)]}' { "log": [ { "commit": "19e3becfc73cf02df18de42742ac1d90e8d29ac6", "tree": "4a8440d1fef88688b828ea8767d8d10891d8e21d", "parents": [ "2daa5e6017e0619087f192371b2b003ff9f030bb" ], "author": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Mon Jan 07 11:59:41 2019 -0600" }, "committer": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Thu Jan 31 08:20:44 2019 -0600" }, "message": "Support implied rules\n\nUsing keystone API[0] to get all role inference rules and makes it\npossible to extend the used list of roles with implied roles.\n\n[0] https://developer.openstack.org/api-ref/identity/v3/#list-all-role-inference-rules\nChange-Id: Ia57351f3b21a82f4556ec61323abd295b427fc1e\n" }, { "commit": "55e5dfe640e1d8bdc5250c17420fcc5a3fca7b3f", "tree": "8103fa68c8840129744e3b44c12a68776923b92e", "parents": [ "cd2c5fdbb9c4565b9e0ca30009e567e013587048" ], "author": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Mon Jan 07 11:59:41 2019 -0600" }, "committer": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Mon Jan 28 07:45:07 2019 -0600" }, "message": "Fix OverPermission exception for keystone tests\n\nExtend the roles in `access_token` according to the implementation[0]\nof the bp basic-default-roles:\n `admin` implies `member` implies `reader`\nSupport deprecated rules.\n\n[0] Ie18a269e3d1075d955fe494acaf634a393c6bd7b\n\nChange-Id: I0d0de2a20b03548a7e5dab1ee7af7b72651abcb6\nStory: 2004709\nTask: 28740\n" }, { "commit": "bab9e9467ce8bba3ce001414221e72cae8267d9d", "tree": "87eb21da37b3e9ac14b382bc1de4d6175d2416cf", "parents": [ "0464e81c98b1d71d0bd42ce520013cd0ac1c8bac" ], "author": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Thu Oct 11 14:04:48 2018 -0500" }, "committer": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Wed Nov 14 12:58:52 2018 -0600" }, "message": "Helper for validating RBAC list actions\n\nList RBAC actions typically perform soft authorization checks meaning\nthat the response bodies omit resources that the user isn\u0027t authorized\nto see.\nFor example, if an admin user creates a user, member role might not be\nable to see that user when listing all the users in a tenant,\ndepending on the RBAC rule.\nThis patch set adds override_role_and_validate_list function to\nRbacUtils to validate RBAC flows for API list actions.\n\nChange-Id: I5f39efc8aa0004d4ad435cbd6b8fb037c33832d6\n" }, { "commit": "ba9829d5478305b3319cb713d8a28c1893c120cc", "tree": "3e6038b5ac749de8aa64e8c030096f059436dcdd", "parents": [ "f7c54efb7f0ebc8044140d2876ad5ccebd52e669", "d02a8d836c560a3571b0a2f17f102e25bc7c5301" ], "author": { "name": "Zuul", "email": "zuul@review.openstack.org", "time": "Tue Nov 13 22:26:25 2018 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Nov 13 22:26:26 2018 +0000" }, "message": "Merge \"RequirementsAuthority multi role support enhancement\"" }, { "commit": "d02a8d836c560a3571b0a2f17f102e25bc7c5301", "tree": "ea06f52eac491355b12bd1890020259f249b242b", "parents": [ "a5f5590e2997fb2fbbb135cd2c38a9ef5bd4a5d2" ], "author": { "name": "Mykola Yakovliev", "email": "VegasQ@gmail.com", "time": "Tue Oct 30 21:35:20 2018 -0500" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Nov 08 14:44:09 2018 +0000" }, "message": "RequirementsAuthority multi role support enhancement\n\nThis patchset eliminates different behaviour between\npolicy_authority and requirements_authority.\n\nProblem description:\n\n`rbac_test_roles \u003d [member,]`\n\nPolicy authority:\n\n`update_port: role:member and role:viewer`\n\nResults in 403/False (we are member but not viewer).\n\nRequirements authority:\n\n```\nreq_auth:\n update_port:\n - member\n - viewer\n```\n\nResults in 200/True (member in update_port list).\n\nProposed solution:\n\nChange requirements_authority file sytax to support\ncomma separated roles to be considered as logical and.\n\nDepends-On: https://review.openstack.org/#/c/606110/\nChange-Id: I2e2a4a2020f5e85af15f1836d69386bc91a2d2ec\nCo-Authored-By: Felipe Monteiro \u003cfelipe.monteiro@att.com\u003e\n" }, { "commit": "74f8e7d97fffd6909ead4f362b7f956e64fb2768", "tree": "b4610969494bdffa72729533ea229db3fc5b0d17", "parents": [ "742b73767ba6eb14fd60a5aeebe52bae9cf0c58c" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Sep 30 12:33:49 2018 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Nov 07 16:23:51 2018 -0500" }, "message": "refactor: Break up RbacMalformedException into discrete exceptions\n\nThis patch set breaks up RbacMalformedException into the following\ndiscrete exceptions:\n\n* RbacMissingAttributeResponseBody\n* RbacPartialResponseBody\n* RbacEmptyResponseBody\n\nEach of the exception classes deals with a different type of\nfailure related to a soft authorization failure [0] which\nmeans that a failure occurred server side related to RBAC\nauthorization, but the result of which an incomplete, partial\nor empty response body (with a 2xx status code).\n\n* incomplete means that the response body (for show or list)\n is missing certain attributes\n* partial means that a list response only returned a subset of\n the possible results available.\n* empty means that the show or list response body is entirely\n empty\n\nBecause RbacMalformedException is not part of a stable library\nit is removed altogether; we do not need to deprecate it.\n\n[0] http://git.openstack.org/cgit/openstack/patrole/tree/doc/source/rbac-overview.rst#n232\n\nStory: 2003843\nTask: 26633\nChange-Id: I2c76c3c4d226e4877fc9d1e93707edfc230a1be4\n" }, { "commit": "e0f35503c90bee01666ee252689738c7c2042ce8", "tree": "fc80d222332c6925886acec96e4192d30636569d", "parents": [ "c38aca7587f526dbea4b3337b0a4822ae837d4ea" ], "author": { "name": "Mykola Yakovliev", "email": "VegasQ@gmail.com", "time": "Wed Sep 26 18:26:57 2018 -0500" }, "committer": { "name": "Mykola Yakovliev", "email": "myakovliev@mirantis.com", "time": "Wed Oct 31 20:45:13 2018 +0000" }, "message": "Multi role RBAC validation\n\nThis patchset replaces ``CONF.patrole.rbac_test_role`` with\n``CONF.patrole.rbac_test_roles``, where instead of single role\nwe can specify list of roles to be assigned to test user.\n\nChange-Id: Ia68bcbdbb523dfe7c4abd6107fb4c426a566ae9d\n" }, { "commit": "c38aca7587f526dbea4b3337b0a4822ae837d4ea", "tree": "92f3b63fa25c57b238cc7d99f1da30f208f5eb9b", "parents": [ "f63a8345312c17d04218fe40f9abca9d99774741" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Oct 31 01:21:48 2018 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Oct 31 01:24:24 2018 -0400" }, "message": "Add feature flag for Keystone policies removed in Stein\n\nThis patch set adds a new feature flag called\n``removed_keystone_policies_stein`` under the configuration\ngroup ``[policy-feature-enabled]`` for skipping Keystone\ntests whose policies were removed in Stein. This feature flag\nis currently applied to credentials-related policies, e.g.:\nidentity:[create|update|get|delete]_credential\n\nMore info on removed Keystone policies:\n\nhttps://review.openstack.org/#/c/597187/16\n\nChange-Id: Ibd16e658d0e1367b46a2d6730f2b6970a95ae221\n" }, { "commit": "bf524fbcf5295d521a1200db23d687a4976e9163", "tree": "8bc24696978687781978a55d1aa3bc94d4eeaebe", "parents": [ "28c9c3a2c7c3d07b7f12d6c8e4ad33853e27be3f" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Oct 03 09:03:35 2018 -0500" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Oct 19 00:27:41 2018 +0000" }, "message": "Deprecate use of v2 roles client in rbac_utils.py\n\nThis patch set deprecates use of the v2 roles client for\nrole overriding operations. This is because the Keystone v2 API\nis deprecated and slated for removal, so Patrole\u0027s use of the\nv2 Tempest roles client is also deprecated and will be\nremoved in a future release. Patrole will only support the v3 Tempest\nroles client for role overriding operations in the future.\n\nChange-Id: I9b201677cf8244b25f3cc8ea3b48a95b2b83b95e\n" }, { "commit": "59f538fdbdf650154779028747285a5e35fa2d17", "tree": "9bb4e0d069ab1eb382b4fdb06eed6c2dbf55671b", "parents": [ "91e33c6ef17af701ed230802da6eee256bcc4884" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Aug 22 23:34:40 2018 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Oct 04 17:23:16 2018 +0100" }, "message": "Replace rule/expected_error_code with non-deprecated versions\n\nThis patch set replaces deprecated occurrences of rule with\nrules and expected_error_code with expected_error_codes in\nrbac_rule_validation.action decorator.\n\nAlong with removing the parameters from the decorator, all the\nAPI tests have been changed to use the non-deprecated parameters\ninstead. Unit tests have also been updated.\n\nChange-Id: I6485b6c57795b5fe75e2b339d5c9720da30be564\n" }, { "commit": "404199107e1cf7443b8eb6667c5d177fe549a135", "tree": "363a5bb2cf18d09ca2b11888395c639fbdaaa166", "parents": [ "8c04bd87800ff8c428b58f0d8b990689916eff9e", "ef7047df40b674c72635b9dac9d7e6e1f22e9a86" ], "author": { "name": "Zuul", "email": "zuul@review.openstack.org", "time": "Thu Sep 27 22:23:32 2018 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu Sep 27 22:23:32 2018 +0000" }, "message": "Merge \"Use oslo_policy.policy.Rules.load to load rules\"" }, { "commit": "8c04bd87800ff8c428b58f0d8b990689916eff9e", "tree": "3eee77c1e29d35190b8229976864915ba874a523", "parents": [ "787fbd72542c233a66309c1700fad9645d01a394" ], "author": { "name": "Chi Lo", "email": "cl566n@att.com", "time": "Fri Jun 01 16:21:50 2018 -0500" }, "committer": { "name": "Chi Lo", "email": "cl566n@att.com", "time": "Sun Sep 16 06:31:39 2018 -0500" }, "message": "Add granularity for volume_extension:volume_type_encryption\n\nUse granular rules:\nvolume_extension:volume_type_encryption:create\nvolume_extension:volume_type_encryption:delete\nvolume_extension:volume_type_encryption:update\nvolume_extension:volume_type_encryption:get\n\nfor the corresponding create, delete, update, and\nget volume_type_encryption test cases.