Merge "Fix failing compute volume attachment tests."
diff --git a/contrib/post_test_hook.sh b/contrib/post_test_hook.sh
new file mode 100644
index 0000000..ea4b5e3
--- /dev/null
+++ b/contrib/post_test_hook.sh
@@ -0,0 +1,60 @@
+#!/bin/bash -xe
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# This script is executed inside post_test_hook function in devstack gate.
+# First argument ($1) expects 'rbac-role' as value for setting appropriate
+# tempest rbac option 'rbac_test_role'.
+
+# Install pip manually.
+PATROLE_DIR=$BASE/new/patrole
+sudo pip install -e $PATROLE_DIR
+
+# Allow tempest.conf to be modified by Jenkins.
+sudo chown -R jenkins:stack $BASE/new/tempest
+sudo chown -R jenkins:stack $BASE/data/tempest
+
+TEMPEST_CONFIG=$BASE/new/tempest/etc/tempest.conf
+TEMPEST_COMMAND="sudo -H -u tempest tox"
+DEVSTACK_GATE_TEMPEST_REGEX="(^patrole_tempest_plugin\.tests\.api)"
+
+# Import devstack function 'iniset'.
+source $BASE/new/devstack/functions
+
+# First argument is expected to contain value equal either to 'admin' or
+# 'member' (both lower-case).
+RBAC_ROLE=$1
+
+if [[ "$RBAC_ROLE" == "member" ]]; then
+ RBAC_ROLE="Member"
+fi
+
+# Set rbac_flag=True under [rbac] section in tempest.conf
+iniset $TEMPEST_CONFIG rbac rbac_flag True
+# Set rbac_test_role=$RBAC_ROLE under [rbac] section in tempest.conf
+iniset $TEMPEST_CONFIG rbac rbac_test_role $RBAC_ROLE
+# Set additional, necessary CONF values
+iniset $TEMPEST_CONFIG auth use_dynamic_credentials True
+iniset $TEMPEST_CONFIG auth tempest_roles Member
+
+# Give permissions back to Tempest.
+sudo chown -R tempest:stack $BASE/new/tempest
+sudo chown -R tempest:stack $BASE/data/tempest
+
+set -o errexit
+
+# cd into Tempest directory before executing tox.
+cd $BASE/new/tempest
+
+$TEMPEST_COMMAND -eall-plugin -- $DEVSTACK_GATE_TEMPEST_REGEX --concurrency=$TEMPEST_CONCURRENCY
+sudo -H -u tempest .tox/all-plugin/bin/tempest list-plugins
diff --git a/contrib/pre_test_hook.sh b/contrib/pre_test_hook.sh
index 65d1801..ffa4c20 100755
--- a/contrib/pre_test_hook.sh
+++ b/contrib/pre_test_hook.sh
@@ -12,28 +12,8 @@
# License for the specific language governing permissions and limitations
# under the License.
-# This script is executed inside post_test_hook function in devstack gate.
-# First argument ($1) expects 'rbac-role' as value for setting appropriate
-# tempest rbac option 'rbac_test_role'.
+# This script is executed inside pre_test_hook function in devstack gate.
+# Installs patrole tempest plugin manually.
-sudo chown -R jenkins:stack $BASE/new/tempest
-sudo chown -R jenkins:stack $BASE/data/tempest
-
-# Import devstack function 'iniset'
-source $BASE/new/devstack/functions
-
-export TEMPEST_CONFIG=${TEMPEST_CONFIG:-$BASE/new/tempest/etc/tempest.conf}
-
-# First argument is expected to contain value equal either to 'admin' or
-# 'member' (both lower-case).
