)]}' { "log": [ { "commit": "8d3e4396d9003eba77ed1354eff3516e7e4bc429", "tree": "cd7a6f4301b8244db24769715b4f73d20bb98017", "parents": [ "9e0e46270495929cfa0f78ffd82ec6b37e6f62a9", "3c3fc9a9b168a18f7ac3abec1db1807042d56b71" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue May 09 16:09:43 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue May 09 16:09:43 2017 +0000" }, "message": "Merge \"Consolidates rbac_base for v2 and v3 identity tests\"" }, { "commit": "9e0e46270495929cfa0f78ffd82ec6b37e6f62a9", "tree": "1cc2c8ec7a0cdccd7eb4d76f68fe52d8219715b7", "parents": [ "e4782c0e4bbac1a5e5fe119bf02d5f7995d80cf2", "7cec526593995d4464cba6d345ea8f2103192243" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue May 09 16:09:37 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue May 09 16:09:37 2017 +0000" }, "message": "Merge \"Corrects compute microversion docstrings\"" }, { "commit": "e4782c0e4bbac1a5e5fe119bf02d5f7995d80cf2", "tree": "5e3a0c2d17657a3f3c82b3facff8ca70c9b9dd52", "parents": [ "f1bd2b06abbb8c19ddf939f79b8dc1dcdbd7e71e", "f6b69e23b95d5348a19774ed14f14b53b52b1452" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue May 09 16:08:06 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue May 09 16:08:06 2017 +0000" }, "message": "Merge \"Change \"admin\" literal for admin role to CONF admin_role\"" }, { "commit": "7cec526593995d4464cba6d345ea8f2103192243", "tree": "f7218766efa10c9729e010226d0aef007a8cef65", "parents": [ "3db2fb7279fd6c90b2255998e970624d0c214006" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu May 04 17:18:46 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri May 05 21:43:30 2017 +0100" }, "message": "Corrects compute microversion docstrings\n\nThis patch updates API ref links for the comments above the\nmicroversions to point to the precise location of the\ndeprecated API comment. Also adds min_microversion where\nmax_microversion is specified.\n\nChange-Id: I6c6e9e3c5bd78d62c6cfd3ccef480d2b6c54dd75\n" }, { "commit": "f1bd2b06abbb8c19ddf939f79b8dc1dcdbd7e71e", "tree": "2d431d1ba679695c3695f3792f854e519d002173", "parents": [ "aca34184ad26a7b4d6936f5537bad25d61c16523" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri May 05 05:16:40 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri May 05 05:18:20 2017 +0100" }, "message": "Volume services rbac test\n\nAdds an RBAC test for the volume services API. This covers\nthe cinder policy action \"volume_extension:services:index\".\n\nChange-Id: I8d12de532087b52bd113c052bfa173f6041e9e1d\n" }, { "commit": "aca34184ad26a7b4d6936f5537bad25d61c16523", "tree": "6a0ae2699303f6e95e2ed9b677a578da588c9a81", "parents": [ "ae6d0ef3c15a2f5e86250e446031005f290a73d4", "45c2b35d55fded3fe5e31f478567bff45355e254" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu May 04 23:08:01 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu May 04 23:08:01 2017 +0000" }, "message": "Merge \"Remove heat tests from patrole\"" }, { "commit": "f6b69e23b95d5348a19774ed14f14b53b52b1452", "tree": "33874463560c02812dbff7396aa55b1cc7d5c00d", "parents": [ "ae6d0ef3c15a2f5e86250e446031005f290a73d4" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu May 04 21:55:04 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu May 04 20:59:29 2017 +0000" }, "message": "Change \"admin\" literal for admin role to CONF admin_role\n\nCurrently, the Patrole framework always assumes that the admin\nrole is \"admin\". But this might not necessarily be the case.\nThe word \"admin\" is just a convention, but is nonetheless an\narbitrary designation for administration privileges.\n\nInstead, the Patrole framework should take advantage of the\nalready-existing Tempest configuration option:\n\n cfg.StrOpt(\u0027admin_role\u0027,\n default\u003d\u0027admin\u0027,\n help\u003d\"Role required to administrate keystone.\"),\n\nThis patch changes instances of \u0027admin\u0027 (for identifying the\nadmin role) with ``CONF.identity.admin_role``. This patch doesn\u0027t\nmake changes to \u0027admin\u0027 in unit tests, as that\u0027s not necessary,\nbut instead uses ``CONF.set_override`` to change the ``admin_role``\nto \"admin\".\n\nCloses-Bug: #1680294\nChange-Id: Ia4431c2a16892a60fe10bb7e8495e7e384e552c1\n" }, { "commit": "3c3fc9a9b168a18f7ac3abec1db1807042d56b71", "tree": "acb43dcf42a53caa93307f5aeb272169b585ee2e", "parents": [ "83d77303ec44000821da7961116ee06ac4cf9497" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Wed Apr 26 17:02:33 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Thu May 04 18:36:15 2017 +0000" }, "message": "Consolidates rbac_base for v2 and v3 identity tests\n\nConsolidates identity v2 and v3 base classes into one file and\nrefactors necessary identity tests as a result of this change.\n\nChange-Id: Iab2850f6863cb4c2250bd2ad5fe47ee7ba5fb954\nCloses-Bug: #1685958\n" }, { "commit": "ae6d0ef3c15a2f5e86250e446031005f290a73d4", "tree": "865ea7b45bf55b3ab0bde3adc849cd47bd7c618f", "parents": [ "83d77303ec44000821da7961116ee06ac4cf9497", "2c9e3a4379d824fca792867321515a923226aaf7" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu May 04 18:18:56 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu May 04 18:18:56 2017 +0000" }, "message": "Merge \"Removes force_backup_delete test\"" }, { "commit": "83d77303ec44000821da7961116ee06ac4cf9497", "tree": "7fff5ffd7ed710618a48723e35d3cb6de04d4118", "parents": [ "6f8b350c9b18c77ceff071825d82da23b06e74b7", "78fc4895be73245937414611079d03a1e8a2132f" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu May 04 15:40:27 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu May 04 15:40:27 2017 +0000" }, "message": "Merge \"Merge rbac_auth with rbac_rule_validation\"" }, { "commit": "6f8b350c9b18c77ceff071825d82da23b06e74b7", "tree": "63ed7baff7b28ec7149ab9dc06a524b95eadb47b", "parents": [ "f950f859fbfe17849db8ab6342d5d8d1fbdb73a5", "2297aa1e08522650841ad18697811efd6735ef78" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu May 04 15:40:16 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu May 04 15:40:16 2017 +0000" }, "message": "Merge \"Add RBAC test cases to manage cinder volume\"" }, { "commit": "f950f859fbfe17849db8ab6342d5d8d1fbdb73a5", "tree": "e0960b9b5598e72f0abf069976240ccfee29d8e3", "parents": [ "63459954835032dce4083997baccd988e66d281d", "d7120bbdc37d4b8471286cb1d3538c275eaecbd3" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed May 03 21:55:36 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed May 03 21:55:36 2017 +0000" }, "message": "Merge \"Add force detach volume test.\"" }, { "commit": "d7120bbdc37d4b8471286cb1d3538c275eaecbd3", "tree": "326d77e1d187bd8927262da40939341b72f5da96", "parents": [ "910c7c860786073e25b6a8a8ada0493bc5477651" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 26 22:30:20 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed May 03 20:03:02 2017 +0000" }, "message": "Add force detach volume test.\n\nThis patch adds the force detach volume test to\ntest_volume_actions_rbac, which enforces the following policy\naction:\n\n volume_extension:volume_admin_actions:force_detach\n\nfor the force_detach endpoint [0].\n\n[0] https://github.com/openstack/cinder/blob/master/cinder/api/contrib/admin_actions.py#L130\n\nChange-Id: I4442f97012572bb2bfb398ba5593d742b920f13e\n" }, { "commit": "2c9e3a4379d824fca792867321515a923226aaf7", "tree": "e2f6bd7574d085d876bc07234602d6a1430c46a2", "parents": [ "e7e552e7db5a7876a067b7aba46fc66b05b36743" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Wed May 03 15:28:09 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Wed May 03 15:28:09 2017 -0400" }, "message": "Removes force_backup_delete test\n\nTempest has removed support for force_backup_delete and does not\ncurrently have any plans to add it back in [0]. As such, this\ntest should be removed.\n\n[0] https://review.openstack.org/#/c/461625/\n\nChange-Id: Id456b384e2302c08a785add184ce0b0dd9642f4b\n" }, { "commit": "63459954835032dce4083997baccd988e66d281d", "tree": "341d23bca32c1e3d6de1ad6be8c1871b8f74c051", "parents": [ "910c7c860786073e25b6a8a8ada0493bc5477651" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Fri Apr 28 15:15:59 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Wed May 03 19:26:43 2017 +0000" }, "message": "Adds create metadef resource test\n\nAdds test for glance\u0027s add_metadef_resource_type_association policy.\n\nChange-Id: Ic249cb10f4e0715e8f89676ee8686e737b011ba4\n" }, { "commit": "910c7c860786073e25b6a8a8ada0493bc5477651", "tree": "099c8b1cb5b5c00924bef3672075388e7e8e6cb2", "parents": [ "4606d0ca14ebb153da992ad25a35b1f8921f51be", "85f79d7abf6b2e5445a667025397d05dacad757a" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed May 03 19:20:14 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed May 03 19:20:14 2017 +0000" }, "message": "Merge \"Creates config options for policy.json paths\"" }, { "commit": "4606d0ca14ebb153da992ad25a35b1f8921f51be", "tree": "872565f55271f576ccaeebeba0068252567794db", "parents": [ "e7e552e7db5a7876a067b7aba46fc66b05b36743", "b89e5849b635fe1600159e161c4df415875bb0f0" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed May 03 19:19:46 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed May 03 19:19:46 2017 +0000" }, "message": "Merge \"Move tests from volumes into volumes actions.