\n\nDepends-On: Iba58e785df934d1c4175c0877d266193ac0167b7\n\nChange-Id: Ie5159166505d9bee3e99ca0d51949f6391c569b9\n" }, { "commit": "96cb119fe968eafe77e52e6f4b1cc0740c31f5e4", "tree": "74a56e62e3ea6b6871ff06099c7b211f3962de7c", "parents": [ "f2bbb107f24ff7d9d9117ac6c30c7d28aed25791", "062fb157b80c037940fc4b227d78c258c3593f45" ], "author": { "name": "Zuul", "email": "zuul@review.openstack.org", "time": "Wed Sep 19 14:58:12 2018 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Sep 19 14:58:12 2018 +0000" }, "message": "Merge \"Add support for multiple policy files\"" }, { "commit": "ef7047df40b674c72635b9dac9d7e6e1f22e9a86", "tree": "0453f41821f0e6260c5b767c964a1950cf829fe5", "parents": [ "062fb157b80c037940fc4b227d78c258c3593f45" ], "author": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Tue Sep 11 14:48:55 2018 -0500" }, "committer": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Wed Sep 12 18:26:21 2018 -0500" }, "message": "Use oslo_policy.policy.Rules.load to load rules\n\nRe-using Rules.load function makes it possible to support parsing\ncustom YAML policy files, the new policy file extension since Ocata.\n\nChange-Id: I9c7645a0f9b04609921a5ea607b203e8215fc32b\n" }, { "commit": "062fb157b80c037940fc4b227d78c258c3593f45", "tree": "77799307a5654192911b2b47fd2379bf313963d1", "parents": [ "a3c15da1cd0d74d17727056dd72103fc915ab86d" ], "author": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Thu Sep 06 20:51:57 2018 -0500" }, "committer": { "name": "Sergey Vilgelm", "email": "sergey@vilgelm.info", "time": "Tue Sep 11 12:22:55 2018 -0500" }, "message": "Add support for multiple policy files\n\nMost of the neutron plugins provide an updated version of policy.json\nfile with full list of rules, but at the same time there are a lot of\nother plugins which provide their own policy files and store them in\nthe policy.d/ folder: neutron-fwaas, networking-bgpvpn, vmware-nsx,\nect...\nTo implement the tests for such plugins the Patrole should be able to\nload and merge multiple policy files for any of the services.\n\nModify the discover_policy_files function to discover all policy files\nfor each of the services. Using glob.glob() function makes it possible\nto use patterns like \u0027*.json\u0027 to discover the policy files.\nModify the _get_policy_data function to load a data from all discovered\npolicy files for a service.\n\nUpdate the unit test according to the changes.\n\nChange-Id: Ib24f3d6d7a5ffdeaecce579af9795fd897dce872\n" }, { "commit": "194752f1b5304e90e0e2911324f93cbe0169a1f3", "tree": "93799978b43a147d6919661d9ff22716b1af4426", "parents": [ "a3c15da1cd0d74d17727056dd72103fc915ab86d" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Sep 10 11:43:38 2018 -0600" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Sep 10 13:47:30 2018 -0600" }, "message": "Remove deprecated patrole.enable_rbac configuration option\n\nThis patch set removes deprecated [patrole].enable_rbac\nconfiguration option. It is better to use an appropriate\ntest regex to skip Patrole tests.\n\nChange-Id: I639f3215f7aff8a85bc97dc55c1d97be3123e003\n" }, { "commit": "11376ab7ff60d9a4a4e8f63d905e1ee20c4ba042", "tree": "ff02f3c804f56b5155a743238c44876968fd6430", "parents": [ "842845eaef1de6595e96ad253d0666555ce083f1" ], "author": { "name": "Mykola Yakovliev", "email": "VegasQ@gmail.com", "time": "Mon Aug 06 15:34:22 2018 -0500" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Aug 31 02:35:46 2018 +0000" }, "message": "Limit exception handling to calls within override_role\n\nMotivation: prevents false positives caused by test\nexceptions matching the expected exception before or\nafter the ``override_role`` context is called.\n\nThis patchset changes expected_error_codes behavior [0] by checking\nerrors explicitly outside the override_role context. This is done\nby introducing a new function to rbac_rule_validation that is\nused for validating that the expected exception isn\u0027t raised too\nearly (before ``override_role`` call) or too late (after\n``override_call``) or at all (which is a bad test).\n\nThis means that exceptions raised prior to override_role\ncall result in failure. The same goes for exceptions raised\nafter override_role -- except for those that are an instance\nof BasePatroleException (which is valid for things like\nRbacMalformedResponse getting raised intentionally).\n\nThe new exception that is introduced is called\nRbacOverrideRoleException.\n\nUnit tests are added for all validation scenarios described\nabove.\n\n[0] https://storyboard.openstack.org/#!/story/2003297\nStory: 2003297\nTask: 24246\n\nCo-Authored-By: Felipe Monteiro \u003cfelipe.monteiro@att.com\u003e\nChange-Id: Iae9a58640463093f6dda20d40261b20051be2820\n" }, { "commit": "b1e9d7a69337ccaa2395437e120e80bac4b5d662", "tree": "f4f7fc1b737029a2bdedf844caed497e3cea39bd", "parents": [ "17385c78737ca5e5dcc50a378596f0c9efa4f19b", "6bffc5c5c6d1a52793e1e2091f4e87b2edac8f31" ], "author": { "name": "Zuul", "email": "zuul@review.openstack.org", "time": "Tue Aug 21 18:26:13 2018 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Aug 21 18:26:13 2018 +0000" }, "message": "Merge \"Skip the deprecated API extensions policy tests\"" }, { "commit": "6bffc5c5c6d1a52793e1e2091f4e87b2edac8f31", "tree": "deb60b61fb01e112115f244effa1cd72fbe81f9a", "parents": [ "d063b409bb7a3d056ac9d55bb6200b1076e71422" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Aug 19 22:54:33 2018 +0100" }, "committer": { "name": "Ghanshyam Mann", "email": "gmann@ghanshyammann.com", "time": "Tue Aug 21 05:53:38 2018 +0000" }, "message": "Skip the deprecated API extensions policy tests\n\nA new policy feature flag called\n``[policy_feature_flag].removed_nova_policies_stein``\nhas been added to Patrole\u0027s config to handle Nova API\nextension policies removed in Stein [0].\n\nThe policy feature flag is applied to tests that validate\nresponse bodies for expected attributes previously returned\nfor the following policies that passed authorization:\n\n - os_compute_api:os-config-drive\n - os_compute_api:os-extended-availability-zone\n - os_compute_api:os-extended-status\n - os_compute_api:os-extended-volumes\n - os_compute_api:os-keypairs\n - os_compute_api:os-server-usage\n - os_compute_api:os-flavor-rxtx\n - os_compute_api:os-flavor-access (only from /flavors APIs)\n - os_compute_api:image-size\n\nNote that not all removed policies are included above because\ntest coverage is missing for them (like\nos_compute_api:os-security-groups).\n\nAlso fixes test flows associated with image_size tests:\n\n* endpoints are list images with details and show image (not\n list image)\n* both tests should check for OS-EXT-IMG-SIZE:size attribute\n\n[0] https://review.openstack.org/#/c/586872/8\n\nStory: 2003501\n\nChange-Id: Ia6f8d255a540f7063beedd80a3ca1833f3987490\n" }, { "commit": "bd15460f14ec538d0be12ca8f1201478134a82fe", "tree": "47bdf6b2cc93b0591419754da35bac7d4c07b8b6", "parents": [ "9ee07cf523583ffa0b6988de54c8dfe9b7e6e645" ], "author": { "name": "ghanshyam", "email": "gmann@ghanshyammann.com", "time": "Fri Aug 17 05:42:02 2018 +0000" }, "committer": { "name": "ghanshyam", "email": "gmann@ghanshyammann.com", "time": "Fri Aug 17 05:42:02 2018 +0000" }, "message": "Add release notes page for v0.4.0\n\nPatrole 0.4.0 has been released [1].\nThis commit adds a new page for v0.4.0 release notes.\n\n[1] https://review.openstack.org/#/c/592277/\n\nChange-Id: I98519d5f4ff788fee485e735f4c284ea1dd00c28\n" }, { "commit": "cad317ec400655b1d23bb0f3fc3a8edd0d6a8c40", "tree": "5d1bc155915a8dec79598b1156d46945b0f7553d", "parents": [ "bfcf1cc50e05c765f852044c679984c67589d736" ], "author": { "name": "ghanshyam", "email": "gmann@ghanshyammann.com", "time": "Thu Aug 16 03:13:18 2018 +0000" }, "committer": { "name": "ghanshyam", "email": "gmann@ghanshyammann.com", "time": "Thu Aug 16 03:13:18 2018 +0000" }, "message": "Add releasenote to tag the Patrole for Rocky release\n\nThis commit adds the releasenote to tag Patrole for Rocky\nand needed for version 0.4.0 to release.\n\nChange-Id: Ic6897aa3dd057eebc99e750d50ebb87a35391b2d\n" }, { "commit": "caffc23980285e4864085976fb482ca04d1ca7d2", "tree": "5dfccb57d6380b4167fbdb3148e86b21eda3901b", "parents": [ "839034139e8d47340f1edd75404bdbceb26e77bc", "d067148212ef95b938af5edbec359fa49156ddee" ], "author": { "name": "Zuul", "email": "zuul@review.openstack.org", "time": "Thu Aug 02 18:16:31 2018 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu Aug 02 18:16:32 2018 +0000" }, "message": "Merge \"Add tests to cover segments\"" }, { "commit": "839034139e8d47340f1edd75404bdbceb26e77bc", "tree": "57dcd0feec8c43e3d0e8c4fa9908e831dc6bd872", "parents": [ "9af45b13bca3564e758d0bd5ee83be9272dbb8e2" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Jul 09 16:33:55 2018 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Jul 31 02:15:49 2018 -0400" }, "message": "Deprecate enable_rbac configuration option\n\nThe ``[patrole].enable_rbac`` option is deprecated and will be removed\nduring the \"S\" release. This is a legacy option that was meaningful\ndownstream when Patrole was a suite of tests inside Tempest itself. Now\nthat Patrole exists upstream as a Tempest plugin, it is paradoxical to\ninstall the Patrole plugin yet have an option that allows all Patrole\ntests to be skipped. This option is at odds with current Patrole\narchitecture.