From 4c44ad581747b2461f12d7d90a36410c9007e035 Mon Sep 17 00:00:00 2001
From: Roger Luethi <rl@patchworkscience.org>
Date: Thu, 9 Nov 2017 14:30:06 +0100
Subject: [PATCH] Remove domain role from tempest users

This patch removes the openstack_user resource with :grant_domain
action. A user is always created within a specific domain; such a
membership cannot be tacked on later. This resource gave the user the
role intended for their project for the domain (i.e., for the Default
domain instead of for the service project).

We add the domain_name attribute that creates the tempest users in the
desired domain. Note that this change needs a sufficiently recent
openstackclient cookbook -- otherwise the domain_name attribute is
ignored (which does not matter as long as the tempest users are to be
created in the Default domain).

Change-Id: I345826bc3dae80d25b8f8826c63c5914cf1c2db5
---
 recipes/setup.rb   |  9 +--------
 spec/setup_spec.rb | 22 ++--------------------
 2 files changed, 3 insertions(+), 28 deletions(-)

diff --git a/recipes/setup.rb b/recipes/setup.rb
index acfb1cd..4edcb5a 100644
--- a/recipes/setup.rb
+++ b/recipes/setup.rb
@@ -74,6 +74,7 @@ connection_params = {
 
   openstack_user service_user do
     project_name service_project
+    domain_name service_domain
     password service_pass
     connection_params connection_params
   end
@@ -84,14 +85,6 @@ connection_params = {
     connection_params connection_params
     action :grant_role
   end
-
-  openstack_user service_user do
-    domain_name service_domain
-    role_name service_role
-    user_name service_user
-    connection_params connection_params
-    action :grant_domain
-  end
 end
 
 heat_stack_user_role = node['openstack']['integration-test']['heat_stack_user_role']
diff --git a/spec/setup_spec.rb b/spec/setup_spec.rb
index b17a655..2c59d5b 100644
--- a/spec/setup_spec.rb
+++ b/spec/setup_spec.rb
@@ -40,6 +40,7 @@ describe 'openstack-integration-test::setup' do
       expect(chef_run).to create_openstack_user(
         'tempest_user1'
       ).with(
+        domain_name: 'Default',
         project_name: 'tempest_project1',
         password: 'tempest_user1_pass',
         connection_params: connection_params
@@ -54,16 +55,6 @@ describe 'openstack-integration-test::setup' do
       )
     end
 
-    it do
-      expect(chef_run).to grant_domain_openstack_user(
-        'tempest_user1'
-      ).with(
-        domain_name: 'Default',
-        role_name: 'Member',
-        connection_params: connection_params
-      )
-    end
-
     it do
       expect(chef_run).to grant_role_openstack_user(
         'tempest_user1'
@@ -87,22 +78,13 @@ describe 'openstack-integration-test::setup' do
       expect(chef_run).to create_openstack_user(
         'tempest_user2'
       ).with(
+        domain_name: 'Default',
         project_name: 'tempest_project2',
         password: 'tempest_user2_pass',
         connection_params: connection_params
       )
     end
 
-    it do
-      expect(chef_run).to grant_domain_openstack_user(
-        'tempest_user2'
-      ).with(
-        domain_name: 'Default',
-        role_name: 'Member',
-        connection_params: connection_params
-      )
-    end
-
     it do
       expect(chef_run).to grant_role_openstack_user(
         'tempest_user2'