\"" }, { "commit": "e7e552e7db5a7876a067b7aba46fc66b05b36743", "tree": "a4ce83902f697492c7d2fca31403fd61ef300f83", "parents": [ "a0e6940339e6ada37ccf52c45c0b398f42f6be2e" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue May 02 17:04:12 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed May 03 16:09:54 2017 +0000" }, "message": "[Fix gate] Fix failing identity v2 admin tests\n\nThis patch fixes the failing identity tests that\nbelong to the v2 admin API [0].\n\nDue to recent changes to Keystone and DevStack,\nthe v2 admin API tests fail if run outright.\n\nTempest now skips the v2 admin tests uness\n``CONF.identity_feature_enabled.api_v2_admin`` is true [1];\nPatrole should do the same.\n\nThis patch makes the following changes:\n - Skips identity v2 admin tests unless\n ``CONF.identity_feature_enabled.api_v2_admin`` is true\n - Removes superfluous tempest.conf overrides from\n post_test_hook\n - Updates ``rbac_utils.switch_role`` to ensure that admin\n identity credentials are properly configured and that\n the ``roles_v3_client`` is always used\n - Refactors test_projects_rbac in v2 identity because\n the API belongs to both the admin and non-admin API,\n which was causing OverPermission error to be thrown.\n\n[0] https://developer.openstack.org/api-ref/identity/v2-admin/\n[1] https://review.openstack.org/#/c/458844/\n\nChange-Id: Ic698d0b2cf669793aaad6aff972ba155ef993e4a\n" }, { "commit": "45c2b35d55fded3fe5e31f478567bff45355e254", "tree": "c6c6f24b7fd78bb2056e4afbb3d10b2b31fb96f0", "parents": [ "a0e6940339e6ada37ccf52c45c0b398f42f6be2e" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed May 03 02:47:37 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed May 03 03:20:35 2017 +0100" }, "message": "Remove heat tests from patrole\n\nAs Tempest is now in the process of removing\nheat tests [0], Patrole should follow suit\nby doing the same.\n\n[0] https://review.openstack.org/#/c/461841/\n\nChange-Id: I169e74a3af4957248cda26d108b61ff187ae4b1d\nRelated-Change-Id: Ifc2cac575919da4e361eaa3234d7e0f3e2f98d21\nDepends-On: Ifd150ef113988e7a3721ee174f0453f99ce198f6\nCloses-Bug: #1687837\n" }, { "commit": "a0e6940339e6ada37ccf52c45c0b398f42f6be2e", "tree": "2b79543306c913a331c6095b4808f4e773237fa8", "parents": [ "203c338ffbf50dac15e3a90677aaa7dc2c5070e2", "b45a05e8bed5c404016724c0ca39f050885ea9bd" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon May 01 15:37:57 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon May 01 15:37:58 2017 +0000" }, "message": "Merge \"Add RBAC test for force-deleting a backup\"" }, { "commit": "203c338ffbf50dac15e3a90677aaa7dc2c5070e2", "tree": "001db1c0e34be697d3fe8e42740a81e4dcdd6297", "parents": [ "985052a456968458edca8bb133e9a921b76dbfb8", "c82ce14af86224d888cc6ec0edde8e1b9dac2425" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon May 01 15:02:28 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon May 01 15:02:28 2017 +0000" }, "message": "Merge \"Replace generic api_extensions checks\"" }, { "commit": "985052a456968458edca8bb133e9a921b76dbfb8", "tree": "d7f3ab0b6e7424f4203a9d61c9878ad0bd3070f2", "parents": [ "f568d04215f1e70e959cdbcab1a74e12e89fbd6a", "d0b747bd640ca9bc1f932f9d91cfe2b6801eb5f3" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon May 01 14:57:57 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon May 01 14:57:57 2017 +0000" }, "message": "Merge \"Add RBAC tests for cinder os-quota-class-sets API\"" }, { "commit": "d0b747bd640ca9bc1f932f9d91cfe2b6801eb5f3", "tree": "05a99d668852f89eb83f7acc831e25b39b57822a", "parents": [ "edcdbecd6bfaf5476eb57a35d21c78a5c2876a5d" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Apr 30 04:41:44 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Apr 30 19:01:40 2017 +0000" }, "message": "Add RBAC tests for cinder os-quota-class-sets API\n\nThis patch adds RBAC tests for the cinder os-quota-class-sets API,\nwhich cover the policy action \"volume_extension:quota_classes\" [0][1].\n\n[0] https://github.com/openstack/cinder/blob/master/cinder/api/contrib/quota_classes.py#L44\n[1] https://github.com/openstack/cinder/blob/master/cinder/api/contrib/quota_classes.py#L55\n\nChange-Id: Iba5dc5caf7ed3f1ad344b0d7b2d6c13a9842cf79\n" }, { "commit": "b45a05e8bed5c404016724c0ca39f050885ea9bd", "tree": "b3155249c06b7c9cfd8ac515c3dac0f775774fba", "parents": [ "edcdbecd6bfaf5476eb57a35d21c78a5c2876a5d" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Apr 30 03:51:08 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Apr 30 03:51:08 2017 +0100" }, "message": "Add RBAC test for force-deleting a backup\n\nThis patch adds a new test for force-deleting a backup in\ntest_volumes_backup_rbac, which tests the cinder policy action:\n\"volume_extension:backup_admin_actions:force_delete\".\n\nThis patch also corrects the currently wrong policy action for\nthe test test_snapshot_force_delete from\n\"volume_extension:volume_admin_actions:force_delete\" to\n\"volume_extension:snapshot_admin_actions:force_delete\". (The\n``_force_delete`` function in the cinder admin actions API enforces\nthe policy action corresponding to the resource name [0][1]).\n\n[0] https://github.com/openstack/cinder/blob/master/cinder/api/contrib/admin_actions.py#L133\n[1] https://github.com/openstack/cinder/blob/master/cinder/api/contrib/admin_actions.py#L82\n\nChange-Id: Icecf2152fe84da2847ae677a74a4d183eb4cd88b\n" }, { "commit": "f568d04215f1e70e959cdbcab1a74e12e89fbd6a", "tree": "36c86893f34bd0b412c4ad392357972bdcb9dde6", "parents": [ "edcdbecd6bfaf5476eb57a35d21c78a5c2876a5d" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Tue Apr 25 16:32:54 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Fri Apr 28 20:20:51 2017 +0000" }, "message": "Adds missing volumes client tests\n\nAdds missing volumes client tests for set bootable, reserve,\nunreserve, and update metadata actions, as well as renames update\nmetadata item and delete metadata items tests to properly represent\nwhat actions they perform.\n\nChange-Id: I75bbf62635f3476e658f5b162f5bd65f9fcaab08\nImplements: bp: test-volumes-rbac\n" }, { "commit": "c82ce14af86224d888cc6ec0edde8e1b9dac2425", "tree": "11184d9fb8e14ed7238374b41ce1d98c2dbf9604", "parents": [ "edcdbecd6bfaf5476eb57a35d21c78a5c2876a5d" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Thu Apr 27 13:20:28 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Fri Apr 28 16:10:05 2017 -0400" }, "message": "Replace generic api_extensions checks\n\nReplaces generic api_extensions checks with specific extension\nthat is being called in each test file.\n\nChange-Id: I219bb336dd0323f944bd9b4c36ed0a9f715931c2\nCloses-Bug: #1686593\n" }, { "commit": "78fc4895be73245937414611079d03a1e8a2132f", "tree": "bd57f093e6c8fade8f617a8da1a501f330d19a40", "parents": [ "84227729cfc252a62404fdb46c9a3ea33cbf349d" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 12 21:33:39 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Apr 27 21:57:37 2017 +0000" }, "message": "Merge rbac_auth with rbac_rule_validation\n\nCurrently, rbac_auth doesn\u0027t do much: It decentralizes logic\nthat can be easily merged into rbac_rule_validation without\ndoing anything authentication-related. All rbac_auth does is:\n\n 1) Construct RbacPolicyParser and check whether a given role\n is allowed to perform a given policy action.\n 2) Dump some info to LOG\n 3) Catch some exceptions\n\nThus, there\u0027s no justification for keeping rbac_auth. It doesn\u0027t\nprovide a high-enough level of abstraction to warrant being used.\nIt should be removed and its logic inserted in rbac_rule_validation.\n\nChange-Id: I756175ea28ec11f24150f46d5ae4c2f64499a0ea\nCloses-Bug: #1681459\n" }, { "commit": "85f79d7abf6b2e5445a667025397d05dacad757a", "tree": "730ba99421d70b7c3cd8e4c6f7645c5ac94dbedd", "parents": [ "c6a1e0a479ebcc20be7173bcd8d5387042d531a9" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Fri Apr 21 11:09:14 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Thu Apr 27 17:55:05 2017 -0400" }, "message": "Creates config options for policy.json paths\n\nRemoves unsused \"path\" parameter from rbac_policy_parser.py.\nAllows for configuration of policy.json paths by service for\nCinder, Glance, Keystone, Neutron, and Nova.\n\nChange-Id: Ifb386511fd533d587d99de6585ddb78bc17cbc94\n" }, { "commit": "edcdbecd6bfaf5476eb57a35d21c78a5c2876a5d", "tree": "66187cb526df7b52f4ba15ef8dfc7141f492cc7e", "parents": [ "6bbc6255589b995bb523ad65ad45c11ebc3f2782" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 26 22:43:02 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Apr 27 22:46:10 2017 +0100" }, "message": "Stop using aliases for creds manager\n\nNow that Tempest has stopped using aliases like cls.os\nand cls.os_adm [0], Patrole should do the same.\n\nThis patch normalizes the usage around os_admin, os_primary and\nos_alt.