\n\nTo skip RBAC tests going forward, with Patrole Tempest plugin already\ninstalled, use an appropriate regex.\n\nChange-Id: I0cc39184c7891fb9133a45488a36ba220592915f\n" }, { "commit": "d067148212ef95b938af5edbec359fa49156ddee", "tree": "996c038134eb1ac34b7d74e9f50273e381d41cdd", "parents": [ "05a73499ce2eabb1f68013304d23ae09e38ba29c" ], "author": { "name": "Mykola Yakovliev", "email": "VegasQ@gmail.com", "time": "Mon Jul 23 12:13:02 2018 -0500" }, "committer": { "name": "Mykola Yakovliev", "email": "VegasQ@gmail.com", "time": "Fri Jul 27 18:01:16 2018 -0500" }, "message": "Add tests to cover segments\n\nThis patch set adds tests to cver the neutron segments API [0].\nTest lists, gets, creates, updates, and deletes segments.\nPart of \"Increase Neutron RBAC Coverage\" initiative [1]\n\n[0] https://developer.openstack.org/api-ref/network/v2/index.html#segments\n[1] https://storyboard.openstack.org/#!/story/2002641\n\nStory: 2002641\nTask: 22306\nChange-Id: I8eef0dcd5355d6212ead2bcb109f23ca0b613109\n" }, { "commit": "35a77113fccfd5659c123adb2cc142836cdd764d", "tree": "b35dbf96aaec39fd83b3d07f7672b3bbbc8b4983", "parents": [ "2fc2929882c211682219c5ab71f06e5954fc7b53" ], "author": { "name": "Cliff Parsons", "email": "cliff.parsons@att.com", "time": "Mon May 07 14:03:40 2018 -0500" }, "committer": { "name": "Cliff Parsons", "email": "cliff.parsons@att.com", "time": "Sun Jun 17 04:37:17 2018 +0000" }, "message": "Add support for handling multiple error codes\n\nPatrole currently cannot handle the scenario where two possible\nerror codes can returned by Neutron policy enforcement for a\nfailed policy check (403 Forbidden and 404 NotFound), depending\non what role is being tested. Patrole framework can only handle\none expected_exception.\n\nThis change builds upon the recent multi-policy support to allow\nthe tester to specify multiple policy actions for one API test.\nFor each policy action, the tester would need to specify an\nerror code that is expected if the action should fail. If multiple\npolicy actions fail, the error code for the first policy action\nthat fails will be expected to be returned from the service.\n\nThis handles the cases in Neutron where Neutron may use a second\npolicy rule to determine whether or not to return a 403 error\ncode or a 404 error code. The tester is expected to list out\nwhich policy rules are being tested by the API endpoint test.\n\nChange-Id: I5cd861e184da90bb27f8ba454c94fa4d4f99c269\nCloses-Bug: #1772710\n" }, { "commit": "44d77848b5e1be53072281f77e6324cde15c3caa", "tree": "0f85a812de79f1092ece6d3ab9a30e5ac4572829", "parents": [ "1f2ba24f4df09ba3711aa520bdf1bedb63e7797a" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Mar 21 02:42:59 2018 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon May 21 22:26:36 2018 +0000" }, "message": "Update rbac_rule_validation for multi-policy support\n\nIntroduces foundational logic needed for multi-policy support\nto rbac_rule_validation module. Patrole now offers support for\nmultiple policies. The ``rules`` argument has been added to the\n``rbac_rule_validation.action`` decorator, which takes a list of\npolicy names which Patrole will use to determine the expected test\nresult. This allows Patrole to more accurately determine\nwhether RBAC is configured correctly, since some API endpoints\nenforce multiple policies.\n\nThe new ``rules`` argument is implemented for\ntest_unlock_server_override test which corresponds to [0]\nwhich enforces:\n\n rules\u003d[\"os_compute_api:os-lock-server:unlock:unlock\",\n \"os_compute_api:os-lock-server:unlock:unlock_override\"]\n\nwhich is set for this test.\n\nThe ``rule`` argument in the ``rbac_rule_validation.action``\ndecorator has been deprecated in favor of ``rules``.\n\nThe following will be carried out in additional follow up patches:\n\n * Renaming rule to rules\n * Adding multi-policy support carefully for selected APIs\n to be tracked via an etherpad\n * Updating Patrole documentation with multi-policy support\n details\n\n[0] https://github.com/openstack/nova/blob/0ab78890c155f0b6ffc7c4148b26642f47aa7070/nova/api/openstack/compute/lock_server.py#L42\n\nPartially Implements: bp rbac-testing-multiple-policies\nChange-Id: Iec651aff1c1ef6acda19bcad2f57720f1dd3f8a0\n" }, { "commit": "739041fb9c0018326baa55098e6d1a381e08c87c", "tree": "04a63d0e9fb34277f977db98a3a209078ec20bd4", "parents": [ "58515edc32a704503155b18d5904c6d96261b3d0" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Mar 25 00:24:03 2018 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat May 19 16:24:33 2018 +0100" }, "message": "feature flag: Policy feature enabled config group\n\nA new configuration group ``[policy_feature_enabled]`` has been added to\nPatrole which will be responsible for collecting the feature flags to be\nused for newly introduced policies or policies that were changed in a\nbackwards-incompatible way.\n\n * create_port_fixed_ips_ip_address_policy (Neutron)\n * update_port_fixed_ips_ip_address_policy (Neutron)\n * limits_extension_used_limits_policy (Cinder)\n * volume_extension_volume_actions_attach_policy (Cinder)\n * volume_extension_volume_actions_reserve_policy (Cinder)\n * volume_extension_volume_actions_unreserve_policy (Cinder)\n\nThese feature flags will be supported until Pike release cycle\nis EOL.\n\nThe motivation behind these feature flags is [0] which adds\nPike/Queens gating to Patrole. However, in Queens, Neutron\nand Cinder renamed or removed a few policies in a backwards-\nincompatible way. These policies can be reviewed here: [1].\n\nThis PS requires another PS [2] in devstack\u0027s lib/tempest\nbecause Patrole, being a branchless project and hosting the\nPatrole devstack plugin itself, must fall back to Tempest\u0027s\ndevstack script to list out the backwards-incompatible\npolicies in Pike.\n\nA documentation update will also come in a follow up with\ninformation on these feature flags.\n\n[0] I76c4a9b8737bf94f230ab141def652b054120f3b\n[1] e.g. http://logs.openstack.org/51/547851/4/check/patrole-member-pike/139c534/job-output.txt.gz#_2018-03-22_21_46_08_392229\n[2] I00bdeff9474c54d38b6d6844a041b305bec01ad8\n\nChange-Id: Ia0d9847908a8e723446c16465d68cd7f622c04cc\n" }, { "commit": "a1db761f098c8e17c698f3fa37d7692e7b3d0069", "tree": "e92a21258b3c004b63951b471b90039298f0d7cd", "parents": [ "5ca77494c880232c940a38127e4fdbca10435694", "4ef7e5309c61583fb2a6e48777188aff06620227" ], "author": { "name": "Zuul", "email": "zuul@review.openstack.org", "time": "Tue Mar 27 01:25:48 2018 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Mar 27 01:25:48 2018 +0000" }, "message": "Merge \"Remove already-deprecated strict_policy_check option\"" }, { "commit": "4ef7e5309c61583fb2a6e48777188aff06620227", "tree": "0a3c947eabf100b82d2b797c4187891efa287ef0", "parents": [ "f1c6757160d89c7115fda36383f2c3846544d04e" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Mar 11 07:17:11 2018 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Mar 26 19:44:15 2018 +0100" }, "message": "Remove already-deprecated strict_policy_check option\n\nThe option ``[patrole].strict_policy_check`` was deprecated\nduring the last release cycle (Queens). This was because the\noption could be set to False in order to skip tests which\nmight result in false positives.\n\nThis PS, then, removes strict_policy_check references in the code,\nupdates documentation, and adds a releasenote.\n\nChange-Id: I7f7eda39c0472bd3d70892c801fc4d14db0c0426\n" }, { "commit": "1c8620af7a9cf5b2bf7336592b42bb86d3e44c21", "tree": "a89370ea6027bf70a2288f5e81829b12a071954d", "parents": [ "2e6c54854eff80268bbd9e21031b201116106c4a" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Feb 25 18:52:22 2018 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Mar 25 04:27:02 2018 +0000" }, "message": "Remove deprecated switch_role method\n\nThis is to remove the deprecated switch_role method from\nrbac_utils module as it has been replaced by override_role\nwhich is a superior way to manipulate the underlying role used\nfor querying API endpoints in Tempest.\n\nChange-Id: Ibaffcd8cd0b62ad792b0ef5f9be4d33ec31e8c7a\n" }, { "commit": "5ca7ada87b319f4371dba58f89671030d1729b3b", "tree": "d254e77ea69cc44252826f30f4aef813304fbb8f", "parents": [ "748abc9204e11cd0a806e03175672bf4a2eba13c" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Mar 10 12:11:19 2018 -0500" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Mar 13 23:11:02 2018 +0000" }, "message": "Add releasenotes page for v0.3.0\n\nThis PS is to add releasenotes page for v0.3.0 (current) release\nof Patrole.