Test Nova and Glance RBAC policy old defaults
Nova and Glance RBAC new defaults and scope are enabled
by default in Devstack so all jobs test them by default.
Old defaults are deprecated but still present and many
deployement might be using them so let's testing those
in new jobs tempest-all-rbac-old-defaults but periodically.
Change-Id: I17df2b259888347051732b59cc29dff139bcc6ad
diff --git a/zuul.d/integrated-gate.yaml b/zuul.d/integrated-gate.yaml
index 0901788..8ac0b42 100644
--- a/zuul.d/integrated-gate.yaml
+++ b/zuul.d/integrated-gate.yaml
@@ -393,12 +393,24 @@
# Keystone policies are changed to work for both system as well as
# for project scoped, we need to keep scope check disable for
# keystone.
- NOVA_ENFORCE_SCOPE: true
+ # Nova and Glance have enabled the new defaults and scope by default
+ # in devstack.
CINDER_ENFORCE_SCOPE: true
- GLANCE_ENFORCE_SCOPE: true
NEUTRON_ENFORCE_SCOPE: true
PLACEMENT_ENFORCE_SCOPE: true
+- job:
+ name: tempest-all-rbac-old-defaults
+ parent: tempest-all
+ description: |
+ Integration test that runs all tests on RBAC old defaults.
+ devstack_localrc:
+ # NOTE(gmann): Nova and Glance have enabled the new defaults and scope
+ # by default in devstack so we need some jobs keep testing the old
+ # defaults until they are removed from service side.
+ NOVA_ENFORCE_SCOPE: false
+ GLANCE_ENFORCE_SCOPE: false
+
- project-template:
name: integrated-gate-networking
description: |
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 3223a1e..894e623 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -157,6 +157,7 @@
irrelevant-files: *tempest-irrelevant-files
- tempest-all:
irrelevant-files: *tempest-irrelevant-files
+ - tempest-all-rbac-old-defaults
- tempest-full-parallel
- tempest-full-zed-extra-tests
- tempest-full-yoga-extra-tests
@@ -191,6 +192,7 @@
periodic:
jobs:
- tempest-all
+ - tempest-all-rbac-old-defaults
- tempest-full-parallel
- tempest-full-oslo-master
- tempest-stestr-master