\n\n[0] https://review.openstack.org/#/c/457555/\n\nChange-Id: Ibc826c8c6be2590db9ad9da0831fffeae6d3a01b\nRelated-Change-Id: I5f7164f7a7ec5d4380ca22885000caa0183a0bf7\n" }, { "commit": "6bbc6255589b995bb523ad65ad45c11ebc3f2782", "tree": "b6597471f4075b15b9d6027c2ef4d86efe0ead44", "parents": [ "39c4684b40220e1efdc502d9e5ba24db3aeee67b", "6704253b0d692ab4b3d453c9ccf35af25f498608" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Apr 26 17:30:20 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Apr 26 17:30:20 2017 +0000" }, "message": "Merge \"Add encryption types test\"" }, { "commit": "39c4684b40220e1efdc502d9e5ba24db3aeee67b", "tree": "800e039f46cd7be6bbe346ca911d869c15fa3599", "parents": [ "84227729cfc252a62404fdb46c9a3ea33cbf349d", "b059d49dd2d051ca26e5680e8a199def0ea3e18b" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Apr 25 22:03:10 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Apr 25 22:03:10 2017 +0000" }, "message": "Merge \"Fix up test_volume_actions_rbac\"" }, { "commit": "b059d49dd2d051ca26e5680e8a199def0ea3e18b", "tree": "d23622db02e2129f6e85d01163bb3507578beacb", "parents": [ "4fc9a6b4bcbad1df306a7f08f84860e5abe22213" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Apr 14 18:54:07 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 25 19:38:30 2017 +0000" }, "message": "Fix up test_volume_actions_rbac\n\nThis patch:\n - Adds additional volume actions tests\n - Adds a few decorators to existing tests where needed\n - Fixes test_volume_upload throwing 300\n\nChange-Id: I712cc85c7708cf3592a77114e5dfbfa783a2a190\nCloses-Bug: #1672799\n" }, { "commit": "84227729cfc252a62404fdb46c9a3ea33cbf349d", "tree": "441a7dfd2880254d5a80177812e18ac8f5c27b38", "parents": [ "e2bfb85ec46e854cade683516f244782cd95f62f", "1fa5b2e859420cebe4081117ebcb5d0de9c713b4" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Apr 25 18:40:36 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Apr 25 18:40:36 2017 +0000" }, "message": "Merge \"Keystone v3 tests for endpoint filters for projects\"" }, { "commit": "1fa5b2e859420cebe4081117ebcb5d0de9c713b4", "tree": "f7321847c3f1338fbace4108dcbc8578e3c90d1e", "parents": [ "3f4158d93541c8832f5d7afe6ed10dc15730b87f" ], "author": { "name": "Uday T Kumar", "email": "uk310y@att.com", "time": "Mon Apr 03 19:02:25 2017 +0530" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 25 15:22:48 2017 +0000" }, "message": "Keystone v3 tests for endpoint filters for projects\n\nTests for Keystone v3 for rbac for endpoint filters for projects\n\nChange-Id: Ie4e786483295fcae183b539f96edd25efbec6a1a\nCo-Authored-By: Pradeep Kumar \u003cpk5294@att.com\u003e\nCo-Authored-By: Kaustav Royburman \u003ckr336r@att.com\u003e\nCo-Authored-By: Nicolas Helgeson \u003cnh202b@att.com\u003e\nDepends-on: I42fc49dea52ac4612cb018f3964675444c96ffdd\n" }, { "commit": "e2bfb85ec46e854cade683516f244782cd95f62f", "tree": "34bd31dd761552e8ff23c3fe2cb9ce4ce3fdecaa", "parents": [ "c6a1e0a479ebcc20be7173bcd8d5387042d531a9" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 12 15:51:15 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 25 13:56:44 2017 +0000" }, "message": "Add additional tests to test_images_rbac\n\nThis patch adds the following new tests to test_images_rbac:\n - test_create_image_tag_rbac\n - test_delete_image_tag_rbac\n - test_download_image_rbac\n\nThis patch also refactors the code by creating helper method\nto clean up the tests.\n\nChange-Id: I4362d667c20609974d3187be260e710365ca6665\n" }, { "commit": "6704253b0d692ab4b3d453c9ccf35af25f498608", "tree": "ae480331f845f745cecb4377328f8654b0f817d9", "parents": [ "c6a1e0a479ebcc20be7173bcd8d5387042d531a9" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Mon Apr 24 12:02:45 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Mon Apr 24 21:17:37 2017 -0400" }, "message": "Add encryption types test\n\nAdds patrole tests for the encryptions types client. Also\nrefactors test_volume_types_extra_specs to make use of the\ncreate_volume_type class method.\n\nChange-Id: Ice66abb1546e4f0d882927b0489f3ab1cf330c01\nImplements: bp: rbac-tests-for-encryption-types-client\nDepends-On: I1a52fca1360afb8544148e9e0e8fc2905e74db0a\n" }, { "commit": "b89e5849b635fe1600159e161c4df415875bb0f0", "tree": "43151786af009d241c209002a3a93468a90b82da", "parents": [ "c6a1e0a479ebcc20be7173bcd8d5387042d531a9" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 25 00:54:03 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 25 00:03:36 2017 +0000" }, "message": "Move tests from volumes into volumes actions.\n\nThis patch moves the tests for the following policy actions:\n\n - volume_extension:volume_admin_actions:reset_status\n - volume_extension:volume_admin_actions:force_delete\n\ninto test_volume_actions_rbac because they do not belong\nin test_volumes_rbac, as resetting a status of a volume [0]\nand force-deleting a volume [1] are a part of the volume\nactions API, not the volumes API.\n\nAs there are no tests left in test_volumes_rbac after relocating\nthese 2 tests, the file is deleted.\n\n[0] https://developer.openstack.org/api-ref/block-storage/v3/index.html?expanded\u003dreset-a-volume-s-statuses-detail\n[1] https://github.com/openstack/tempest/blob/master/tempest/api/volume/admin/test_volumes_actions.py\n\nChange-Id: Idc0286de76e1a58826f411de60988975694a2da3\n" }, { "commit": "c6a1e0a479ebcc20be7173bcd8d5387042d531a9", "tree": "20ba23d3b075eea34eee36388669aaa79b45bb6b", "parents": [ "b9452528eed17303d9701e8294ffa5fb37095a40", "fd1db988dc92e07be99d975665e5928ca5090978" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon Apr 24 20:06:17 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon Apr 24 20:06:17 2017 +0000" }, "message": "Merge \"Identity trust rbac tests\"" }, { "commit": "b9452528eed17303d9701e8294ffa5fb37095a40", "tree": "c767c256f7e6afcbf98ed5aa2b6b6bd0ea18a98a", "parents": [ "e03d69a169ccaec3c103f2bb0328854ea24353d3", "e46a27df7b220bf0e0658dc7332bbff6b49ab1f0" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon Apr 24 19:57:30 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon Apr 24 19:57:30 2017 +0000" }, "message": "Merge \"Remove skip exception from virtual interfaces test\"" }, { "commit": "e03d69a169ccaec3c103f2bb0328854ea24353d3", "tree": "b5592ed580d8aa4cd1c224df93fdb3572a535e6c", "parents": [ "e5e03d2076c717b2626de05ca779ffa9d1043fdc", "5c4b97de1cc8549eb9220853556b0c38f11b5ad7" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon Apr 24 17:45:54 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon Apr 24 17:45:54 2017 +0000" }, "message": "Merge \"Add volume user messages rbac test\"" }, { "commit": "2297aa1e08522650841ad18697811efd6735ef78", "tree": "e13a6a601de939c42c49a7294b721dcfb2212551", "parents": [ "a0e6940339e6ada37ccf52c45c0b398f42f6be2e" ], "author": { "name": "Chi Lo", "email": "cl566n@att.com", "time": "Fri Apr 21 20:03:04 2017 -0500" }, "committer": { "name": "Chi Lo", "email": "cl566n@att.com", "time": "Sat Apr 22 08:02:43 2017 -0500" }, "message": "Add RBAC test cases to manage cinder volume\n\nAdd test cases to test the following actions:\n\"volume_extension:volume_manage\": \"rule:admin_api\",\n\"volume_extension:volume_unmanage\": \"rule:admin_api\",\n\nChange-Id: Ic47cb1638c0793d288f3dd40a3036aa50b4ab24a\nPartially-Implements: blueprint \"Add rbac tests for volume_manage_client\"\n" }, { "commit": "0620e9b679e9880a4d5c76bcaf8a3c6c485c1643", "tree": "63894ff02e4acb882d5a5664e5e93219c5a38860", "parents": [ "e7df9c4819336b9631e297bf507b45b7584c1a4e", "6ed0e03496c75f22ca7237111fc2447b8a5c9867" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Apr 19 16:06:52 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Apr 19 16:06:52 2017 +0000" }, "message": "Merge \"Adding server evacuate test\"" }, { "commit": "6ed0e03496c75f22ca7237111fc2447b8a5c9867", "tree": "66bc0f887cd0b8d4064776b793cf1adf969e319e", "parents": [ "a810851df46b02fa3403c0b304d90fa3eb4dad33" ], "author": { "name": "raiesmh08", "email": "mr290n@att.com", "time": "Tue Apr 18 19:49:40 2017 +0530" }, "committer": { "name": "raiesmh08", "email": "mr290n@att.com", "time": "Wed Apr 19 12:45:12 2017 +0530" }, "message": "Adding server evacuate test\n\nThis patch adds server evacuate test.\n\nCloses-Bug: #1673811\n\nChange-Id: Ic731475d3770d6f9a03dac683b269a5ffe36d794\n" }, { "commit": "e46a27df7b220bf0e0658dc7332bbff6b49ab1f0", "tree": "ccb28d344d9bb203e6745f908b0c16581f1d9949", "parents": [ "3f4158d93541c8832f5d7afe6ed10dc15730b87f" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 18 04:27:46 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 19 02:04:58 2017 +0000" }, "message": "Remove skip exception from virtual interfaces test\n\nCurrently, test_list_virtual_interfaces in the virtual interfaces\nrbac test file throws a skip exception in the event that a BadRequest\nis thrown -- which happens if neutron is enabled. This is because\nlisting virtual interfaces is only available for nova-network, in nova.\n\nHowever, skipping the test is not necessary, because policy enforcement\nis always performed [0]: the API always performs policy enforcement\nfirst followed by everything else, so a 403 is always thrown before a 400.\n\nSo, this patch gets rid of the unnecessary raising of skipException.\nIt also adds a assertRaisesRegexp with the expected error message:\n\"Listing virtual interfaces is not supported by this cloud\" and\nexpected BadRequest error. By checking for a specific regex (error\nmessage), there is certainty that the expected BadRequest is indeed\nthrown; if any other BadRequest is thrown, an AssertionError will be\nraised.\n\nIn short: this patch removes the skipException because policy\nenforcement is always performed and ensures that the correct\nBadRequest is thrown.