\n\nChange-Id: I7a4701143407dafb818a1ceb573119ebc2cb0365\n" }, { "commit": "748abc9204e11cd0a806e03175672bf4a2eba13c", "tree": "a1fe9e49f566e00678c278f7ccc50c88689b1006", "parents": [ "318a0bf6028043249fb5bb1c525c243197cd7372", "0548f03bfb0a770156e95226d9c82cda44023836" ], "author": { "name": "Zuul", "email": "zuul@review.openstack.org", "time": "Mon Mar 12 04:47:30 2018 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon Mar 12 04:47:30 2018 +0000" }, "message": "Merge \"Add v0.2.0 releasenotes page\"" }, { "commit": "318a0bf6028043249fb5bb1c525c243197cd7372", "tree": "fef7940c0ac20b29fa6fddaedd656b2515709de1", "parents": [ "2fb16dac7ad808f5cf220b5bb05513b6b4c04fe3" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Feb 27 06:57:10 2018 -0500" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Mar 10 19:31:10 2018 +0000" }, "message": "Remove admin_only kwarg from rbac_rule_validation decorator\n\nThe ``admin_only`` kwarg has been removed from ``rbac_rule_validation``\ndecorator because it is no longer used by any tests. Besides that,\nit should not be used because Patrole is dedicated to RBAC testing and\nan admin-only check is not RBAC because it does not use ``oslo.policy``\nlibrary.\n\nChange-Id: Iee4881a8756cf2f2a0a4520dd450776a4f1e873c\n" }, { "commit": "0548f03bfb0a770156e95226d9c82cda44023836", "tree": "1fd3847f7a818900168a98e2bae30f91e29f7fba", "parents": [ "1a971293c3a60afc5b47b4cba8c04a323ec97298" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Mar 10 12:09:10 2018 -0500" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Mar 10 12:09:10 2018 -0500" }, "message": "Add v0.2.0 releasenotes page\n\nThis is to add a v0.2.0 releasenotes page as Patrole 0.2.0 was\nreleased during the penultimate cycle so this is overdue.\n\nChange-Id: Icc4628de816b9a413a5d7fdf44cc98c3d651f840\n" }, { "commit": "b0069835255dc45bbaca7a4e45fe41051b6b4246", "tree": "cce6730e45c7b9a72634bdafe63d8eff277b2d64", "parents": [ "938471ba9e0d1a0de617aa0068b6242eb677ebcf" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Feb 25 17:07:05 2018 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Feb 25 17:07:05 2018 +0000" }, "message": "Add releasenotes to mark the start of Queens support\n\nThis commit adds the releasenote to start the Queens support\nand needed for version 0.3.0 to release.\n\nChange-Id: I5eecc125b5a09e33d15fdccdcd39f5ad68b115fe\n" }, { "commit": "938471ba9e0d1a0de617aa0068b6242eb677ebcf", "tree": "b05dcdc9b6b63fd54ffe1bc8624ae1cb9833bc10", "parents": [ "6a8c08c3c8ebce3e4400ae21bdb1ee067ff0ef5c" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Feb 20 06:23:17 2018 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Feb 20 04:46:51 2018 +0000" }, "message": "Remove all v2.0 identity API tests\n\nAll of the identity v2.0 API tests have been remvoed from Patrole because\nthe majority of the v2.0 API has been removed from the identity project.\n\nChange-Id: I8501a8e276ce77c5c1bf631177add60d5820ed85\n" }, { "commit": "10e82fdb0fd64cf600d68080899cbfd4ebe33211", "tree": "4ed9cef760895dbc933471cceec75f7fbd823125", "parents": [ "b2e9bb2ebd3f16574317a70f5bca0f8a40d8d1cf" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Nov 21 01:47:20 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Dec 05 00:13:57 2017 +0000" }, "message": "Base implementation of override_role for automatic role re-switch\n\nThis PS deprecated switch_role in rbac_utils and replaces it with\noverride_role. override_role realizes the same functionality as\nswitch_role, but uses @contextmanager so that role-switching can be\nstreamlined. This approach offers the following advantages:\n\n 1) Role switching is performed in 1 class only. There is no\n need to call ``test_obj.switch_role(test_obj, toggle_rbac_role\u003dFalse)``\n from ``rbac_rule_validation``. This de-coupling between both modules\n leads to cleaner, more readable code.\n 2) Improves test code readability.\n 3) Improve role switch granularity, meaning the role remains switched\n within the narrowest scope possible.\n 4) Simplifies interface, making it easier for test-writers to use\n the Patrole framework.\n\nRather than doing:\n\n # setup code here\n rand_name \u003d data_utils.rand_name(...)\n # ...\n # more setup code here\n self.rbac_utils.switch_role(self, toggle_rbac_role\u003dTrue)\n # execute the test here\n\n(Without newlines, this code is very hard to read.)\n\nIt is instead possible to now do:\n\n # setup code here\n rand_name \u003d data_utils.rand_name(...)\n # ...\n # more setup code here\n with self.rbac_utils.override_role(self):\n # execute the test here\n # notice the indentation... visually it is easy to see\n # that this block here is where the role is switched\n # now we are back to admin credentials in case we still\n # need it in the test... this was not possible before w/o\n # calling ``switch_role`` yet again...\n waiters.wait_for_volume_status(self.volumes_client, ...)\n\nThis commit:\n * Adds the necessary logic to rbac_utils to allow for automatic\n role re-switch following test execution (i.e. override_role)\n * Deprecates switch_role method in rbac_utils.\n * Refactors RBAC tests in test_volumes_extend_rbac to prove\n the concept introduced here.\n * Removes _validate_switch_role functionality since its purpose\n was to overcompensate for the old switch_role interface which\n allowed users to pass in a boolean flag; now this is no longer\n needed. Also removes associated unit tests.\n * Updates a docstring in rbac_utils module.\n\nPartially Implements: blueprint rbac-utils-contextmanager\n\nChange-Id: I670fba358bf321eae0d22d18cea6d2f530f00716\n" }, { "commit": "b58c1197e9cbedb0713ea2342e8710d9869a1362", "tree": "065b7cb38206f89237925f1056c2d6a65ef02c15", "parents": [ "feec999bde210930fe1e8b16bbc60c093927c608" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Nov 20 01:50:24 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Nov 27 04:58:28 2017 +0000" }, "message": "Remove deprecrated [rbac] config group\n\nThis PS removes the deprecated [rbac] config group. It was replaced\nlast release cycle with the [patrole] config group, which has\nthe exact same options. This is because [patrole] is more user-friendly\nand congruent with the project name.\n\nChange-Id: Id1a7af0445bd50f44ddcc4277f952391968726b8\n" }, { "commit": "f71def828a1598e3cee0a1a5c3702f6bfaa650e0", "tree": "710e2db8b5cf7afd4a34a1108a89b1f1b0f5564b", "parents": [ "e182300601d0b17c85f86315d1904525b1bc1977" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Nov 07 03:27:13 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Nov 21 23:34:19 2017 +0000" }, "message": "Deprecate strict_policy_enforce configuration option\n\nThe configuration option ``[patrole] strict_policy_check``\nis deprecated and will be removed in the Rocky release cycle.\n\nThe default value for ``[patrole] strict_policy_check`` has\nbeen changed to ``True`` because a Patrole test should always\nfail if the policy action is invalid, to avoid false positives.\n\nChange-Id: Idb902f23b1845bdbc9ac8fb490f3e74e262c1451\n" }, { "commit": "f07edf12bfcdc4f92b14604af1e52aaa59bdd142", "tree": "74e7dd88d9548845a1c2562a4e7bde282908a070", "parents": [ "bf3743f507802704443512a23beb55355048e673" ], "author": { "name": "Anusha Ramineni", "email": "anusha.ramineni@nectechnologies.in", "time": "Fri Nov 17 08:41:09 2017 +0530" }, "committer": { "name": "Anusha Ramineni", "email": "anusha.ramineni@nectechnologies.in", "time": "Fri Nov 17 08:42:43 2017 +0530" }, "message": "Remove setting of version/release from releasenotes\n\nRelease notes are version independent, so remove version/release\nvalues. We\u0027ve found that projects now require the service package\nto be installed in order to build release notes, and this is entirely\ndue to the current convention of pulling in the version information.\n\nRelease notes should not need installation in order to build, so this\nunnecessary version setting needs to be removed.\n\nThis is needed for new release notes publishing, see\nI56909152975f731a9d2c21b2825b972195e48ee8 and the discussion starting\nat\nhttp://lists.openstack.org/pipermail/openstack-dev/2017-November/124480.html\n.\n\nChange-Id: Ic41ae6c5794e753af17edc2ca1cea79f9849293c\n" }, { "commit": "bbd6a3ca5951939bf891964914535563f83f77e6", "tree": "cf8332a33ec38301f7f3977fa63c94f86c4e151c", "parents": [ "322ca259b95b27653a1eb3d655d96a82e69dd1dc" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Nov 01 01:57:49 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Nov 01 01:57:49 2017 +0000" }, "message": "Remove deprecated custom policy file options\n\nThis PS removes deprecated custom policy file options, including:\n\n * cinder_policy_file\n * glance_policy_file\n * keystone_policy_file\n * neutron_policy_file\n * nova_policy_file\n\nSpecifying the location of a custom policy file should instead be\ndone by setting ``[patrole] custom_policy_files`` instead, as it\nworks with any service name.\n\nChange-Id: I7d5cfa8d3cbd8a3818553ea1066005f9315f100c\n" }, { "commit": "f7e74ac95c04f19fd0468a69ec7830acc3226193", "tree": "ac6b91377d5be4962f5722b840e30cfcc3f8017b", "parents": [ "1171b6fb1b6fae40817bf1a2cb5d52bad4a73304", "0f86ca422a6bd2d1a6edc76e8496426262128edf" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Sep 27 01:22:51 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Sep 27 01:22:51 2017 +0000" }, "message": "Merge \"RBAC tests for extended server attributes policies\"" }, { "commit": "0f86ca422a6bd2d1a6edc76e8496426262128edf", "tree": "281d701010fd2992f0b4169f8f08fd19681e5ad2", "parents": [ "a63f854f6392c554c0095862ab766ee09be14cfd" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Aug 29 21:30:52 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Sep 26 16:48:30 2017 +0000" }, "message": "RBAC tests for extended server attributes policies\n\nThis commit adds RBAC tests for extended server attributes\npolicies, the documentation for which can be found here:\n\nhttps://github.com/openstack/nova/blob/master/nova/policies/extended_server_attributes.py\n\nTests for both APIs that enforce each policy were added.