Commit Graph

17 Commits

Author SHA1 Message Date
Douglas Mendizábal b2aa462f0e Consistent and Secure RBAC (Phase 1)
This patch updates the RBAC tests to test the new policy changes in
Keystone that allow users with the "admin" (aka root) role to access
system-level APIs previously available only to the system-admin persona.

The changes affect both the project-admin and domain-admin personas.

All the relevant policy changes have been made in keystone.

Depends-On: https://review.opendev.org/c/openstack/keystone/+/908524
Change-Id: I43c6da5bce9552948692eef8d71408d74382cc4e
2024-02-13 01:45:41 +00:00
Douglas Mendizábal 4c4cdfebce Update supported branches
This patch updates the jobs to reflect the latest suported branches for
keystone.

Test jobs for both antleope (2023.1) and bobcat (2023.2) have been
added, and the jobs for the xena and yoga branches have been removed as
they are no longer maintained.

This patch also makes the protection jobs non-voting as they are
expected to fail due to policy changes in keystone.  A follow-up patch
fixes the test and re-enables the job.

Change-Id: I2d3968672eb4dd32a163827a7e24384578a4c913
2024-02-13 10:45:09 +09:00
Ghanshyam Mann 5b9eb634ec Pin stable branch jobs nodeset to Ubuntu Focal (20.04)
In 2023.1 cycle. we are moving the default distro
version of Ubuntu to Jammy (22.04)[1] so we need to pin
the nodeset for stable branch job in master gate so that
they continue run on their supporting distro version which is
Ubuntu Focal since stable/victoria.

[1] https://governance.openstack.org/tc/goals/selected/migrate-ci-jobs-to-ubuntu-jammy.html

Change-Id: I7d8027dd893e07581ca30053c4d6c8ba843b14d9
2023-02-15 17:57:38 -08:00
Ghanshyam Mann 0506e1c6d9 Update stable jobs on master gate
As zed is released, we should add its job on master
gate to keep branchless tempest plugins compatible
to stable branch.

Also, removing the stable/wallaby job as that is in EM
state.

Ref: Tempest plugins guide for stable branch testing:
- https://docs.openstack.org/tempest/latest/stable_branch_testing_policy.html

Change-Id: I28117a37a41ac76ba5561a285e417882c2d6a5a1
2023-01-26 19:37:02 -06:00
Ghanshyam Mann 7f43a20380 Update stable branches jobs on master gate
we have stable/xena and stable/yoga also present
and supported so we should add their job on master
gate to keep branchless tempest plugins compatible
to stable branch.

This also removes the old EM stable branches which are
train, ussuri, and victoria jobs.

Ref: Tempest plugins guide for stable branch testing:
- https://docs.openstack.org/tempest/latest/stable_branch_testing_policy.html

Change-Id: I3181e8a321aa36d06d00b0e96c2a7733a438aea3
2022-05-31 18:48:33 -05:00
Ghanshyam Mann 32e48a7ea5 Add victoria/wallaby stable branch jobs on master gate
We have stable/victoria and stable/wallaby released so we
should add their job on master gate to keep branchless
tempest plugins compatible to those branch.

This also removes the stable/stein job as that is in EM
state now.

Ref: Tempest plugins guide for stable branch testing:
- https://docs.openstack.org/tempest/latest/stable_branch_testing_policy.html

Change-Id: Ic60d898969e730fcf1aebc4d103f06ec0baf24ed
2021-04-29 18:34:31 -05:00
Colleen Murphy a6d4ceaf57 Add RBAC tests
This change leverages the nine default personas available in tempest[1]
to demonstrate a potential framework for testing default policies. An
abstract base class is created that helps set up credentials and
outlines every policy that needs to be tested, then nine subclasses are
created to test every persona. Each test represents one policy rule, and
some tests make multiple requests in order to test the policy from
different approaches, for example, to check what happens if a different
domain is specified, or what happens if the resource does not exist.

The idea here is to be very verbose and explicit about what is being
tested: every policy gets one test in the base class, and each persona
is tested in a subclass. The layout should be easy to understand and
someone reading the code should not be left guessing whether a case is
missing or if there is magic happening in the background that is causing
a false positive or false negative.

This is intended to replace the unittest protection tests currently
in place.

