openstack
/
octavia-tempest-plugin
Code Issues Proposed changes

Add "member" role to non-admin test credentials 

Some services are enabling "new defaults" RBAC by default. This will require all non-admin users to have either the "member" or "reader" role. This patch updates the Octavia tempest plugin to include the "member" role in test credentials when the tempest plugin is configured for "RBAC_test_type" other than owner-or-admin.

Change-Id: I8aadb98d438943b18a8d72ff54e216930cfd3ccc
This commit is contained in:
Michael Johnson 2023-01-18 17:59:17 +00:00
parent f1061176af
commit 9e9f526d65
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
octavia_tempest_plugin/tests/test_base.py
View File

@ -71,8 +71,10 @@ class LoadBalancerBaseTest(validators.ValidatorsMixin,
['lb_observer', CONF.load_balancer.observer_role, 'reader'],
['lb_global_observer', CONF.load_balancer.global_observer_role,
'reader'],
['lb_member', CONF.load_balancer.member_role],
['lb_member2', CONF.load_balancer.member_role]]
# Note: Some projects are now requiring the 'member' role by
# default (nova for example) so make sure our creds have this role
['lb_member', CONF.load_balancer.member_role, 'member'],
['lb_member2', CONF.load_balancer.member_role, 'member']]
# If scope enforcement is enabled, add in the system scope credentials.
# The project scope is already handled by the above credentials.

7
releasenotes/notes/Make-sure-member-credentials-have-the-member-role-for-new-defaults-5fbc2e05768c04b9.yaml Normal file
View File

@ -0,0 +1,7 @@
---
fixes:
- |
Some services are now enabling the "new default roles" which means all
non-admin users must have the "member" or "reader" role. This fix updates
the test credentials to include these roles when not running in
admin-or-owner test mode.