Force os_primary and os_project_member to be the same
as tempest moves to 'safe rbac by default', it gradually replaces
usage of os_primary cred category with more explicitly named
os_project_member.
However, many tests are still asking for both.
If the test is testing for some RBAC access for both os_primary
and os_project_member creds, currently it will fail when using
pre-provisioned creds because those will be allocated from different
projects.
This patch forces the os_primary to be effectively a simple alias
to os_project_member in the case of pre-provisioned creds,
always creating and re-using the same cred as os_project_member does,
forcing them to always be the same if a test asks for both of them.
Related-Issue: RODX-37478
Change-Id: I407263bd905f30e563101895d209f7c3a686a6f2
(cherry picked from commit fd5feba5d52cacb090dbf31d65d40b3038c10ce9)
diff --git a/tempest/lib/common/preprov_creds.py b/tempest/lib/common/preprov_creds.py
index 8bb41d1..587c235 100644
--- a/tempest/lib/common/preprov_creds.py
+++ b/tempest/lib/common/preprov_creds.py
@@ -272,7 +272,8 @@
free_hash = self._get_free_hash(useable_hashes)
clean_creds = self._sanitize_creds(
self.hash_dict['creds'][free_hash])
- LOG.info('%s allocated creds:\n%s', self.name, clean_creds)
+ LOG.info('%s allocated creds for roles %s in scope %s:\n%s',
+ self.name, roles, scope, clean_creds)
return self._wrap_creds_with_network(free_hash)
@lockutils.synchronized('test_accounts_io', external=True)
@@ -310,12 +311,10 @@
# TODO(gmann): Remove this method in favor of get_project_member_creds()
# after the deprecation phase.
def get_primary_creds(self):
- if self._creds.get('primary'):
- return self._creds.get('primary')
- # NOTE(pas-ha) use the same call as get_project_member_creds
- net_creds = self._get_creds(['member'], scope='project')
- self._creds['primary'] = net_creds
- return net_creds
+ # NOTE(pas-ha) force os_primary and os_project_member
+ # to be exactly the same creds, otherwise they may be from
+ # different projects and fail some RBAC tests
+ return self.get_project_member_creds()
# TODO(gmann): Replace this method with more appropriate name.
# like get_project_alt_member_creds()