\n\n[0] https://github.com/openstack/nova/blob/master/nova/api/openstack/compute/virtual_interfaces.py\n\nChange-Id: Ia5bd4feb2708095bbab9eb2a377f336da84103fc\n" }, { "commit": "e7df9c4819336b9631e297bf507b45b7584c1a4e", "tree": "2e2722f1248e0185ea692c74819d4c0a25a105e8", "parents": [ "3f4158d93541c8832f5d7afe6ed10dc15730b87f" ], "author": { "name": "Joseph Abad", "email": "joseph.abad@att.com", "time": "Tue Apr 18 16:38:50 2017 -0400" }, "committer": { "name": "Joseph Abad", "email": "joseph.abad@att.com", "time": "Tue Apr 18 16:38:50 2017 -0400" }, "message": "Increase unit test coverage for policy parser.\n\nChange-Id: If801873d95c0157e3a243924b2da96a119e2acb0\n" }, { "commit": "5c4b97de1cc8549eb9220853556b0c38f11b5ad7", "tree": "a838bf080075b9e47161713eda7b4ae674ef068d", "parents": [ "a810851df46b02fa3403c0b304d90fa3eb4dad33" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 17 20:29:57 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 17 20:29:57 2017 +0100" }, "message": "Add volume user messages rbac test\n\nThis patch:\n * Adds test_user_messages_rbac which tests the cinder messages\n API [0].\n * Adds volume_types create helper to volume rbac_base.\n\nNote that microversioning is required for this test; see [1]\nfor more details.\n\n[0] https://developer.openstack.org/api-ref/block-storage/v3/index.html?expanded\u003d#messages\n[1] https://github.com/openstack/tempest/blob/master/tempest/api/volume/admin/test_user_messages.py\n\nChange-Id: I1a52fca1360afb8544148e9e0e8fc2905e74db0a\n" }, { "commit": "3f4158d93541c8832f5d7afe6ed10dc15730b87f", "tree": "9a5bceb999fd7160c099db2526579df81f524f7a", "parents": [ "a810851df46b02fa3403c0b304d90fa3eb4dad33" ], "author": { "name": "Nicolas Helgeson", "email": "nh202b@att.com", "time": "Wed Mar 15 16:47:05 2017 -0700" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 17 19:30:59 2017 +0100" }, "message": "Identity V3 Tests - Domains\n\nTests for identity v3 domains\n\nPartially-Implements bp: initial-tests-identity\n\nChange-Id: I580eabc733f948939cfed842fef083f791e263e1\nCo-Authored-By: Nishant Kumar \u003cnk613n@att.com\u003e\n" }, { "commit": "fd1db988dc92e07be99d975665e5928ca5090978", "tree": "600e3a4572d0e2a67caff8d9576e08bb83c6304f", "parents": [ "a810851df46b02fa3403c0b304d90fa3eb4dad33" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Apr 13 21:19:41 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 17 18:11:30 2017 +0000" }, "message": "Identity trust rbac tests\n\nAdd identity trust rbac tests corresponding to the policy actions\nin [0].\n\nMost of the policy actions in [0] have a rule of \u0027\u0027 (empty string),\nmeaning any role can perform the action. However, the\n\"identity:create_trust\" policy action has a rule of\nbase.RULE_TRUST_OWNER which translates to:\n\n user_id:%(trust.trustor_user_id)s [1].\n\nThis is a rather unique rule, one that is not dependent on the\ncurrent user\u0027s user_id, project_id or even role. Rather, this\nrule translates to: \"Does the current user\u0027s user_id match\nthe user_id of the trustor creating a trust with a trustee?\"\n\nAs should be expected, \"trust.trustor_user_id\" can only be\ndynamically calculated at runtime, rather than immediately\nretrieved from a tempest credential variable, as is the case\nwith user_id and project_id.\n\nHence, this patch not only 1) creates trust rbac tests but 2)\nenhances the framework, particularly the rbac_rule_validation\ndecorator, as well as the rbac_policy_parser framework, to\nhandle additional target data that must be passed to\noslo-policy-checker in order for proper authorization\ndetermination.\n\nThe \"target\" parameter in oslo.policy is a dictionary that\ncontains \"As much information about the object being\noperated on as possible\" [2]. Accordingly, the\nrbac_rule_validation decorator has been enhanced with a new\nparam called `extra_target_data` that is a dictionary\ncontaining key-value pairs of dynamically calculated\ndata needed by oslo.policy to correctly determine whether\nthe \"target\" has authorization to perform a policy action.\n\nFor example,\n\n extra_target_data\u003d{\n \"trust.trustor_user_id\": \"os.auth_provider.credentials.user_id\"\n })\n\nmeans that trust.trustor_user_id equals the primary credential\u0027s\nuser_id. So, if a trustor\u0027s user_id equals the primary credential\u0027s\nuser_id, then the policy parser will return True for `is_allowed`.\nHowever, if a trustor\u0027s user_id doesn\u0027tequal to the primary credential\u0027s\nuser_id, but rather the alt credential\u0027s user_id, say, then `is_allowed`\nreturns False.\n\nThus, the only way to do negative testing with test_trusts_rbac is\nto explicitly create a negative test, as described in the above\nparagraph, which is what this patch does. Normally, negative testing\nis baked in, dependent on the `rbac_test_role`, but with more\ncomplicated policy enforcement as described above, this is not\npossible.\n\nWhile it is possible to create a new CONF value called trustor_user_id,\nit would require using pre-provisioned credentials, which is something\nPatrole doesn\u0027t explicitly use.\n\n[0] https://github.com/openstack/keystone/blob/master/keystone/common/policies/trust.py\n[1] https://github.com/openstack/keystone/blob/master/keystone/common/policies/base.py\n[2] https://docs.openstack.org/developer/oslo.policy/api/oslo_policy.html\n\nDepends-On: Ib82e8b8a0d6c8587fb0b1ce415e751c3ebc3c2f9\nChange-Id: I5c00fdb345556066343bdaeb5f008d639a94bc4b\n" }, { "commit": "a810851df46b02fa3403c0b304d90fa3eb4dad33", "tree": "d7a0ea102bc22cf5b4ce1648c52694a07428b5c8", "parents": [ "4fc9a6b4bcbad1df306a7f08f84860e5abe22213" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Fri Apr 14 14:33:09 2017 -0400" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Apr 15 01:14:00 2017 +0100" }, "message": "Add capabilities and scheduler stats tests\n\nAdds RBAC tests for the capabilities and scheduler stats clients.\n\nChange-Id: I08bf2539eff08e77c37b83b98da853da71c76f52\n" }, { "commit": "4fc9a6b4bcbad1df306a7f08f84860e5abe22213", "tree": "c45eed6dd8c55c8a7ba0ed97ca8ce603c658c861", "parents": [ "16e6d4b9fefc9177b05df0f93fd6cf97567bc1ec", "6a99c56bb4e28f4c6984b8c3a9c2d3afdb544791" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu Apr 13 22:20:49 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu Apr 13 22:20:49 2017 +0000" }, "message": "Merge \"Remove admin namespace throughout Patrole - Identity tests\"" }, { "commit": "16e6d4b9fefc9177b05df0f93fd6cf97567bc1ec", "tree": "a5f6856a6fe5b943ae96307f2a1d6cac807e8071", "parents": [ "4d14c699fdc0bcf02ee82d06cb847a32e2773e39", "94c1cc61b8c7404f05372e8af48a2e5d1bd711ac" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Apr 11 20:15:55 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Apr 11 20:15:55 2017 +0000" }, "message": "Merge \"Add RBAC tests for namespace_tags_client.\"" }, { "commit": "4d14c699fdc0bcf02ee82d06cb847a32e2773e39", "tree": "50947e9e615db740f4307fe8fcc7862f9880bcf7", "parents": [ "40ca06d7dbfd6173a5476bf04bf90963b4a5bfd1", "706fd34fcc75bba9dc868b9566f50ffa4fa9e940" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Apr 11 17:09:35 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Apr 11 17:09:35 2017 +0000" }, "message": "Merge \"Remove admin namespace throughout Patrole - Volume tests\"" }, { "commit": "94c1cc61b8c7404f05372e8af48a2e5d1bd711ac", "tree": "6ffe7fdb9b868ec72d0fde96802835d47b1f758b", "parents": [ "40ca06d7dbfd6173a5476bf04bf90963b4a5bfd1" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 11 16:38:45 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 11 16:41:48 2017 +0100" }, "message": "Add RBAC tests for namespace_tags_client.\n\nAdds RBAC tests for all the endpoints in namespace_tags_client\nexcept for\n\n 1) delete_namespace_tag\n 2) delete_namespace_tags\n\nbecause Glance does not currently do policy enforcement for them [0]\n(the policy actions are even missing from the policy.json).\n\nThis patch also removes invalid occurrences of CONF and LOG\nthroughout Patrole image tests, and renames a few incorrectly\nnamed image test files.\n\nPartially-Implements blueprint: initial-tests-image\n\n[0] https://github.com/openstack/glance/blob/master/etc/policy.json\n\nChange-Id: I15be44d50886b8f500d640b67563504287767d91\n" }, { "commit": "40ca06d7dbfd6173a5476bf04bf90963b4a5bfd1", "tree": "b75523e5d38dcaffde078f588f3d5210aa816361", "parents": [ "4d6264c2cc341dce889f97b59bad6ee9ff707bcf", "9909ac6d33f54f6a8487757d653e232ffc759dad" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Apr 11 13:42:37 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Apr 11 13:42:37 2017 +0000" }, "message": "Merge \"Remove admin namespace throughout Patrole - Nova tests\"" }, { "commit": "6a99c56bb4e28f4c6984b8c3a9c2d3afdb544791", "tree": "e106a063732cee11d0ba27c66f988beeff59f5c9", "parents": [ "083eb7cfd6fc8952e57745e49ee68dbe63e5c50f" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Apr 08 19:13:55 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 10 23:45:03 2017 +0100" }, "message": "Remove admin namespace throughout Patrole - Identity tests\n\nIn Tempest, it is meaningful to separate admin and non-admin\ntests into different classes and files, because Tempest\nmust use clients with admin credentials to perform admin-only\nAPI calls, like changing an admin password. More specifically,\nTempest must use the os_adm/os_admin-namespace clients\n(instantiated with admin credentials) to perform these tests;\nelse 403s are thrown.