\n\nChange-Id: I4150bcff934f1386ba8947d271289b790900ce2e\nImplements: blueprint rbac-tests-for-extended-server-attributes\n" }, { "commit": "1171b6fb1b6fae40817bf1a2cb5d52bad4a73304", "tree": "5b9ece0cdcc2ec252c89cd1ef493df947621c9a9", "parents": [ "a63f854f6392c554c0095862ab766ee09be14cfd" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Aug 31 04:27:45 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Sep 26 16:47:24 2017 +0000" }, "message": "Add os-create-backup compute RBAC test\n\nAdd RBAC test for creating a server backup, providing coverage for the\npolicy action: \"os_compute_api:os-create-backup\".\n\nThis patch also:\n - Removes unnecessary setUp from ServerActionsV216RbacTest\n since it does a rebuild server in case something bad\n happened to the server -- but there is only 1 test case\n in the class.\n - Use data_utils.rand_name to create a fake host name for\n evacuate server test to further randomize host name to\n guarantee 404 is thrown which is the desired outcome.\n\nChange-Id: Ia5f95deb7b9495345db50c0569885a17b22984f6\nDepends-On: Ib97e65cca468a09bbeaf68fcfe0e8192674a481e\n" }, { "commit": "384bc468a1e9176be6b6adee9739d31dc898acdd", "tree": "3150c80db632481172703921328d7c5bc4c6089a", "parents": [ "0f593351d428dff4e5d4c8a0ba746b610b167b04", "4af0345627ad9201b91e8bccf62ae93fbcec57ff" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Sep 19 16:18:05 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Sep 19 16:18:05 2017 +0000" }, "message": "Merge \"Volume test for backup:backup_project_attribute\"" }, { "commit": "6f4bc6795745e002e27b098125ca7e48ea47ad7e", "tree": "8d1c1b522d69db74ba38ef0450c5296b3f98ad85", "parents": [ "be3fac39f8ee43d09704a5e59f6aee61623045c0", "72430755e2f2054badc1d8ebaabc96d2b6ac9cae" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu Sep 07 17:12:27 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu Sep 07 17:12:27 2017 +0000" }, "message": "Merge \"RBAC tests for key_name in response\"" }, { "commit": "72430755e2f2054badc1d8ebaabc96d2b6ac9cae", "tree": "b0b6ac7fa070d3508289037a1e96cef1a8f91008", "parents": [ "2a4bc7e28a3a1a18dbce0d537e97eb6d4d4a5ff6" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Fri Aug 25 16:01:10 2017 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Sep 06 20:41:42 2017 +0000" }, "message": "RBAC tests for key_name in response\n\nAdds tests for os-keypairs that looks for \"key_name\" in the\nresponse body from a call to list or show server. Also adds a\nskip exception to test_keypairs_rbac if os-keypairs extension\nis not enabled.\n\nImplements bp:rbac-tests-for-key-name-in-response\n\nChange-Id: I2dc5332bfd59ea7c7a0e4a32b69d94ccd19ffaac\n" }, { "commit": "789d6b47e2508512f420afd730039d683e400bb0", "tree": "0512b4f17c764670b59601f63521ba777c31ebaf", "parents": [ "45fffa50e0020d4a34b1c3eac4b553522bf5fb35", "bf58a7fe3a2e03a60d4142b28b831663ddaf7b68" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Sep 06 03:13:13 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Sep 06 03:13:13 2017 +0000" }, "message": "Merge \"Fix flavor_rxtx_rbac\"" }, { "commit": "45fffa50e0020d4a34b1c3eac4b553522bf5fb35", "tree": "7ed9363e50aab9bb3f8314c15df6dee2d4419c09", "parents": [ "2a4bc7e28a3a1a18dbce0d537e97eb6d4d4a5ff6" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Aug 31 23:06:23 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Aug 31 23:10:56 2017 +0100" }, "message": "Prepare release notes for release 0.2.0\n\nAdds prelude information for release 0.2.0 to release notes,\nincluding information about currently supported projects\nand backwards-compatibility information.\n\nChange-Id: Ibf18f19a0f4775fe205e18095f1c0dcb4b257aab\n" }, { "commit": "4af0345627ad9201b91e8bccf62ae93fbcec57ff", "tree": "815de5278adb031a580bfee2a427b5dde768329f", "parents": [ "11b023243f5d58a69f9f6fe65db44bd8cea98721" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Aug 15 21:49:49 2017 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Aug 31 14:35:27 2017 +0000" }, "message": "Volume test for backup:backup_project_attribute\n\nAdd RBAC test for \"backup:backup_project_attribute\" which verifies\nthat the \"os-backup-project-attr:project_id\" attribute appears in\nthe response body only policy enforcement succeeds.\n\nThis commit specifically:\n * adds the test specified above\n * adds a class-wide volume shared by test_show_backup and\n test_show_backup_project_attribute tests (i.e. moved\n volume creation for these tests from setUp into\n resource_setup)\n\nChange-Id: I751275633a3b6f20e67894fceb826f0f97a62b46\n" }, { "commit": "5e9656d375f5d2a49fa7cc3459c126b76ce9c0e5", "tree": "0c12a2fb9346ab4e8208a7011a29f11ec240f781", "parents": [ "c545832800e2e8e9f607a446d9adc48d6306dff1", "3983d1321031469b7e750c059498c172676e8eb6" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Aug 30 21:00:45 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Aug 30 21:00:45 2017 +0000" }, "message": "Merge \"RBAC tests for os-extended-volumes policies\"" }, { "commit": "2b441901c347f912c3593d2482de902191c2e1f7", "tree": "16eb4ddb8bbdeb07b6a9e524cb4ca5e8785a760b", "parents": [ "7f8993fe3c5edb9157d696f1e0b5b97f37f31032", "146735df7ae0b8483b820c60f13b871d93ffe16c" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Aug 30 20:44:17 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Aug 30 20:44:17 2017 +0000" }, "message": "Merge \"Test coverage for compute flavor_manage policies\"" }, { "commit": "bf58a7fe3a2e03a60d4142b28b831663ddaf7b68", "tree": "d53259e8001193da2e2ccdd78700c944522ced5e", "parents": [ "9db9a1b0cb5bc63af7bbdf6ec543622cac3c64f1" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Fri Aug 25 14:21:49 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Tue Aug 29 14:30:31 2017 -0400" }, "message": "Fix flavor_rxtx_rbac\n\nUpdates flavor_rxtx to more thoroughly test policy enforcement\nby\n- making use of RbacMalformedResponse to ensure rxtx_factor\n is included in response body\n- adding new flavor_rxtx tests\n\nCurrently, POST /flavors is not tested as that action also\nenforces os-flavor-manage: create, which is admin-only by\ndefault and would therefore fail due to conflicting policy\nrestrictions. This test will be added once multi-policy\nsupport is available.\n\nChange-Id: I7fb35212fc6bb817a2b04077c983865e1191f214\nCloses-Bug: #1712725\n" }, { "commit": "7f8993fe3c5edb9157d696f1e0b5b97f37f31032", "tree": "142ed239840fd76b629343d96e776a08b7900cd1", "parents": [ "472b84c9bcf80e352caa4e652cd47571489fb59a" ], "author": { "name": "Sean Pryor", "email": "spryor@redhat.com", "time": "Mon Aug 14 12:53:17 2017 -0400" }, "committer": { "name": "Sean Pryor", "email": "spryor@redhat.com", "time": "Fri Aug 25 23:12:08 2017 -0400" }, "message": "Add a per-test log\n\nThis patch adds a new per-test logging feature to Patrole\nTo accomplish this, it adds two new config variables\n\nThe logging now prints a log message containing the results of each RBAC\ntest to a separate log file, as well as to the normal\ntempest.log file. This message is of the form:\n[Service] \u003cnova, neutron, etc\u003e\n[Test] \u003cname of the test\u0027s method\u003e\nfollowed by either the result of the test as Allowed/Denied/Error, or\nthe expected result (from oslopolicy) and then the actual result\n\nThere are two new config variables that control this, added in a new\nconfig group called patrole_log:\nenable_reporting - defaults to True, which enables this new logging\nfunctionality\nreport_log_name - defaults to patrole.log, controls the name of the log\nthe output is written to.\nreport_log_path - Defaults to the local directory, path (relative or\nabsolute) where to store the log\n\nChange-Id: Iff2176f1a7c7d10f78b96d748f1d70b222fd5072\n" }, { "commit": "3983d1321031469b7e750c059498c172676e8eb6", "tree": "7379a5095058c76726bfe870fedba0e303dc13d3", "parents": [ "d6bde6096519a9fb6878a4fafb592c039420d422" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Aug 01 01:51:07 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Aug 25 05:03:49 2017 +0000" }, "message": "RBAC tests for os-extended-volumes policies\n\nThis commit adds RBAC tests for os-extended-volumes\npolicies, the documentation for which can be found here:\n\nhttps://github.com/openstack/nova/blob/master/nova/policies/extended_volumes.py\n\nTests for both APIs that enforce each policy were added.\n\nChange-Id: I6669f420743a3fee6470a7bb4ca5f1353a0e9696\nImplements: blueprint rbac-tests-for-compute-extended-volumes\nDepends-On: I1c14646dc8d102cd093be09833c23846781e5e73\n" }, { "commit": "146735df7ae0b8483b820c60f13b871d93ffe16c", "tree": "4a88bcbb593036a55d90d6bf5891f5c750a1f61d", "parents": [ "d6bde6096519a9fb6878a4fafb592c039420d422" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Aug 21 23:38:19 2017 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Aug 22 12:51:46 2017 +0000" }, "message": "Test coverage for compute flavor_manage policies\n\nThis commit adds test coverage for the flavor_manage policies,\nwhich includes tests only for the non-deprecated policy actions:\n\n* \"os_compute_api:os-flavor-manage:create\"\n* \"os_compute_api:os-flavor-manage:delete\"\n\nThis commit also renames _create_flavor in rbac_base for compute\nmodule to be public since it is consumed by other files. It also\nadds a wait_for_resource_deletion call.