-RBAC_ROLE=$1
-
-if [[ "$RBAC_ROLE" == "member" ]]; then
- $RBAC_ROLE = "Member"
-fi
-
-# Set rbac_flag=True under [rbac] section in tempest.conf
-iniset $TEMPEST_CONFIG rbac rbac_flag True
-
-# Set rbac_test_role=$RBAC_ROLE under [rbac] section in tempest.conf
-iniset $TEMPEST_CONFIG rbac rbac_test_role $RBAC_ROLE
+PATROLE_DIR=$BASE/new/patrole
+sudo pip install -e $PATROLE_DIR
diff --git a/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py
index c4b44e7..4b86210 100644
--- a/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py
+++ b/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py
@@ -13,9 +13,12 @@
# License for the specific language governing permissions and limitations
# under the License.
+import testtools
+
from tempest.common import waiters
from tempest import config
from tempest.lib import decorators
+from tempest.lib import exceptions as lib_exc
from patrole_tempest_plugin import rbac_rule_validation
from patrole_tempest_plugin.tests.api.compute import rbac_base
@@ -25,10 +28,6 @@
class ServerActionsRbacTest(rbac_base.BaseV2ComputeRbacTest):
- def tearDown(self):
- self.rbac_utils.switch_role(self, switchToRbacRole=False)
- super(ServerActionsRbacTest, self).tearDown()
-
@classmethod
def setup_clients(cls):
super(ServerActionsRbacTest, cls).setup_clients()
@@ -37,13 +36,6 @@
@classmethod
def skip_checks(cls):
super(ServerActionsRbacTest, cls).skip_checks()
- if not CONF.compute_feature_enabled.api_extensions:
- raise cls.skipException(
- '%s skipped as no compute extensions enabled' % cls.__name__)
- if not CONF.compute_feature_enabled.interface_attach:
- raise cls.skipException(
- '%s skipped as interface attachment is not available'
- % cls.__name__)
@classmethod
def resource_setup(cls):
@@ -51,6 +43,30 @@
super(ServerActionsRbacTest, cls).resource_setup()
cls.server_id = cls.create_test_server(wait_until='ACTIVE',
validatable=True)['id']
+ cls.flavor_ref = CONF.compute.flavor_ref
+ cls.flavor_ref_alt = CONF.compute.flavor_ref_alt
+ cls.image_ref = CONF.compute.image_ref
+
+ def setUp(self):
+ super(ServerActionsRbacTest, self).setUp()
+ try:
+ waiters.wait_for_server_status(self.client,
+ self.server_id, 'ACTIVE')
+ except lib_exc.NotFound:
+ # if the server was found to be deleted by a previous test,
+ # a new one is built
+ server = self.create_test_server(
+ validatable=True,
+ wait_until='ACTIVE')
+ self.__class__.server_id = server['id']
+ except Exception:
+ # Rebuilding the server in case something happened during a test
+ self.__class__.server_id = self.rebuild_server(
+ self.server_id, validatable=True)
+
+ def tearDown(self):
+ self.rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(ServerActionsRbacTest, self).tearDown()
def _test_start_server(self):
self.client.start_server(self.server_id)
@@ -62,6 +78,21 @@
waiters.wait_for_server_status(self.client, self.server_id,
'SHUTOFF')
+ def _test_resize_server(self, flavor):
+ self.client.resize_server(self.server_id, flavor)
+ waiters.wait_for_server_status(self.client, self.server_id,
+ 'VERIFY_RESIZE')
+
+ def _test_revert_resize_server(self):
+ self.client.revert_resize_server(self.server_id)
+ waiters.wait_for_server_status(self.client, self.server_id,
+ 'ACTIVE')
+
+ def _test_confirm_resize_server(self):
+ self.client.confirm_resize_server(self.server_id)
+ waiters.wait_for_server_status(self.client, self.server_id,
+ 'ACTIVE')
+
@rbac_rule_validation.action(
service="nova",
rule="os_compute_api:servers:stop")
@@ -78,3 +109,59 @@
self._test_stop_server()
self.rbac_utils.switch_role(self, switchToRbacRole=True)
self._test_start_server()
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:servers:resize")
+ @decorators.idempotent_id('0546fbdd-2d8f-4ce8-ac00-f1e2129d0765')
+ @testtools.skipUnless(CONF.compute_feature_enabled.resize,
+ 'Resize is not available.')