\n\nPatrole, on the other hand, doesn\u0027t need to use\nos_adm/os_admin-namespace clients, because of the fact that\nrole-switching is performed to grant the os-namespace\nclients sufficient credentials to perform API actions that\nrequire admin credentials during setting up and cleaning up\ntest resources. Thus, the distinction between admin and\nnon-admin is not important in Patrole, as role-switching\nmeans that at different points in time the clients have admin\nand non-admin credentials.\n\nThus, all namespaces (files, folders and classes) that contain\n\"admin\" should be renamed, if the non-admin version does not\nalready exist. If the admin version and non-admin version\ntests both exist, then the admin version should be removed and\nits tests merged with the non-admin version.\n\nThis patch, in addition, adds additional tests to test_rbac_roles:\nsome identity:check_grant tests were missing. Following tests\nwere added:\n 1) Checking user role on domain\n 2) Checking group role on project\n 3) Checking group role on domain\n\nChange-Id: Ib82e8b8a0d6c8587fb0b1ce415e751c3ebc3c2f9\nPartial-Bug: #1672250\n" }, { "commit": "4d6264c2cc341dce889f97b59bad6ee9ff707bcf", "tree": "72a0c1d2365be99d4cb93ffaf6815ab4839cf408", "parents": [ "1a2784bdffbe292da9e929ecedd166f9d7a6f0e7" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 10 16:52:06 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 10 18:52:27 2017 +0000" }, "message": "Fix non-existent cinder policy action tests.\n\nThe current policy actions are invalid as they are not included\nin Cinder\u0027s policy.json [0] and are not enforced by Cinder\u0027s\npolicy enforcement system:\n\n - volume:list_extensions\n - volume_extension:get_volumes_image_metadata\n - volume:availability_zone_list\n - volume:get_volume_image_metadata\n\nSome of these are incorrectly spelled:\n - volume:get_volume_image_metadata \u003d\u003e volume:get_snapshot_metadata\n - volume_extension:get_volumes_image_metadata \u003d\u003e\n volume_extension:volume_image_metadata\n\nSome of these are not enforced at all so have been removed:\n - volume:list_extensions\n - volume:availability_zone_list\n\nSome of these are not as granular (but are not being changed due\nto their being fixed in Related-Change):\n - volume_extension:qos_specs_manage:\u003ccreate/update/delete/read\u003e \u003d\u003e\n volume_extension:qos_specs_manage\n\n[0] https://github.com/openstack/cinder/blob/master/etc/cinder/policy.json\n\nChange-Id: I2d3fcdb38126df4df4e2ffe78acec7cefeba8ea3\nRelated-Change: I1ca996e968a273b989bea0bf3c54b47349ca47fe\nCloses-Bug: #1677026\n" }, { "commit": "9909ac6d33f54f6a8487757d653e232ffc759dad", "tree": "233259234cb242ef9b7e024d6c45d8c6fc42d310", "parents": [ "083eb7cfd6fc8952e57745e49ee68dbe63e5c50f" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Apr 07 21:12:36 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 10 18:51:47 2017 +0000" }, "message": "Remove admin namespace throughout Patrole - Nova tests\n\nIn Tempest, it is meaningful to separate admin and non-admin\ntests into different classes and files, because Tempest\nmust use clients with admin credentials to perform admin-only\nAPI calls, like changing an admin password. More specifically,\nTempest must use the os_adm/os_admin-namespace clients\n(instantiated with admin credentials) to perform these tests;\nelse 403s are thrown.\n\nPatrole, on the other hand, doesn\u0027t need to use\nos_adm/os_admin-namespace clients, because of the fact that\nrole-switching is performed to grant the os-namespace\nclients sufficient credentials to perform API actions that\nrequire admin credentials during setting up and cleaning up\ntest resources. Thus, the distinction between admin and\nnon-admin is not important in Patrole, as role-switching\nmeans that at different points in time the clients have admin\nand non-admin credentials.\n\nThus, all namespaces (files, folders and classes) that contain\n\"admin\" should be renamed, if the non-admin version does not\nalready exist. If the admin version and non-admin version\ntests both exist, then the admin version should be removed and\nits tests merged with the non-admin version.\n\nChange-Id: I4bc55c7e1c8b7391fb11baf35987ace1c4080ef1\nPartial-Bug: #1672250\n" }, { "commit": "1a2784bdffbe292da9e929ecedd166f9d7a6f0e7", "tree": "8a3b146d201007eec7f530334f4377a22c449e26", "parents": [ "15293514aeea518060fb656414db18881004d8e2", "ba4881b06bcf3293426f8f1efc4b26181c59a1bf" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon Apr 10 17:47:25 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon Apr 10 17:47:25 2017 +0000" }, "message": "Merge \"Fix _validate_switch_role throwing incorrect error message\"" }, { "commit": "706fd34fcc75bba9dc868b9566f50ffa4fa9e940", "tree": "a6f3f47c07b15462bfc87c5927d25d4f96004ae8", "parents": [ "083eb7cfd6fc8952e57745e49ee68dbe63e5c50f" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Apr 08 19:31:04 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 10 18:27:50 2017 +0100" }, "message": "Remove admin namespace throughout Patrole - Volume tests\n\nIn Tempest, it is meaningful to separate admin and non-admin\ntests into different classes and files, because Tempest\nmust use clients with admin credentials to perform admin-only\nAPI calls, like changing an admin password. More specifically,\nTempest must use the os_adm/os_admin-namespace clients\n(instantiated with admin credentials) to perform these tests;\nelse 403s are thrown.\n\nPatrole, on the other hand, doesn\u0027t need to use\nos_adm/os_admin-namespace clients, because of the fact that\nrole-switching is performed to grant the os-namespace\nclients sufficient credentials to perform API actions that\nrequire admin credentials during setting up and cleaning up\ntest resources. Thus, the distinction between admin and\nnon-admin is not important in Patrole, as role-switching\nmeans that at different points in time the clients have admin\nand non-admin credentials.\n\nThus, all namespaces (files, folders and classes) that contain\n\"admin\" should be renamed, if the non-admin version does not\nalready exist. If the admin version and non-admin version\ntests both exist, then the admin version should be removed and\nits tests merged with the non-admin version.\n\nDepends-On: I8c3944e766210a31aa684e29c45e39470b738640\nChange-Id: I417fa0d29fc06b04582cdac24608b0373db6aacb\nPartial-Bug: #1672250\n" }, { "commit": "ba4881b06bcf3293426f8f1efc4b26181c59a1bf", "tree": "baab53119f2d778fc6fb5502595059fb7b027a1f", "parents": [ "083eb7cfd6fc8952e57745e49ee68dbe63e5c50f" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Apr 09 02:11:25 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Mon Apr 10 00:09:54 2017 +0000" }, "message": "Fix _validate_switch_role throwing incorrect error message\n\nCurrently, if switch_role in rbac_utils is not called correctly\n(or not at all), then a role switch error is thrown. It is only\nnot thrown if a skip exception is currently being handled--that is,\nif the test is skipped, then the validation is ignored.\n\nHowever, this logic is not entirely correct. For example, when\nan unexpected error is thrown, like an AttributeError, then the\nvalidation check fails, and so a role switch error is thrown -- when\ninstead the AttributeError should be thrown instead.\n\nThis patch changes the behavior of _validate_switch_role to only\nthrow a switch role error if no other exception is currently\nbeing handled.\n\nChange-Id: I8c3944e766210a31aa684e29c45e39470b738640\n" }, { "commit": "15293514aeea518060fb656414db18881004d8e2", "tree": "3b2de43f648f45e41ddf7288de414a72872e1d01", "parents": [ "083eb7cfd6fc8952e57745e49ee68dbe63e5c50f" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Apr 09 02:08:02 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Apr 09 02:08:02 2017 +0100" }, "message": "Fix rbac_rule_validation test being incorrectly skipped\n\nUnit tests should not be skipped. Currently, however, the test\ntest_invalid_policy_rule_throws_parsing_exception is being skipped,\nbecause after strict_policy_check was introduced [0], a skip\nexception is thrown (when strict_policy_check is False, which it\nis by default), instead of an \"actual\" exception.\n\nThus, the test was being skipped incorrectly.\n\nThis patch fixes that by overriding strict_policy_check in\nthe test to be True.\n\n[0] https://review.openstack.org/#/c/449340/\n\nChange-Id: I95b4150ebaf729ff8d0e1569ba591b8275779aa8\n" }, { "commit": "083eb7cfd6fc8952e57745e49ee68dbe63e5c50f", "tree": "bb5393831239baac384bc0c003d4a3f4beb1204b", "parents": [ "a7409cf1b4a654d2d21ab6d55fb50534be4062dd", "75f2363601d1812fbade748ac28e487e148f09fc" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Fri Apr 07 20:02:36 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Fri Apr 07 20:02:36 2017 +0000" }, "message": "Merge \"Renames switchToRbacRole to toggle_rbac_role\"" }, { "commit": "75f2363601d1812fbade748ac28e487e148f09fc", "tree": "81737bdfcb88aecf1386c281b802fbf111a49454", "parents": [ "5ad0fec679aeabf32ddbee7264dc20c9022c2106" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Apr 07 15:56:26 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Apr 07 16:56:57 2017 +0000" }, "message": "Renames switchToRbacRole to toggle_rbac_role\n\nThis is a trivial change that renames switchToRbacRole to\ntoggle_rbac_role.