\n\nChange-Id: I632235a1d81488ecc8fb1e92f801415a08c7e778\n" }, { "commit": "5f72954f121a5aa5f6bd378e2d013d2973297766", "tree": "be3fb98ac07aa30bd1ac7e1b66f03b9a14951668", "parents": [ "620105c1165464e0d2e28b9350d6e3b07f392a2d" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Jul 31 22:44:04 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Aug 21 20:17:57 2017 +0000" }, "message": "RBAC tests for extended availability zone policies\n\nThis commit adds RBAC tests for extended availability zone\npolicies, the documentation for which can be found here:\n\nhttps://github.com/openstack/nova/blob/master/nova/policies/extended_availability_zone.py\n\nTests for both APIs that enforce each policy were added.\n\nChange-Id: I36aad1ea7ef3c1418cd23fda8357132ac8bde559\nDepends-On: I1c14646dc8d102cd093be09833c23846781e5e73\n" }, { "commit": "f6eb862105742e0a04d5ef541849713348b5d357", "tree": "cf0a1f9dcf9cd8e2b1890d0136d33f680a60a604", "parents": [ "11b023243f5d58a69f9f6fe65db44bd8cea98721" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Aug 06 06:08:02 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Aug 15 21:45:27 2017 -0400" }, "message": "Deprecate [rbac] configuration group.\n\nThe [rbac] configuration group has been deprecated\nand will be removed in the next release. It has been\nrenamed to the [patrole] group which contains\nthe exact same options.\n\nThis commit makes necessary deprecation changes,\nalong with renaming changes to documentation, unit\ntests and framework.\n\nChange-Id: I71198506b97b98ac18a969b7e6b13b664579c081\n" }, { "commit": "68cb207ab6d5ff949b810665962efb2311e6f452", "tree": "fa06d3498574d540d575ca1943b603fb4a3da6d4", "parents": [ "66cadb4d967568c3bd9b519dc70addf36e36acee", "d2fcf033caadaebdf742a057e5c37fe6f135dc7a" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon Aug 14 23:10:59 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon Aug 14 23:10:59 2017 +0000" }, "message": "Merge \"Add RBAC test for updating volume group\"" }, { "commit": "2af8f554cb6f2d644da8e1656ad8f4613ef0a696", "tree": "f021d581be30c6140a940a9754e52bb82088d4ae", "parents": [ "da52cc3fac551e758dd858a4ca5c3d7977511c0e", "03286507585e6c1e5a498b50611d04daa6c9dea3" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Sat Aug 12 03:07:11 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Sat Aug 12 03:07:11 2017 +0000" }, "message": "Merge \"RBAC tests for os-extended-status policies\"" }, { "commit": "d2fcf033caadaebdf742a057e5c37fe6f135dc7a", "tree": "64a31195ff146b77b6e52f18da844dc0310c5493", "parents": [ "f6b0e29960e4929951de84f1b5423c92505c96e3" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Aug 11 01:06:53 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Aug 11 01:06:53 2017 +0100" }, "message": "Add RBAC test for updating volume group\n\nThis commit adds a test for updating a volume group, providing\ncoverage for group:update policy action.\n\nChange-Id: Ifc6ccb8d79fa01c3dfe951282e004f79db2d01cd\n" }, { "commit": "428c44ae9d7d732dada7e2b3696af92ebc61c601", "tree": "750887855614b51e08d1d37335e1602074340a0d", "parents": [ "7b9ae3fbc847f8b4cb8fa1dfb294423f6c97fa7c" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Thu Aug 03 16:00:07 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Mon Aug 07 18:57:58 2017 +0000" }, "message": "Adds update and delete agent tests\n\nAdds tests for PUT and DELETE endpoints for the os-agents client\nto test_agents_rbac.\n\nChange-Id: I916061e8301876385f3bf1566ed6a2ac14f1467a\nCloses-Bug: #1705796\n" }, { "commit": "03286507585e6c1e5a498b50611d04daa6c9dea3", "tree": "33e92e5c6d8b92129a4994f1f5b8508a1ec149f7", "parents": [ "7b9ae3fbc847f8b4cb8fa1dfb294423f6c97fa7c" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Jul 31 22:36:11 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Aug 03 03:15:09 2017 +0000" }, "message": "RBAC tests for os-extended-status policies\n\nThis commit adds RBAC tests for os-extended-status\npolicies, the documentation for which can be found here:\n\nhttps://github.com/openstack/nova/blob/master/nova/policies/extended_status.py\n\nTests for both APIs that enforce each policy were added.\n\nChange-Id: I2eb9c7f62d8adbff77dd36f39c3030751d21a894\nImplements: blueprint rbac-tests-for-compute-extended-status\nDepends-On: I1c14646dc8d102cd093be09833c23846781e5e73\n" }, { "commit": "c6043b8ad995371a812f4b460eef68c2e751bfa8", "tree": "d6a2d713e21f0df12e5dc11cc748cb0d3c3d7696", "parents": [ "530a4457572ece4ff0ffef514ff52d4b3ba3e52e", "ccfa23e3888730ef292cead216ddc1fb68e6f00a" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jul 19 02:33:17 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jul 19 02:33:17 2017 +0000" }, "message": "Merge \"Add missing v3 token related testcases\"" }, { "commit": "ccfa23e3888730ef292cead216ddc1fb68e6f00a", "tree": "179e843b8b32afe0789195f77fc247312d1a9634", "parents": [ "5e08484be65d68a3b7a837b746d406a7be6aa9ca" ], "author": { "name": "Pradeep Kumar", "email": "pk5294@att.com", "time": "Fri May 19 21:09:44 2017 +0530" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Jul 18 18:22:14 2017 +0000" }, "message": "Add missing v3 token related testcases\n\nWe have added scenarios to test_check_token_existence(),\ntest_validate_token() and test_validate_revoke_token()\n\nCo-Authored-By: Nishant Kumar \u003cnk613n@att.com\u003e\nCo-Authored-By: Pramod Kumar Singh \u003cpk110e@att.com\u003e\nCo-Authored-By: Hemanth Nakkina \u003cnh863p@att.com\u003e\n\nChange-Id: I4aadd8016dc30b0fb39f22862806aeb787b3ae75\nDepends-on: I0b95a19162456cbaf524ea6691e7e28c151c6ada\nCloses-Bug: #1691044\n" }, { "commit": "3ab2c357e8510e3d1aa562c29d4b72e9f24e1477", "tree": "b96f1454fa489374dae0e5e90d937be2197a41cf", "parents": [ "2bf66db706a1ddec90ec55a57b227e1d0494cfa8" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Jul 05 22:25:34 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Jul 10 20:56:49 2017 +0000" }, "message": "Dynamic policy file discovery\n\nPatrole should eventually support other services like Heat\nand Murano, not just the Big Tent services included in Tempest.\n\nPatrole then should be able to dynamically discover custom\npolicy files. While the solution this commit implements is\nnot perfect, it will allow more services\u0027 policy file to\nbe discovered by Patrole. The policy files will still\nhave to be located on the same host as Patrole.\n\nThis commit removes the service-specific policy path\nCONF options in favor of a new CONF option called\n``[rbac] custom_policy_files`` which is a ListOpt that\nincludes paths for each custom policy file. Each\npolicy path assumes that the service name is included in\nthe path. The paths should be ordered by precedence, with\nhigh-priority paths before low-priority paths. The first\npath that is found to contain the service\u0027s policy file\nwill be used.\n\nThis commit refactors unit tests and rbac_policy_parser\nas needed to work with the changes.\n\nChange-Id: Ia929b77223b54906888af6cd324f0cfa0fafda8f\nImplements blueprint: dynamic-policy-file-discovery\n" }, { "commit": "a12fc2feb4b244092dcf37f8b3f7c5d22c88c94d", "tree": "f2cba05b4b45a7028f7c3c231a71c5fbf89f3208", "parents": [ "c70ac86ae29b34a9a947fde12b0198df82990fe5", "ed95005ac3a3b237284dfddb98826bcb762205eb" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Fri Jul 07 17:34:15 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Fri Jul 07 17:34:15 2017 +0000" }, "message": "Merge \"Add support for testing custom RBAC requirements\"" }, { "commit": "ed95005ac3a3b237284dfddb98826bcb762205eb", "tree": "687bc0eaa64d429be14d4051844a1db7b8af3f6a", "parents": [ "4781dc9067c4c21e425cd4c283e929cf99bdc4f0" ], "author": { "name": "Rick Bartra", "email": "rb560u@att.com", "time": "Thu Jun 29 17:20:33 2017 -0400" }, "committer": { "name": "Rick Bartra", "email": "rb560u@att.com", "time": "Fri Jul 07 11:16:31 2017 -0400" }, "message": "Add support for testing custom RBAC requirements\n\nAdd support of running Patrole against a custom requirements YAML that\ndefines RBAC requirements. The YAML file lists all the APIs and the roles\nthat should have access to the APIs. The purpose of running Patrole against\na requirements YAML is to verify that the RBAC policy is in accordance to\ndeployment specific requirements. Running Patrole against a requirements\nYAML is completely optional and can be enabled through the rbac section of\nthe tempest.conf.