[Fix gate] Fix failing identity v2 admin tests
This patch fixes the failing identity tests that
belong to the v2 admin API [0].
Due to recent changes to Keystone and DevStack,
the v2 admin API tests fail if run outright.
Tempest now skips the v2 admin tests uness
``CONF.identity_feature_enabled.api_v2_admin`` is true [1];
Patrole should do the same.
This patch makes the following changes:
- Skips identity v2 admin tests unless
``CONF.identity_feature_enabled.api_v2_admin`` is true
- Removes superfluous tempest.conf overrides from
post_test_hook
- Updates ``rbac_utils.switch_role`` to ensure that admin
identity credentials are properly configured and that
the ``roles_v3_client`` is always used
- Refactors test_projects_rbac in v2 identity because
the API belongs to both the admin and non-admin API,
which was causing OverPermission error to be thrown.
[0] https://developer.openstack.org/api-ref/identity/v2-admin/
[1] https://review.openstack.org/#/c/458844/
Change-Id: Ic698d0b2cf669793aaad6aff972ba155ef993e4a
diff --git a/patrole_tempest_plugin/rbac_utils.py b/patrole_tempest_plugin/rbac_utils.py
index d952014..55a5599 100644
--- a/patrole_tempest_plugin/rbac_utils.py
+++ b/patrole_tempest_plugin/rbac_utils.py
@@ -20,6 +20,7 @@
import oslo_utils.uuidutils as uuid_utils
import six
+from tempest.common import credentials_factory as credentials
from tempest import config
from patrole_tempest_plugin import rbac_exceptions
@@ -56,10 +57,12 @@
self.token = test_obj.auth_provider.get_token()
self.identity_version = test_obj.get_identity_version()
- if self.identity_version.endswith('v3'):
- self.roles_client = test_obj.os_admin.roles_v3_client
- else:
- self.roles_client = test_obj.os_admin.roles_client
+ if not credentials.is_admin_available(
+ identity_version=self.identity_version):
+ msg = "Missing Identity Admin API credentials in configuration."
+ raise rbac_exceptions.RbacResourceSetupFailed(msg)
+
+ self.roles_client = test_obj.os_admin.roles_v3_client
LOG.debug('Switching role to: %s', toggle_rbac_role)