\n\nThis change is needed because:\n - switchToRbacRole is camel case which is inconsistent with\n all the snake-case variables names throughout Patrole and\n OpenStack\n - It violates Python\u0027s naming conventions [0].\n\n[0] See pep8 styling guideline:\n\n\"Function names should be lowercase, with words separated\nby underscores as necessary to improve readability. mixedCase\nis allowed only in contexts where that\u0027s already the prevailing\nstyle.\"\n\nAnd for variable names:\n\n\"Use the function naming rules: lowercase with words separated\nby underscores as necessary to improve readability.\"\n\nChange-Id: Ib6dd50ba02c25d585e2ca0c9383771f9337212b8\nDepends-On: Ie1c4b6a2801f10c8e83f6d3f88fe0364d69317fa" }, { "commit": "a7409cf1b4a654d2d21ab6d55fb50534be4062dd", "tree": "d97315cc4a69c687c88938b5010c369311def800", "parents": [ "5ad0fec679aeabf32ddbee7264dc20c9022c2106" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Apr 07 17:52:05 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Apr 07 17:54:29 2017 +0100" }, "message": "Fix volume transfers rbac test\n\nFollowing recent change in Tempest [0], volume transfers\nfunctionality has been moved out of volumes client into a volume\ntransfers client.\n\nThis patch makes the appropriate change in Patrole to work\nwith the new change to Tempest.\n\n[0] https://review.openstack.org/#/c/438006/\n\nChange-Id: Ie1c4b6a2801f10c8e83f6d3f88fe0364d69317fa\nRelated-Change: Ia85bcfbadbff4f7c594dc5631ecdd595c5d275f3\n" }, { "commit": "5ad0fec679aeabf32ddbee7264dc20c9022c2106", "tree": "3368ff04dffc4e2834fa0265822296d267d9d361", "parents": [ "b486134f03aab5c039e613094fe240bbdad0990d", "7aae506e692a69ccdc18ce95fc2d7f3644048929" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu Apr 06 22:59:05 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu Apr 06 22:59:05 2017 +0000" }, "message": "Merge \"Fix test_migration_live throwing AttributeError.\"" }, { "commit": "44e7ac93e815cd28aa93cd807e369d21553a7692", "tree": "82d7d28e046787bacc1ee671e12b0ed16ab450a6", "parents": [ "f01a48fb95753b79c2bd59a08b07cdc1cef94044", "b83861ca068ac163a2f8817a7bfa46644b6f11e1" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Apr 05 22:14:55 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Apr 05 22:14:55 2017 +0000" }, "message": "Merge \"Add RBAC tests for the Nova images API.\"" }, { "commit": "f01a48fb95753b79c2bd59a08b07cdc1cef94044", "tree": "ad43fe7975fbc5be6387cca1fe004d964d64e4a9", "parents": [ "3cc966f093dbc8db2ca7c99cb52b74c0cfd51af4" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 05 21:27:54 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 05 20:30:38 2017 +0000" }, "message": "RBAC test for compute os-multinic policy action.\n\nThe \u0027addFixedIp\u0027 action is used in this test case,\nwhich adds a fixed IP to the server instance, but\nthereby causes os_compute_api:os-multinic to be enforced [0].\n\n[0] https://github.com/openstack/nova/blob/4f91ed3a547965ed96a22520edcfb783e7936e95/nova/api/openstack/compute/multinic.py\n\nCo-Authored-By: Michael Sliem \u003cms272s@att.com\u003e\nCo-Authored-By: Rao Adnan Khan \u003crk221s@att.com\u003e\n\nPartially-Implements: blueprint initial-tests-compute\nChange-Id: Ic2e0efb4416255d9dcae1021c78955f60c85ba61\n" }, { "commit": "b83861ca068ac163a2f8817a7bfa46644b6f11e1", "tree": "c6331d28310b1ba33dd555fbd9e1abdcfcdb7c57", "parents": [ "62252fd8c2366ba6e2dc51e8750f2f0fa6c526d4" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 05 17:00:01 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 05 20:18:58 2017 +0000" }, "message": "Add RBAC tests for the Nova images API.\n\nThese APIs are proxy calls to the Image service. Consequently, no nova\npolicy actions are enforced; instead, only glance policy actions are\nenforced. As such, these tests check that only glance policy actions are\nexecuted.\n\nIn addition, these tests will fail with a 404 starting from microversion\n2.36 onward, so max_microversion is set to 2.35.\n\nFinally, this patch removes CONF from test_agents_rbac and updates\nan error message.\n\nCo-Authored-By: Samantha Blanco \u003csamantha.blanco@att.com\u003e\nChange-Id: I16677bf17a61caf9ba8c03d8dc4fda8c5f90d078\n" }, { "commit": "3cc966f093dbc8db2ca7c99cb52b74c0cfd51af4", "tree": "28341f2291cc79771f06ee4f502b11a3b70691d5", "parents": [ "5cc41329774bb99f6dc4cecb580555066b86d68d", "aa1953000a080abf68c04fad4732d7b0889903c0" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Apr 05 17:57:25 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Apr 05 17:57:25 2017 +0000" }, "message": "Merge \"Add implied roles rbac tests to identity v3.\"" }, { "commit": "5cc41329774bb99f6dc4cecb580555066b86d68d", "tree": "b45953156b3ad315658cfd369158e2b0b3ff8335", "parents": [ "62252fd8c2366ba6e2dc51e8750f2f0fa6c526d4", "fa01d5f4e8a151b582397b17688505a8f0ac71d9" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Wed Apr 05 17:41:52 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Wed Apr 05 17:41:53 2017 +0000" }, "message": "Merge \"Add role-switching validation to Patrole framework.\"" }, { "commit": "aa1953000a080abf68c04fad4732d7b0889903c0", "tree": "3017bb051ea987eb7cabaaeaa229329af9d9efe0", "parents": [ "62252fd8c2366ba6e2dc51e8750f2f0fa6c526d4" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Mar 31 05:06:21 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Apr 05 16:38:20 2017 +0000" }, "message": "Add implied roles rbac tests to identity v3.\n\nAdd implied roles rbac tests to identity v3. These tests cover the\nAPIs in OS-INHERIT API.\n\nPartially-Implements: blueprint initial-tests-identity\nDepends-On: I9d6c0dc83a85bbca173b753183d838adfee04008\nChange-Id: I3f64751a5e68924ec27aaee4cb4a91596b404a69\n" }, { "commit": "7aae506e692a69ccdc18ce95fc2d7f3644048929", "tree": "11c805d8ef77ccdc61eb9f5f799725c0628e38e7", "parents": [ "90c7eef9cdd090f1f2afbe5aab66f56952c48ecf" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 04 21:48:51 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 04 21:48:51 2017 +0100" }, "message": "Fix test_migration_live throwing AttributeError.\n\nThis patch fixes test_migration_live, which currently throws\nan AttributeError, because self.block_migration is undefined.\n\nThis patch sets self.block_migration \u003d \u0027auto\u0027 and the minimum\nmicroversion to 2.25, which is when the block_migration\nkwarg for live_migrate_server can be set to auto, so that nova\ncan decide the value of block_migration during live migration [0].\n\n[0] https://developer.openstack.org/api-ref/compute/?expanded\u003dlive-migrate-server-os-migratelive-action-detail\n\nChange-Id: I82572d9418901070d6925723241e5aabe0aeae8d\n" }, { "commit": "e34cae02dffba101a0437ce6e8a2cb2e6ecc080f", "tree": "b88cc40c63f031a7d46002ff2f32ee423cb4829d", "parents": [ "a585f56bdbc738093002fac3f5b6a81230e29742", "f512433299b78e837201940439dd1df45f9f5afc" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Apr 04 17:24:37 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Apr 04 17:24:37 2017 +0000" }, "message": "Merge \"Identity V3 (ext) Tests - Oauth Consumers\"" }, { "commit": "fa01d5f4e8a151b582397b17688505a8f0ac71d9", "tree": "69a8b9b28735570fbe551bec047c2caa8bbfd53a", "parents": [ "934acae7a18fd7e368421319723333b5a30420b6" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Apr 01 06:18:25 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Apr 04 18:02:26 2017 +0100" }, "message": "Add role-switching validation to Patrole framework.\n\nCurrently, no role validation is performed when calling switch_role. This\nis problematic for the following reasons:\n - The only \"validation\" right now checks whether switchToRbacRole is None.\n If so, None is returned. The validation used is nowhere near as robust\n as it should be -- what if a string or int is passed in? -- and an error\n should be thrown instead of silently returning None.\n - If switch_role is called with the same boolean value twice, then the\n rbac_role under test is never switched to: this should be detected\n and flagged as an error.\n - If switch_role is not called in a test, then an error should definitely\n be thrown as well, because then the test may pass as a false positive.\n\nThis patch adds role validation so that the above cases are avoided.\n\nThis patch also updated unit tests and added additional ones\nwhere needed.\n\nImplements: blueprint add-switch-role-validation\nChange-Id: Ida0f03af236eb0f91d8cc96d51ca57671b4eef7c\n" }, { "commit": "f512433299b78e837201940439dd1df45f9f5afc", "tree": "ffddcb24a1b3941a395efb6d4d32afbfb5cd5c84", "parents": [ "ae2ebab27c11e2925be3a2a65758e48a08dfa484" ], "author": { "name": "Nicolas Helgeson", "email": "nh202b@att.com", "time": "Wed Mar 15 16:42:27 2017 -0700" }, "committer": { "name": "Nicolas Helgeson", "email": "nh202b@att.com", "time": "Tue Apr 04 15:31:23 2017 +0000" }, "message": "Identity V3 (ext) Tests - Oauth Consumers\n\nTests for identity v3 extension oauth consumers\nRequires missing Oauth Consumers Client (missing from tempest)\n\nCo-Authored-By: Kaustuv Royburman (kr336r@us.att.com)\nPartially-Implements bp: initial-tests-identity\n\nChange-Id: Ifcca3a127d8ed7811521189077ce428f656806fa\nDepends-On: I6d0884637cfe00a5313a5d019e1e062316f76d57\n" }, { "commit": "a585f56bdbc738093002fac3f5b6a81230e29742", "tree": "097f36a41d209186cfb6b4e478211c22572e612c", "parents": [ "90c7eef9cdd090f1f2afbe5aab66f56952c48ecf", "fb185791f96051fbdfeed15edd79d6eae7444f64" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Apr 04 14:20:29 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Apr 04 14:20:29 2017 +0000" }, "message": "Merge \"Add role assignments rbac tests to identity v3.