\n\nChange-Id: I8ba89ab5e134b15e97ac20a7aacbfd70896e192f\nImplements: blueprint support-custom-yaml\nCo-Authored-By: Sangeet Gupta \u003csg774j@att.com\u003e\nCo-Authored-By: David Purcell \u003cd.purcell222@gmail.com\u003e\n" }, { "commit": "25569dc76b444e1cbed3e612d5b8c35f3cecec31", "tree": "7395b051be173403ab552c82f48f71547d3945f7", "parents": [ "e30ad634cbb92bef54a5ae99be21babb3aae9a71", "1430ac293433a02d604b7f06a87f8dfb7395e9bc" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jul 05 16:56:31 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jul 05 16:56:31 2017 +0000" }, "message": "Merge \"RBAC tests for volume v3 groups and group types\"" }, { "commit": "e30ad634cbb92bef54a5ae99be21babb3aae9a71", "tree": "9bdf12a58a623580d9789aef3876ba1c33cdfea5", "parents": [ "9f1b60f348c26223add9c87539a710515aec8ec1", "6661e2f03c52ceb6db5ea6ca2ee2d98830156461" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jul 05 16:56:23 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jul 05 16:56:23 2017 +0000" }, "message": "Merge \"Additional volume v2 backup RBAC tests\"" }, { "commit": "9f1b60f348c26223add9c87539a710515aec8ec1", "tree": "4babbb7fefdc25e6c3535d9ea62cfd331404494c", "parents": [ "a662f824fea8fe8347391371ab468b1561637bf3" ], "author": { "name": "maniksidana", "email": "ms702g@att.com", "time": "Fri May 19 02:04:01 2017 -0500" }, "committer": { "name": "Hemanth Nakkina", "email": "nh863p@att.com", "time": "Mon Jul 03 12:21:45 2017 +0530" }, "message": "Add test cases for oauth1 token related APIs.\n\nAdd test_oauth_tokens_rbac.py with RBAC test cases\nrelated to OAUTH1 token APIs\n\nChange-Id: I811ae810f95266f950a867d2993d56f632d20495\nCo-Authored-By: Nishant Kumar \u003cnk613n@att.com\u003e\nCo-Authored-By: Hemanth Nakkina \u003cnh863p@att.com\u003e\nDepends-On: I4c5369ae3ad7a7add630e3ac6a4fc52f854bc77c\nCloses-Bug: #1686076\n" }, { "commit": "1430ac293433a02d604b7f06a87f8dfb7395e9bc", "tree": "d8aca8ee147a029bee5e47e62088333e0b90b71c", "parents": [ "4781dc9067c4c21e425cd4c283e929cf99bdc4f0" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Jun 30 19:01:16 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Jun 30 21:30:16 2017 +0000" }, "message": "RBAC tests for volume v3 groups and group types\n\nThis commit adds RBAC tests for volume v3 groups\nand group types APIs. Only the APIs currently\nimplemented by the corresponding Tempest clients\nare tested.\n\nChange-Id: I4ccd52f097eb07221fbb8b9158e53d439573fd97\n" }, { "commit": "c5cf33790e589fd0e7cb36e2eaf6d9cdcaaa4eb7", "tree": "9eb54dba93892336df38b4e8f84b1bb201c6c36f", "parents": [ "34193e3d462b1bb338d7d86b544007157bb0a12b", "0f010a566c5f645ac0d26576d7ae8b55356f7f1d" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu Jun 29 23:36:29 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu Jun 29 23:36:29 2017 +0000" }, "message": "Merge \"RBAC tests for compute quota class sets\"" }, { "commit": "6661e2f03c52ceb6db5ea6ca2ee2d98830156461", "tree": "472710bf416f1a6a0a64386d1d3407e0600d514f", "parents": [ "377f088373648d3d819135c8291e64262610a3ec" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Jun 27 22:30:11 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Jun 29 21:37:29 2017 +0000" }, "message": "Additional volume v2 backup RBAC tests\n\nAdd additional RBAC tests to ``VolumesBackupsRbacTest``, providing\ncoverage for the following policy action:\n\n * volume_extension:backup_admin_actions:reset_status\n\nChange-Id: Id5d1539a3721fed3d16cf3aa1bb826f7832b6924\n" }, { "commit": "34193e3d462b1bb338d7d86b544007157bb0a12b", "tree": "362f3a9b11b814b3504d2c1ed360c89d530b7ecd", "parents": [ "4781dc9067c4c21e425cd4c283e929cf99bdc4f0" ], "author": { "name": "Van Hung Pham", "email": "hungpv@vn.fujitsu.com", "time": "Wed Jun 28 14:51:11 2017 +0700" }, "committer": { "name": "Van Hung Pham", "email": "hungpv@vn.fujitsu.com", "time": "Wed Jun 28 14:51:11 2017 +0700" }, "message": "Switch from oslosphinx to openstackdocstheme\n\nAs part of the docs migration work[0] for Pike we need to switch to use\nthe openstackdocstheme.\n\n[0]https://review.openstack.org/#/c/472275/\n\nChange-Id: I18e7db0410ffa28d6a62a1adfb1a7eabe610c950\n" }, { "commit": "0f010a566c5f645ac0d26576d7ae8b55356f7f1d", "tree": "a8ea85dc9f85792b687ed58e17705aed76c3a5bb", "parents": [ "7a52b6185e501f1fe3a017779d1a2161cff720cb" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Jun 23 20:42:59 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Jun 27 21:16:47 2017 +0000" }, "message": "RBAC tests for compute quota class sets\n\nAdd RBAC tests for compute quota class sets API, providing coverage for\nthe following policy actions:\n\n * os_compute_api:os-quota-class-sets:show\n * os_compute_api:os-quota-class-sets:update\n\nChange-Id: I0f1732a66b5955a04919a169eb338c9fa7d82340\nCloses-Bug: #1700159\n" }, { "commit": "6cb60f4dbdcc99328b728063a5d921f627a6bd8b", "tree": "627b87b07652c51c74a8054714aac8708feca7d7", "parents": [ "e9e3c2d595c3b9fd9d0b922514fd59733b175620", "c5ebd763662a35e4e97034bf870bad1566bbdbbe" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Fri Jun 23 20:41:20 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Fri Jun 23 20:41:20 2017 +0000" }, "message": "Merge \"Identity v3 RBAC Tests - EP Filter Groups\"" }, { "commit": "028ee15613358bac3d136a2510084cfb1733990b", "tree": "612bc8d76f22e69356abc73c6b88e6f0181c119d", "parents": [ "294e297f786c8e8983078caf1be2c4161ffc3f93", "e8f7917aefa97b63e9cfe749964cfbe7676a1a62" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jun 21 20:03:22 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jun 21 20:03:22 2017 +0000" }, "message": "Merge \"Additional network router RBAC tests\"" }, { "commit": "1829b68b48d381be9d15ff69c970893969b6422a", "tree": "48f4131d290e310cc4c7e2da12918fc2ad0a63b7", "parents": [ "ce90fc0f7f546424dda566734e35f89152ab8c25", "c471d41fdb6d79ae3fa7f7b61a5c1133564853bb" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jun 21 20:03:11 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jun 21 20:03:11 2017 +0000" }, "message": "Merge \"Volume test for volume_extension:volume_actions:upload_public\"" }, { "commit": "ce90fc0f7f546424dda566734e35f89152ab8c25", "tree": "5db427ae9ff65f1e27a07e74aebd63041266414b", "parents": [ "4625add2e2453820359a97fb825cabc3588aa4d5", "12a52d9fcabe4e86d88aa7cd05b68c0ed5bd041a" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jun 21 19:59:47 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jun 21 19:59:47 2017 +0000" }, "message": "Merge \"Add vol extra specs/type access RBAC tests\"" }, { "commit": "4625add2e2453820359a97fb825cabc3588aa4d5", "tree": "03eb95bd8ebb0a9d859eb80a0eb6afcd9cfac6bc", "parents": [ "1938e67ffa00dffafb66058e47497515669d7df3", "3c1de67be7509d1c16c2ed2414fe2ae6d1fb7957" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jun 21 17:53:56 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jun 21 17:53:57 2017 +0000" }, "message": "Merge \"Subnet rbac tests\"" }, { "commit": "1938e67ffa00dffafb66058e47497515669d7df3", "tree": "9dfd0539bf029ce45bfedcd0fd2b49f46b507129", "parents": [ "4a8921680317507a2524c94d14c1188eabf4f447", "f85cedce588c0543034a57be948243c807144b25" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jun 21 15:40:41 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jun 21 15:40:41 2017 +0000" }, "message": "Merge \"Add missing v2 token related testcases\"" }, { "commit": "f85cedce588c0543034a57be948243c807144b25", "tree": "b1f9e4ca5f3b81ff1d3b7474b34127a7a658c6d6", "parents": [ "4aa609ea01dd6f6ed080ee60220475473e708bf5" ], "author": { "name": "Pramod Kumar Singh", "email": "pk110e@att.com", "time": "Thu Apr 13 10:12:24 2017 +0530" }, "committer": { "name": "Pramod Kumar Singh", "email": "pk110e@att.com", "time": "Tue Jun 20 21:06:04 2017 +0530" }, "message": "Add missing v2 token related testcases\n\nWe have added scenarios to test_validate_token_head(),\ntest_validate_token() and test_validate_revoke_token()\n\nChange-Id: I9a781e3062b3d86cfb2d846b10437453bcb6a56e\nCo-Authored-By: Nishant Kumar \u003cnk613n@att.com\u003e\nCo-Authored-By: Pradeep Kumar \u003cpk5294@att.com\u003e\nDepends-On: Idc351fdcce420bb42c00bab23460f32e3c66e9ce\nCloses-Bug: #1689262\n" }, { "commit": "c5ebd763662a35e4e97034bf870bad1566bbdbbe", "tree": "e64cf55379363053917021bba31f87f572a34c81", "parents": [ "4a8921680317507a2524c94d14c1188eabf4f447" ], "author": { "name": "Nicolas Helgeson", "email": "nh202b@att.com", "time": "Wed Mar 15 16:24:43 2017 -0700" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Jun 20 16:35:33 2017 +0100" }, "message": "Identity v3 RBAC Tests - EP Filter Groups\n\nThis patch adds project-specific RBAC tests for the\nidentity v3 extension API: OS-EP-FILTER, providing\ncoverage for the following policy actions:\n\n * identity:create_endpoint_group\n * identity:list_endpoint_groups\n * identity:get_endpoint_group\n * identity:update_endpoint_group\n * identity:delete_endpoint_group\n\nThis patch also updates namespaces used in\nproject-specific RBAC tests for OS-EP-FILTER\nAPI, for consistency.\n\nCo-Authored-By: Kaustuv Royburman \u003ckr336r@att.com\u003e\nCo-Authored-By: Felipe Monteiro \u003cfelipe.monteiro@att.com\u003e\n\nChange-Id: Ida8fd205d38a1b1231bfd9fb04dd3d2a94bde0dc\nDepends-On: I96a8dbe02ff70d9cf8b23e194fe60fc5df08c43b\n" }, { "commit": "b48eba0e3502096ea09758e1058d5263361f3326", "tree": "5aaa5fece3248125caebf705cde6b36b037786a7", "parents": [ "cd8f14d0b96431afcfc4b7e27e6b719ec873ba2f", "1442d57231ccf55e5f4b8ddd0d77f751e7887a8a" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon Jun 19 19:08:07 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon Jun 19 19:08:07 2017 +0000" }, "message": "Merge \"RBAC tests for Tempest network agents_client\"" }, { "commit": "c471d41fdb6d79ae3fa7f7b61a5c1133564853bb", "tree": "7039735c1b9021b8e43c38959b745784a8d3f01d", "parents": [ "65ce70df6c7e01d4a0cc6ed42586edfe4fb429db" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Jun 09 04:05:33 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Jun 15 20:39:21 2017 +0000" }, "message": "Volume test for volume_extension:volume_actions:upload_public\n\nThis commit adds a test for testing the policy action:\nvolume_extension:volume_actions:upload_public.