[1] https://review.opendev.org/686306 (this will require additional
devstack and keystone configuration to work properly in CI)

Depends-on: https://review.opendev.org/686306
Depends-on: https://review.opendev.org/699051
Depends-on: https://review.opendev.org/699519
Depends-on: https://review.opendev.org/700826
Depends-on: https://review.opendev.org/743853
Depends-on: https://review.opendev.org/744087
Depends-on: https://review.opendev.org/744268
Depends-on: https://review.opendev.org/731087

Change-Id: Icb5317b9297230490bd783fe9b07c8db244c06f8
2021-02-11 16:02:54 +00:00
Lance Bragstad 2473e5bdba Update federation jobs to use ubuntu focal
This change is consistent with updates we landed in keystone:

  fb86048d0a83cc6f2b5dcf78124ed12202902092

Change-Id: Ibd1d6624fc3addbe60c7218766d80cb43ad732bc
2021-02-10 19:31:18 +00:00
Ghanshyam Mann 4774d61bb4 [goal] Migrate keystone-tempest-plugin jobs to focal
As per victoria cycle testing runtime and community goal[1]
we need to migrate upstream CI/CD to Ubuntu Focal(20.04).

Most of the Tempest jobs will be migrate automatically once devstack
base job start running on Focal(Depends-On).

Stable jobs testing stable branch needs to keep running on their supported
distro version which is bionic from stein till ussuri.

[1] https://governance.openstack.org/tc/goals/selected/victoria/migrate-ci-cd-jobs-to-ubuntu-focal.html

Change-Id: I8c7c12202e5fd024999bb2010bb483b0b2582346
Story: #2007865
Task: #40190
2020-07-30 22:53:17 +00:00
Vishakha Agarwal bd8ba4e7e2 Add stable branches testing on keystone-tempest-plugin master gate
This patch add the jobs for stable/stein, stable/train and
stable/ussuri in keystone tempest plugin. Supported stable branch
use keystone-tempest-plugin master version to test them. Adding stable
job on master ensures that keystone-tempest-plugin master version is
compatible with stable branches testing.

Change-Id: I72bf38247f693a2efcdad2e64a8948023350ff53
2020-05-06 10:09:16 +00:00
Colleen Murphy 874e450b31 Update Zuul job list
Remove py2 job and add voting k2k job.

Change-Id: Ia3c3f3222e435d479c447fc0acc9f5fbb76c49dc
2020-01-28 15:34:41 -08:00
Vishakha Agarwal 0cf7ef8bc6 [ussuri][goal] Drop python 2.7 support and testing
OpenStack is dropping the py2.7 support in ussuri cycle.

keystone-tempest-plugin is ready with python 3 and ok to drop the
python 2.7 support.

Complete discussion & schedule can be found in
- http://lists.openstack.org/pipermail/openstack-discuss/2019-October/010142.html
- https://etherpad.openstack.org/p/drop-python2-support

Ussuri Communtiy-wide goal:
https://governance.openstack.org/tc/goals/selected/ussuri/drop-py27.html

Change-Id: I4c46dfbfb9e679d64f6cc6b99d8f63775ec3914a
2020-01-22 12:41:06 +05:30
Colleen Murphy 7dac0f1f6c Use up-to-date federation job names
Change-Id: I4960d56e91977696edb3deee58729e0c74db4a64
2019-10-17 09:24:39 -07:00
Colleen Murphy 022bd1d637 Add python3 functional test job
This was created and added in the keystone repo so let's use it here as
well.

Change-Id: I0686d52730b0d773730baea84710bda213c402b3
2018-10-31 14:05:40 +01:00
Andreas Jaeger 48f7e26096 Import another job from project-config
The job  legacy-keystone-dsvm-py35-functional-v3-only was left by
accident in project-config, import it and rename it so that the job in
keystone is used.

See https://review.openstack.org/601463 for keystone rename.

Needed-By: https://review.openstack.org/603282
Change-Id: Ic2551a09eeddd8a403b566dc9d9b88c09406db83
2018-09-18 07:16:19 +00:00
Andreas Jaeger d0706829d5 Rename keystone zuul jobs
Follow changes Ib7c8a2f1cfa19f332aad20ac528f8fa86addd5f9 and
If0d0db326f25a95f6a0c16f49c841a4db7cb6022 to rename the jobs
to the jobs in the keystone repository.

Change-Id: I0a9984642bafc0438c561948dc8bb49b248e5f72
2018-09-17 20:04:12 +02:00
Doug Hellmann 807bd94f3e import zuul job settings from project-config
This is a mechanically generated patch to complete step 1 of moving
the zuul job settings out of project-config and into each project
repository.

Because there will be a separate patch on each branch, the branch
specifiers for branch-specific jobs have been removed.

Because this patch is generated by a script, there may be some
cosmetic changes to the layout of the YAML file(s) as the contents are
normalized.

See the python3-first goal document for details:
https://governance.openstack.org/tc/goals/stein/python3-first.html

Change-Id: Ia47cf5948034aa524d30ed1c02f027e4c863988c
Story: #2002586
Task: #24304
2018-08-29 16:04:12 -04:00