\"" }, { "commit": "fb185791f96051fbdfeed15edd79d6eae7444f64", "tree": "d299aa125da516cffdfb64770e9fffed649ebdff", "parents": [ "934acae7a18fd7e368421319723333b5a30420b6" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Apr 01 05:33:50 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sun Apr 02 16:40:24 2017 +0100" }, "message": "Add role assignments rbac tests to identity v3.\n\nAdd role assignments rbac tests to identity v3. These\ntests cover the policy actions here [0]:\n - identity:list_role_assignments\n - identity:list_role_assignments_for_tree\n\n[0] https://github.com/openstack/keystone/blob/master/keystone/common/policies/role_assignment.py\n\nChange-Id: I7bdeedf51f77ba008dbad74c32c668eb0cab8aac\nPartially-Implements: blueprint initial-tests-identity\n" }, { "commit": "78b192553a9a51db1d4a53de893a7134d96a3303", "tree": "19e84792cdc2b0d3f8091e5d545e8840281f9dea", "parents": [ "934acae7a18fd7e368421319723333b5a30420b6" ], "author": { "name": "Jeremy Liu", "email": "liujiong@gohighsec.com", "time": "Sat Apr 01 16:19:09 2017 +0800" }, "committer": { "name": "Jeremy Liu", "email": "liujiong@gohighsec.com", "time": "Sun Apr 02 06:50:04 2017 +0000" }, "message": "Fix check-uuid not working\n\n\u0027check-uuid\u0027 and \u0027check-uuid --fix\u0027 are not working because we do not\nset package name for them. This patch fixes that.\n\nChange-Id: I553c364e3fc0d640620a01046dd7f70bdb704be2\nCloses-Bug: #1678407\n" }, { "commit": "934acae7a18fd7e368421319723333b5a30420b6", "tree": "817db1392468fe1852a6fdfbaa9a1cbf9b62356d", "parents": [ "6da4d213ae22fb38604b91a941189f4c50b551a9" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Mar 31 18:32:55 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Mar 31 19:19:56 2017 +0000" }, "message": "Refactor identity v3 rbac_base to use classmethods.\n\nCurrently, identity v3 rbac_base uses self.addCleanup to do cleanup\nfor the resources it creates. But this locks the tests into using\nonly test-level resources. This is inefficient. Instead,\nclass-level resources should be used wherever possible.\n\nThis patch changes the identity v3 rbac_base to create class-level\nresources, that are then set up in resource_setup and cleaned up\nin resource_cleanup.\n\nThis patch also refactors test_roles_rbac in identity v3 to work\nwith these changes.\n\nChange-Id: I80f56464a9391e0e41548b266e9b748bf961e1b6\n" }, { "commit": "6da4d213ae22fb38604b91a941189f4c50b551a9", "tree": "56c089d964ed026cf61c817de13603af76321993", "parents": [ "ae2ebab27c11e2925be3a2a65758e48a08dfa484" ], "author": { "name": "Nicolas Helgeson", "email": "nh202b@att.com", "time": "Tue Mar 07 15:58:08 2017 -0800" }, "committer": { "name": "Nicolas Helgeson", "email": "nh202b@att.com", "time": "Thu Mar 30 12:57:15 2017 -0700" }, "message": "Identity V3 Tests - Roles\n\nTests for identity v3 roles\n\nPartially-Implements bp: initial-tests-identity\nDepends-On: I4e28de9ab106239b3926634591ce4a550f108a3e\n\nChange-Id: Id6652b195ae4e32ec2404d2bbd183e81ec605bca\nCo-Authored-By: Nishant Kumar \u003cnk613n@att.com\u003e\n" }, { "commit": "ae2ebab27c11e2925be3a2a65758e48a08dfa484", "tree": "b04a00cfb99d26a154d496658ab24e5262d6c07d", "parents": [ "d4a4aa674b1e2682689ac51d2782b67496108a67" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Mar 23 22:49:06 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Mar 29 19:07:52 2017 +0000" }, "message": "Modify policy parser to combine custom and default policy files.\n\nCurrently, the rbac policy parser file tries to:\n 1) Read the custom policy file if it exists\n 2) Otherwise check if the default policy file exists in code\n\nThe problem with this approach is:\n - What if the custom policy file does not specify all policy actions?\n This is problematic when it comes to validating the policy action:\n is it defined or not?\n - This also holds true for default policy files which may not define\n all the policy actions enforced by the service explicitly.\n\nThis patch partially fixes this issue by 1) using all the\ndefault policy actions defined in code, if they exist and 2)\noverwriting any default policy actions with the custom\npolicy actions provided by the user in a custom policy file.\n\nThe end result is that the Patrole framework uses as many policy actions\nas possible for reference, while using as many custom-defined policy\nactions as possible. This patch, therefore, makes it more feasible to\nthrow an exception if a policy action is invalid.\n\nChange-Id: Idb6b8a99170fd32097940d5b23182f5e43956548\nDepends-On: I7feb522b2ea5f56e48982169c7ebbb2ec2ef2cb3\n" }, { "commit": "d4a4aa674b1e2682689ac51d2782b67496108a67", "tree": "86732423bd3214b40e7c7153ebb787c1c484d7d9", "parents": [ "696be11bd3eadc550132a850ab7ea66b9c4cb1ea" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Mar 28 16:50:05 2017 +0100" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Mar 28 19:27:57 2017 +0100" }, "message": "Add heat resource types rbac tests.\n\nImplements RBAC tests for the following policy actions:\n - stacks:list_resource_types\n - stacks:generate_template\n - stacks:resource_schema\n\nCo-Authored-By: Avishek Dutta \u003cad620p@att.com\u003e\nCo-Authored-By: Anthony Bellino \u003cab2434@att.com\u003e\nCo-Authored-By: Rick Bartra \u003crb560u@att.com\u003e\n\nChange-Id: If4f0ec3b5fe1ebb66c42652e8dee9dda8089bb42\nPartially-Implements: blueprint initial-tests-orchestration\n" }, { "commit": "696be11bd3eadc550132a850ab7ea66b9c4cb1ea", "tree": "5c0f3dadad2feb44fbb5f266526ee5f7e24215d4", "parents": [ "75feb83f3f80ee9fd65e878bea634887620c3847", "ee0205d4cc254199363e6c6252042a361a0183a3" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Tue Mar 28 15:01:02 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Tue Mar 28 15:01:02 2017 +0000" }, "message": "Merge \"Compute API Compute Flavor Rxtx Test.\"" }, { "commit": "ee0205d4cc254199363e6c6252042a361a0183a3", "tree": "11cbf2a3a35edd085cac4d99dad7b593cb0b357f", "parents": [ "8141149e557a9e43443d38848ccd33d6591bac5c" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Feb 16 17:16:50 2017 -0500" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Tue Mar 28 02:43:28 2017 +0100" }, "message": "Compute API Compute Flavor Rxtx Test.\n\nAdds test for compute flavor rxtx policy action [1].\n\n[1] https://github.com/openstack/nova/blob/4f91ed3a547965ed96a22520edcfb783e7936e95/nova/api/openstack/compute/flavor_rxtx.py\n\nChange-Id: I0095e068079ab27482ad196209ee4d9270227d47\n" }, { "commit": "75feb83f3f80ee9fd65e878bea634887620c3847", "tree": "578801d7819b9610686e79071cf3abf8bc7d9979", "parents": [ "cd2b03fcec99fc32c247951ab85c0c78708de468", "0d88008a1ec99474b48c58856d6015a8a97ae6e0" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon Mar 27 19:51:55 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon Mar 27 19:51:55 2017 +0000" }, "message": "Merge \"Improve Patrole config options\"" }, { "commit": "cd2b03fcec99fc32c247951ab85c0c78708de468", "tree": "432be72936e752af7546a15b47fa2bdb3369b37b", "parents": [ "dcddd6e4f204a6df6a17b7768edb3d51a639b197", "06e3bc687028ff0dbcce7d21b2ae3b73b29b2397" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Mon Mar 27 18:35:00 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Mon Mar 27 18:35:00 2017 +0000" }, "message": "Merge \"Tag additional slow tests to run in slow gate.\"" }, { "commit": "06e3bc687028ff0dbcce7d21b2ae3b73b29b2397", "tree": "cfba044d133e3c6d811a3f28d97cd803ec30eb0a", "parents": [ "e28d4ddb53d7df6cea5a488f1aa7f5ff18cbbefa" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Mar 24 20:40:31 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Sat Mar 25 19:19:21 2017 +0000" }, "message": "Tag additional slow tests to run in slow gate.\n\nThis patch tags additional slow tests with @test.attr(type\u003d\u0027slow\u0027)\nso that they can run in the slow gate.\n\nThese tests are:\n - test_migration_live\n - test_cold_migration\n - test_volume_backup_create\n - test_volume_backup_get\n - test_volume_backup_restore\n - test_volume_backup_delete\n - test_detach_volume_to_instance\n\nChange-Id: I45de98c301af560cd2bdae33daaaec50ed26132d\n" }, { "commit": "dcddd6e4f204a6df6a17b7768edb3d51a639b197", "tree": "d3de81b38efdb411844bb8289cb5fec9b7968e0f", "parents": [ "e28d4ddb53d7df6cea5a488f1aa7f5ff18cbbefa" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Mar 24 19:43:33 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Mar 24 19:48:19 2017 +0000" }, "message": "Network tests should take advantage of net_utils to find unused ip.\n\nCurrently, test_create_router_external_fixed_ips fails [0] for the\nsame reason described in this patch [1].\n\nBasically, calling random.choice to select an ip address from\nan allocation pool can potentially select an already-used ip\naddress, resulting in an error.