\n\nSpecifically:\n - adds test for volume_extension:volume_actions:upload_public\n whose minimum microversion is 3.10 [0]\n - changes the image_client for related test for test_volume_upload\n to use the admin image client for waiting for status change\n - tags this test and related test_volume_upload test as slow\n since they both take 20 secs or more to complete\n\n[0] https://github.com/openstack/cinder/blob/a98a16a658244814c079b01a0c4d05e2a1deca43/cinder/api/contrib/volume_actions.py#L272\n\nChange-Id: I2d69b48202b4dc6b4ef4adcb5bf2388353ccbd9d\n" }, { "commit": "747e0291f1b1b24f9ebb3156739b184297dbbffb", "tree": "12409befb851279f9aeb441bc996b8d5d97fd596", "parents": [ "65ce70df6c7e01d4a0cc6ed42586edfe4fb429db" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Wed Jun 07 18:16:41 2017 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Jun 15 18:11:12 2017 +0000" }, "message": "Adds lock server tests\n\nAdds tests for Nova\u0027s lock_server policies.\n\nChange-Id: Ic47ada6ea8f0e55794c22fda5eef94a52c363053\nCloses-Bug: #1696581\n" }, { "commit": "cddd116bc5cab649697a66f04045a6d6629b3972", "tree": "3ef9684547541f7edd05d5ef07675662fbde0c1c", "parents": [ "4da476646101137560987c2cc3dffc0a17a9947d", "f98d8b814816c957060c082870c3f237e75b78b3" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jun 14 02:17:45 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jun 14 02:17:45 2017 +0000" }, "message": "Merge \"Patrole should only test glance v2 api.\"" }, { "commit": "e8f7917aefa97b63e9cfe749964cfbe7676a1a62", "tree": "5379e0436087c004a932bf55e9a3cd4353a79b0b", "parents": [ "4da476646101137560987c2cc3dffc0a17a9947d" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue May 30 21:50:26 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Jun 14 00:39:25 2017 +0000" }, "message": "Additional network router RBAC tests\n\nAdd additional RBAC tests for network routers API, providing coverage\nfor the following policy actions:\n * create_router:ha\n * create_router:distributed\n * get_router:distributed\n * update_router:ha\n * update_router:distributed\n\nIncludes extension checks for l3-ha (high availability router tests) [0],\ndvr (distributed router tests) [1], and ext-gw-mode (enable snat router\ntests) [2].\n\n[0] See description for ha attribute in link below.\n[1] See description for distributed attribute in link below.\n[2] See description for enable_snat attribute in link below.\n\nhttps://developer.openstack.org/api-ref/networking/v2/?expanded\u003dcreate-router-detail#create-router\n\nChange-Id: I236d643f6320b8cc6c595bfcf52b5f5b5cd73378\n" }, { "commit": "4da476646101137560987c2cc3dffc0a17a9947d", "tree": "2f5f049e7169c94de96ff2fa3979baba34408f62", "parents": [ "bbd3892e4548b5b00e04d53f7a062d26d1f68164", "189e13861d79bd3491643d6e769c9c1ea32f70d0" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Jun 13 22:15:36 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Jun 13 22:15:36 2017 +0000" }, "message": "Merge \"Adds console output RBAC tests\"" }, { "commit": "d3d967f1652c119f6073ad4903f422f4742754e8", "tree": "4ef26faea210dae0b9c1af40bcd40a7bd5581f3f", "parents": [ "7b761b809afbdfa3a1628654450f85298f9c3eb8", "1b7d5d5286185bf4c15afd14b19a616f17b1161d" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Jun 13 21:57:53 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Jun 13 21:57:53 2017 +0000" }, "message": "Merge \"Adds service_providers client tests\"" }, { "commit": "3c1de67be7509d1c16c2ed2414fe2ae6d1fb7957", "tree": "550aaa17eaaa6380c1e949b2ce7a4d6377595902", "parents": [ "a44dddf13a6973d35f7bd81c6c3ad0a2550a72b9" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri May 26 23:48:47 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Jun 13 19:51:18 2017 +0100" }, "message": "Subnet rbac tests\n\nAdd rbac tests for subnet-related network policy actions. This\ncommit adds coverage for the following policy actions:\n\n * create_subnet\n * get_subnet\n * update_subnet\n * delete_subnet\n\nNote that policy actions like create_subnet:segment_id and\nget_subnet:segment_id have not been included because it is not\nclear how to enforce them (same with create_subnet:service_types:\nservice_types is not even an attribute exposed in the subnet v2.0\ndocumentation).\n\nChange-Id: I982fde3e065cbf966a03754e99dae8c3fe8715b9\n" }, { "commit": "1442d57231ccf55e5f4b8ddd0d77f751e7887a8a", "tree": "06ed3e1f1b42414d8ae7447829a5dfd7026fe212", "parents": [ "337e00f308f645d1b1cefde97cb01ef13da5b0cc" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Jun 10 19:02:29 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Jun 13 15:56:44 2017 +0000" }, "message": "RBAC tests for Tempest network agents_client\n\nImplements RBAC tests for Tempest network agents_client, providing\ncoverage for the following policies:\n\n * update_agent\n * get_agent\n * create_dhcp-network\n * delete_dhcp-network\n * get_dhcp-networks\n * create_l3-router\n * delete_l3-router\n * get_l3-routers\n\nThis covers all the current endpoints in Tempest\u0027s network\nagents_client, except for delete_agent (which is too destructive\nto test in the gate) and list_agents, which doesn\u0027t do policy\nenforcement.\n\nChange-Id: Id1f64669860d9527f445398c59593ec16d7c6805\nCloses-Bug: #1697129\n" }, { "commit": "7b761b809afbdfa3a1628654450f85298f9c3eb8", "tree": "27f06fff4993b89f3ea98cf513c7ffc8db2bf0f8", "parents": [ "4aa609ea01dd6f6ed080ee60220475473e708bf5" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Wed May 03 14:23:20 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Tue Jun 13 12:59:34 2017 +0000" }, "message": "Adds server security group tests\n\nAdds server security group RBAC tests and updates Nova\nsecurity group RBAC tests.\n\nCo-Authored-By: Felipe Monteiro \u003cfelipe.monteiro@att.com\u003e\n\nChange-Id: I7008e9d489517caa6b8ad743035661a3ab7c93af\nCloses-Bug: #1687315\n" }, { "commit": "1b7d5d5286185bf4c15afd14b19a616f17b1161d", "tree": "f3d85a17b37dfd8faaac666007b7c7340daa8be4", "parents": [ "6c3ae4b6dcf5b28afbb0e9f76dd7794e959083bc" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Mon Jun 12 17:36:06 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Mon Jun 12 17:38:46 2017 -0400" }, "message": "Adds service_providers client tests\n\nAdds tests for Tempest service_providers client.\n\nChange-Id: I7044b1b80cdb5cf61dadabc327f13bb046b510a6\nCloses-Bug: #1697130\n" }, { "commit": "f98d8b814816c957060c082870c3f237e75b78b3", "tree": "290ea418f88e2648d55ea32fdf4cf6377472ade8", "parents": [ "7308f78c43723dd526c8168eab74dd6b2d297458" ], "author": { "name": "maniksidana", "email": "ms702g@att.com", "time": "Thu Jun 08 09:45:39 2017 -0500" }, "committer": { "name": "maniksidana", "email": "ms702g@att.com", "time": "Mon Jun 12 02:44:28 2017 -0500" }, "message": "Patrole should only test glance v2 api.\n\nThis is with regards to\n[0] https://docs.openstack.org/releasenotes/tempest/v16.0.0.html\nDeprecating glance v1 in patrole and only testing glance v2.\n\nChange-Id: I5b2e47542b8e6a7a9c0ce7f5c9d4c76291fac8c1\nCloses-Bug: #1685938\n" }, { "commit": "dafcee4b0338410ce8269f5f758fce31f301957f", "tree": "5c89995135e6c757444f64417b57597e63480d7e", "parents": [ "f8ad10a4741e16a8f91fa7b7f602413195da79c8", "9a6f20f61d6f2af5fbc70e3a2e90e14b3f6cb7fa" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Fri Jun 09 02:18:24 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Fri Jun 09 02:18:24 2017 +0000" }, "message": "Merge \"Adds tests for compute snapshots API\"" }, { "commit": "f8ad10a4741e16a8f91fa7b7f602413195da79c8", "tree": "64868261a1b5643359bd942105a04b1699ecef82", "parents": [ "7308f78c43723dd526c8168eab74dd6b2d297458", "ace85acc1a1122c2f3c3ae3c559836fbed2f8922" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu Jun 08 16:56:52 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu Jun 08 16:56:52 2017 +0000" }, "message": "Merge \"RBAC tests for image_size compute policy action.\"" }, { "commit": "12a52d9fcabe4e86d88aa7cd05b68c0ed5bd041a", "tree": "f63b8161190833890b6f91e312ed4329927a25d2", "parents": [ "7308f78c43723dd526c8168eab74dd6b2d297458" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri May 12 20:42:05 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Jun 08 15:32:13 2017 +0000" }, "message": "Add vol extra specs/type access RBAC tests\n\nAdded RBAC tests for volume type access API and additional tests for\nvolume type extra specs API (there was only 1 test for this API\nbefore this patch), providing coverage for the following policy actions:\n * \"volume_extension:types_extra_specs\"\n * \"volume_extension:volume_type_access\"\n * \"volume_extension:volume_type_access:addProjectAccess\"\n * \"volume_extension:volume_type_access:removeProjectAccess\"\n\nChange-Id: I99628d26fb594967a49d30319921b9b60f0b5eaf\n" }, { "commit": "7308f78c43723dd526c8168eab74dd6b2d297458", "tree": "295cdbc9648579973b9ba479500a0b5885ac0b04", "parents": [ "8316d159e8dbca29369ef8c0dfaadbdfcda79489", "c1f67b2e7f6445bd7f6edc771e0c6d58d4323fc1" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Jun 07 22:12:43 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Jun 07 22:12:44 2017 +0000" }, "message": "Merge \"Correct reno list formatting\"" } ], "next": "189e13861d79bd3491643d6e769c9c1ea32f70d0" }