+ def test_resize_server(self):
+ self.rbac_utils.switch_role(self, switchToRbacRole=True)
+ self._test_resize_server(self.flavor_ref_alt)
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:servers:revert_resize")
+ @decorators.idempotent_id('d41b64b8-a72d-414a-a4c5-94e1eb5e5a96')
+ @testtools.skipUnless(CONF.compute_feature_enabled.resize,
+ 'Resize is not available.')
+ def test_revert_resize_server(self):
+ self._test_resize_server(self.flavor_ref_alt)
+ self.rbac_utils.switch_role(self, switchToRbacRole=True)
+ self._test_revert_resize_server()
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:servers:confirm_resize")
+ @decorators.idempotent_id('f51620cb-dfcb-4e5d-b421-2e0edaa1316e')
+ @testtools.skipUnless(CONF.compute_feature_enabled.resize,
+ 'Resize is not available.')
+ def test_confirm_resize_server(self):
+ self._test_resize_server(self.flavor_ref_alt)
+ self.rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.addCleanup(
+ lambda: (self._test_resize_server(self.flavor_ref),
+ self._test_confirm_resize_server())
+ )
+ self._test_confirm_resize_server()
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:servers:rebuild")
+ @decorators.idempotent_id('54b1a30b-c96c-472c-9c83-ccaf6ec7e20b')
+ def test_rebuild_server(self):
+ self.rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.rebuild_server(self.server_id, self.image_ref)
+ waiters.wait_for_server_status(self.client, self.server_id,
+ 'ACTIVE')
+
+ @rbac_rule_validation.action(
+ service="nova",
+ rule="os_compute_api:servers:reboot")
+ @decorators.idempotent_id('19f27856-56e1-44f8-8615-7257f6b85cbb')
+ def test_reboot_server(self):
+ self.rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.client.reboot_server(self.server_id, type='HARD')
+ waiters.wait_for_server_status(self.client, self.server_id,
+ 'ACTIVE')
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_credentials_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_credentials_rbac.py
index d51fecb..a563784 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_credentials_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_credentials_rbac.py
@@ -13,7 +13,7 @@
# License for the specific language governing permissions and limitations
# under the License.
-from tempest.common.utils import data_utils
+from tempest.lib.common.utils import data_utils
from tempest.lib.common.utils import test_utils
from tempest.lib import decorators
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_endpoints_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_endpoints_rbac.py
index 11b0064..dbdf8dc 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_endpoints_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_endpoints_rbac.py
@@ -13,8 +13,8 @@
# License for the specific language governing permissions and limitations
# under the License.
-from tempest.common.utils import data_utils
from tempest import config
+from tempest.lib.common.utils import data_utils
from tempest.lib.common.utils import test_utils
from tempest.lib import decorators
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_groups_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_groups_rbac.py
index a9c998a..16e2dce 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_groups_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_groups_rbac.py
@@ -13,8 +13,8 @@
# License for the specific language governing permissions and limitations
# under the License.
-from tempest.common.utils import data_utils
from tempest import config
+from tempest.lib.common.utils import data_utils
from tempest.lib.common.utils import test_utils
from tempest.lib import decorators
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_projects_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_projects_rbac.py
index 9d6467c..a00569d 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_projects_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_projects_rbac.py
@@ -13,8 +13,8 @@
# License for the specific language governing permissions and limitations
# under the License.
-from tempest.common.utils import data_utils
from tempest import config
+from tempest.lib.common.utils import data_utils
from tempest.lib import decorators
from patrole_tempest_plugin import rbac_rule_validation
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_services_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_services_rbac.py
index e431216..42d0028 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_services_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_services_rbac.py
