, created by
+# sphinx-quickstart on Tue Jan 5 17:40:50 2017.
#
# This file is execfile()d with the current directory set to its
# containing dir.
@@ -56,7 +56,7 @@
# General information about the project.
project = u'patrole Release Notes'
-copyright = u'2016, OpenStack Foundation'
+copyright = u'2017, Patrole Developers'
# The version info for the project you're documenting, acts as replacement for
# |version| and |release|, also used in various other places throughout the
@@ -189,7 +189,7 @@
# html_file_suffix = None
# Output file base name for HTML help builder.
-htmlhelp_basename = 'GlanceReleaseNotesdoc'
+htmlhelp_basename = 'PatroleReleaseNotesdoc'
# -- Options for LaTeX output ---------------------------------------------
@@ -209,8 +209,9 @@
# (source start file, target name, title,
# author, documentclass [howto, manual, or own class]).
latex_documents = [
- ('index', 'GlanceReleaseNotes.tex', u'Glance Release Notes Documentation',
- u'Glance Developers', 'manual'),
+ ('index', 'PatroleReleaseNotes.tex',
+ u'Patrole Release Notes Documentation',
+ u'Patrole Developers', 'manual'),
]
# The name of an image file (relative to this directory) to place at the top of
@@ -239,8 +240,8 @@
# One entry per manual page. List of tuples
# (source start file, name, description, authors, manual section).
man_pages = [
- ('index', 'glancereleasenotes', u'Glance Release Notes Documentation',
- [u'Glance Developers'], 1)
+ ('index', 'patrolereleasenotes', u'Patrole Release Notes Documentation',
+ [u'Patrole Developers'], 1)
]
# If true, show URL addresses after external links.
@@ -253,8 +254,8 @@
# (source start file, target name, title, author,
# dir menu entry, description, category)
texinfo_documents = [
- ('index', 'GlanceReleaseNotes', u'Glance Release Notes Documentation',
- u'Glance Developers', 'GlanceReleaseNotes',
+ ('index', 'PatroleReleaseNotes', u'Patrole Release Notes Documentation',
+ u'Patrole Developers', 'PatroleReleaseNotes',
'One line description of project.',
'Miscellaneous'),
]