\n\nThe best way to resolve such issues is to use the built-in\nTempest helper function `get_unused_ip_addresses` defined\nhere [2].\n\nThis patch makes the necessary changes to the code in [1] and\nto test_routers_rbac as well.\n\n[0] http://logs.openstack.org/03/448603/7/check/gate-tempest-dsvm-patrole-admin-fast-ubuntu-xenial-nv/2bb077f/console.html\n[1] https://review.openstack.org/#/c/448250/\n[2] https://github.com/openstack/tempest/blob/master/tempest/common/utils/net_utils.py\n\nChange-Id: I9bbb7cd77cde9287e398f506de58ff23e9e95496\nCloses-Bug: #1675342\n" }, { "commit": "e28d4ddb53d7df6cea5a488f1aa7f5ff18cbbefa", "tree": "4fe24d15646cc8a111a9d14a3a9665f19b15988a", "parents": [ "8141149e557a9e43443d38848ccd33d6591bac5c", "8eda8cc284991bf97517e1e1d67d42f73db8f8da" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Fri Mar 24 19:29:52 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Fri Mar 24 19:29:52 2017 +0000" }, "message": "Merge \"Refactors exceptions in rbac_rule_validation decorator.\"" }, { "commit": "0d88008a1ec99474b48c58856d6015a8a97ae6e0", "tree": "839780a26e5fbb6ba98109651b712ada9cc92e10", "parents": [ "8141149e557a9e43443d38848ccd33d6591bac5c" ], "author": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Thu Mar 23 18:14:37 2017 -0400" }, "committer": { "name": "Samantha Blanco", "email": "samantha.blanco@att.com", "time": "Fri Mar 24 14:45:18 2017 -0400" }, "message": "Improve Patrole config options\n\n- Renames \"rbac_flag\" to \"enable_rbac\"\n- Creates \"strict_policy_check\" option\n- Resolves bug where policy not in policy.json\n would pass RBAC test, leading to false test\n results\n\nChange-Id: I76429e6cb0ed4cad154a07b7a873fd23209da674\nCloses-Bug: #1673626\n" }, { "commit": "8eda8cc284991bf97517e1e1d67d42f73db8f8da", "tree": "cfc4f1266668a853a44d7a026f8840efc8178de0", "parents": [ "c0c31404ba001ebaad6afed81045d28dcb7d5410" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Mar 22 14:15:14 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Fri Mar 24 15:50:19 2017 +0000" }, "message": "Refactors exceptions in rbac_rule_validation decorator.\n\nCurrently, rbac_rule_validation decorator repeats code\nunderneath \"except expected_exception\" and \"except RbacActionFailed\".\nThese 2 blocks of code can be merged by using a tuple that\ncontains both of these exceptions on 1 line.\n\nThis patch makes the above change. It also adds a new exception\nblock for a wildcard exception. If a 404 is expected but a 403 is\nthrown, the 403 is caught and an error message saying that the\nexpected error code differs from the one caught is then re-raised.\nThat is, a more informative error message is thrown than\notherwise would be.\n\nThis patch finally improves upon rbac_rule_validation unit tests by:\n - removing redundant tests\n - renames tests to make them more understandable\n - adds docstrings to each tests to make them more understandable\n\nChange-Id: Idea4a45f721893c997acbfb2a1beb978ccfe11e6\n" }, { "commit": "6c204ecee475de3c906d88fd03def634feb74c0c", "tree": "6aa6ab4b32c985b02e68a7a3e1a6298f984cc9f4", "parents": [ "2d95e9d516ddfb5fb9c5a22dc3e367ce4bcf0fc5", "42933e56d0472e749932e27ca2a9f90d619705b8" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Fri Mar 24 15:11:12 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Fri Mar 24 15:11:12 2017 +0000" }, "message": "Merge \"Add server tests for nova.\"" }, { "commit": "2d95e9d516ddfb5fb9c5a22dc3e367ce4bcf0fc5", "tree": "df394f1b29bd29b8b9e77d79c945a9b8e6260871", "parents": [ "c0c31404ba001ebaad6afed81045d28dcb7d5410" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Mar 23 20:20:32 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Thu Mar 23 22:52:28 2017 +0000" }, "message": "Remove special_fields definition from volume tests.\n\nFollowing recent change to Tempest [0], it is necessary to\nmake this change to Patrole, since Patrole base classes inherit\nfrom Tempest base classes.\n\n[0] https://review.openstack.org/#/c/448869/\n\nChange-Id: Ibd5dbff3e125da5a5d2d1659d82b891a4a3124c5\n" }, { "commit": "42933e56d0472e749932e27ca2a9f90d619705b8", "tree": "3764e41841122c073059956e4fc685de9b19770e", "parents": [ "c0c31404ba001ebaad6afed81045d28dcb7d5410" ], "author": { "name": "Chi Lo", "email": "cl566n@att.com", "time": "Thu Mar 23 16:59:54 2017 -0400" }, "committer": { "name": "Rick Bartra", "email": "rb560u@att.com", "time": "Thu Mar 23 17:10:58 2017 -0400" }, "message": "Add server tests for nova.\n\nThe following RBAC test cases are added:\nos_compute_api:servers:create:forced_host\nos_compute_api:servers:create:attach_volume\nos_compute_api:servers:create:attach_network\n\nChange-Id: I99489adaa009bb19f7faaac31d25af4b6fef9a18\nPartially-Implements: blueprint initial-tests-nova\n" }, { "commit": "c0c31404ba001ebaad6afed81045d28dcb7d5410", "tree": "d2ed6d5d077d6d882778ec414ab02218fc9be199", "parents": [ "bb91325fdbe6d4bcc33e663da7cac47f1a3af590", "68015d1315734cb4970588f7e442c49a2c2bf697" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu Mar 23 18:43:30 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu Mar 23 18:43:30 2017 +0000" }, "message": "Merge \"Adding compute server tests\"" }, { "commit": "08d9d0224076372a72bc92d39817d85be634869d", "tree": "53d670214246c3d65209b7fd978f670d15174dde", "parents": [ "ca36e10fa732b120f316f5831d179cd9eae7c45a", "7bae840cd813cfc664a51f4c3aba014180288b46" ], "author": { "name": "Jenkins", "email": "jenkins@review.openstack.org", "time": "Thu Mar 23 15:45:40 2017 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "review@openstack.org", "time": "Thu Mar 23 15:45:40 2017 +0000" }, "message": "Merge \"Identity V3 tests - Regions\"" }, { "commit": "68015d1315734cb4970588f7e442c49a2c2bf697", "tree": "ca1c7b84a63f25aa608031b31f7fceabcb82fe47", "parents": [ "e83a257b06a79ff3fc8f8d857f3a7e24728ca118" ], "author": { "name": "raiesmh08", "email": "mr290n@att.com", "time": "Tue Mar 14 16:40:28 2017 +0530" }, "committer": { "name": "Mh Raies", "email": "mh.raies@ericsson.com", "time": "Thu Mar 23 14:59:06 2017 +0000" }, "message": "Adding compute server tests\n\nThis patch adds following compute server tests\n 1. create server\n 2. delete server\n 3. update server\n 4. create agent\n 5. instance migration\n 6. instance live migration\n 7. get server passowrd\n 8. get virtual interfaces\n\nPartially-Implements: blueprint initial-tests-compute\n\nChange-Id: I941e72c1277b3d0a9563fa9de0c51920162263ac\n" }, { "commit": "8ec953f00330251f62cca2bfee7c2f5238b55c3c", "tree": "5e3b75a8039b7e8444fbb0a9ecfc36e4c2d48cef", "parents": [ "6ebeed09e02cd7573bc8f8dbfd1c6afd7be4226b" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Mar 22 16:41:13 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Mar 22 19:31:39 2017 +0000" }, "message": "Identity V3 rbac_base method refactor\n\nThis patch:\n - Pulls out frequently used methods into rbac_base.\n - Renames frequently used methods to be uniformly called\n setup_test_x where x is a resource name\n - Refactors relevant tests to use new setup_test_x methods\n - Fixes create tests that required other resources, but were\n denied permission\n\nCo-Authored-By: Nicolas Hegleson \u003cnicolas.helgeson@att.com\u003e\nChange-Id: I4e28de9ab106239b3926634591ce4a550f108a3e\nCloses-Bug: #1672248\nPartial-Bug: #1670553\n" }, { "commit": "7bae840cd813cfc664a51f4c3aba014180288b46", "tree": "ca155251a90508da5f3a802045510a95448fe111", "parents": [ "df889039243419e63583bf2e6f41903d84d510bd" ], "author": { "name": "Nicolas Helgeson", "email": "nh202b@att.com", "time": "Tue Mar 07 16:24:01 2017 -0800" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Mar 22 17:19:34 2017 +0000" }, "message": "Identity V3 tests - Regions\n\nTests for identity v3 regions\n\nPartially-Implements bp: initial-tests-identity\nDepends-On: I4e28de9ab106239b3926634591ce4a550f108a3e\n\nChange-Id: Ib9164a455b245db03ef24f0c4f2450637947b7fa\nCo-Authored-By: Hemachandra Reddy \u003chr858f@att.com\u003e\n" }, { "commit": "6ebeed09e02cd7573bc8f8dbfd1c6afd7be4226b", "tree": "420a7c8a1a54c8707c7775f075d12ee57b9350c9", "parents": [ "df889039243419e63583bf2e6f41903d84d510bd" ], "author": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Mar 22 17:11:39 2017 +0000" }, "committer": { "name": "Felipe Monteiro", "email": "felipe.monteiro@att.com", "time": "Wed Mar 22 17:11:51 2017 +0000" }, "message": "Fixes IpAddressAlreadyAllocated thrown by fixed_ip port tests.\n\nCurrently, a IpAddressAlreadyAllocated may be thrown by the test\ntest_update_port_fixed_ips [0]. This can also happen for\ntest_create_port_fixed_ips.\n\nThis is because the test 1) creates a port and 2) tries to update\na port with a fixed ip, but because random.choice() is used to\nselect a random address across the ip range, the same address for\nupdate may be chosen as the address that was used for creation,\nresulting in the error.\n\nThis patch excludes the ip address for the port that was first\ncreated from the range over which random.choice selects the\nnext ip address for updating the port with a fixed ip.\n\n[0] http://logs.openstack.org/04/448204/1/check/gate-tempest-dsvm-patrole-member-ubuntu-xenial-nv/0971b9d/console.html\n\nChange-Id: I2e351f9332cafe70efe6f4ecbfaa184079a58b93\nPartial-Bug: #1670553\n" } ], "next": "df889039243419e63583bf2e6f41903d84d510bd" }