@@ -13,8 +13,8 @@
# License for the specific language governing permissions and limitations
# under the License.
-from tempest.common.utils import data_utils
from tempest import config
+from tempest.lib.common.utils import data_utils
from tempest.lib import decorators
from patrole_tempest_plugin import rbac_rule_validation
diff --git a/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py b/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
new file mode 100644
index 0000000..99552e0
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
@@ -0,0 +1,104 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from oslo_log import log
+from tempest.lib.common.utils import data_utils
+from tempest.lib.common.utils import test_utils
+from tempest.lib import decorators
+from tempest import test
+
+from patrole_tempest_plugin import rbac_exceptions
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.tests.api.network import rbac_base as base
+
+LOG = log.getLogger(__name__)
+
+
+class NetworksMultiProviderRbacTest(base.BaseNetworkRbacTest):
+
+ @classmethod
+ def skip_checks(cls):
+ super(NetworksMultiProviderRbacTest, cls).skip_checks()
+ if not test.is_extension_enabled('multi-provider', 'network'):
+ msg = "multi-provider extension not enabled."
+ raise cls.skipException(msg)
+
+ def tearDown(self):
+ self.rbac_utils.switch_role(self, switchToRbacRole=False)
+ super(NetworksMultiProviderRbacTest, self).tearDown()
+
+ def _create_network_segments(self):
+ segments = [{"provider:network_type": "gre"},
+ {"provider:network_type": "gre"}]
+
+ body = self.networks_client.create_network(
+ name=data_utils.rand_name(self.__class__.__name__),
+ segments=segments)
+ network = body['network']
+ self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+ self.networks_client.delete_network,
+ network['id'])
+ return network
+
+ @rbac_rule_validation.action(service="neutron",
+ rule="create_network:segments")
+ @decorators.idempotent_id('9e1d0c3d-92e3-40e3-855e-bfbb72ea6e0b')
+ def test_create_network_segments(self):
+ """Create network with segments.
+
+ RBAC test for the neutron create_network:segments policy
+ """
+ self.rbac_utils.switch_role(self, switchToRbacRole=True)
+ self._create_network_segments()
+
+ @rbac_rule_validation.action(service="neutron",
+ rule="update_network:segments")
+ @decorators.idempotent_id('0f45232a-7b59-4bb1-9a91-db77d0a8cc9b')
+ def test_update_network_segments(self):
+ """Update network segments.
+
+ RBAC test for the neutron update_network:segments policy
+ """
+ network = self._create_network_segments()
+ new_segments = [{"provider:network_type": "gre"}]
+
+ self.rbac_utils.switch_role(self, switchToRbacRole=True)
+ self.networks_client.update_network(network['id'],
+ segments=new_segments)
+
+ @rbac_rule_validation.action(service="neutron",
+ rule="get_network:segments")
+ @decorators.idempotent_id('094ff9b7-0c3b-4515-b19b-b9d2031337bd')
+ def test_show_network_segments(self):
+ """Show network segments.
+
+ RBAC test for the neutron get_network:segments policy
+ """
+ network = self._create_network_segments()
+
+ self.rbac_utils.switch_role(self, switchToRbacRole=True)
+ body = self.networks_client.show_network(network['id'],
+ fields='segments')
+ response_network = body['network']
+
+ # If user does not have access to the network segments attribute,
+ # no NotFound or Forbidden exception are thrown. Instead,
+ # the response will have an empty network body only.
+ if len(response_network) == 0:
+ LOG.info("NotFound or Forbidden exception are not thrown when "
+ "role doesn't have access to the endpoint. Instead, "
+ "the response will have an empty network body. "
+ "This is irregular and should be fixed.")
+ raise rbac_exceptions.RbacActionFailed
diff --git a/patrole_tempest_plugin/tests/api/orchestration/test_soft_config_rbac.py b/patrole_tempest_plugin/tests/api/orchestration/test_soft_config_rbac.py
index f0172c2..fa3840c 100644
--- a/patrole_tempest_plugin/tests/api/orchestration/test_soft_config_rbac.py
+++ b/patrole_tempest_plugin/tests/api/orchestration/test_soft_config_rbac.py
@@ -13,7 +13,7 @@
# License for the specific language governing permissions and limitations
# under the License.
-from tempest.common.utils import data_utils
+from tempest.lib.common.utils import data_utils
from tempest.lib.common.utils import test_utils
from tempest.lib import decorators