As stated in the cryptography.io documentation, "Almost everyone should
use 65537" for the public_exponent in an RSA key. [1]

This patch also uses a larger RSA key length for FIPS compatibility.

[1] https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key

Change-Id: I9f0c030b172a544821aa42924e4401cd7ccc9956

Follow-up of I05b0200b80d8ae957caaa53d5006b050d2d49da6
which fixes also the other leftover usage of a legacy
encryptor class (plain this time).

Change-Id: I8fc4e2e6ed84bf18a4c89c30ee5c40b743d00e46

Stable/wallaby is released so we should add
their job on master gate to keep branchless tempest
plugins compatible to stable branch.

Ref: Tempest plugins guide for stable branch testing:
- https://docs.openstack.org/tempest/latest/stable_branch_testing_policy.html

Change-Id: I3e8534fdc91a9e94fa82ce6504f36f3d0b5aed6c

This patch adds basic RBAC tests for the Transport Keys API for
the reader, admin, and member personas with project scope.

Some tests will need additional work because they require transport
keys to be present, which can only be done by a system-scope admin

Change-Id: I269618fd760cffd992ca450bb9f13b9788b50b54

This patch adds basic RBAC test for the Secret Stores API for
the reader, member and admin personas with project scope.

The tests are skipped by a config option, as they require
the multiple-backends feature to be enabled in barbican.

The devstack instace we're using for gate tests does not have
this enabled, so we default to False for now.

Change-Id: Ibca9d44fb3d0f4fd9945a7e6c636e0fbf6beb42e

This patch adds basic secure-rbac testing for the Quotas resource
for the reader, member, and admin personas with project scope.

Change-Id: I290b808bbb8be26da281cf8971661c44fede71b0

This patch adds basic RBAC tests for the Orders resource for
the reader, member, and admin personas with project scope.

Change-Id: Ie5b7b6f7df20ec96e916232e70e9f61c7771f9d2

This patch adds basic RBAC testing for the Containers resource for
reader, member and admin personas with project scope.

Depends-On: I6879f566117db5ec0099ddad35ba649a3c674bd1
Change-Id: I2272f5cd2385df15cc7761e8b858dfd39be955d4

This patch adds a gate to test the new secure-rbac policy.

Currently, Tempest is unable to create system admin credentials
when the isolated networks option is set to true, so we disable
that option for this gate.

This patch also includes fixes needed to get the existing tests
to pass, as well as some skips for scenario tests that require
isolated networks.

We should be able to remove the skips once Tempest is fixed to
work with system admin.

Depends-On: I584f7b67f2f95caa7c4db3d9d9222d0a9d38442d
Change-Id: I0129ab6d15bc42d98a19e3551b8d009f9ad05e10

This adds initial RBAC tests for secrets

Change-Id: Ib79eed6886839d1b7848c991bd64e82595c6c32e

UPPER_CONSTRAINTS_FILE is old name and deprecated
-https://zuul-ci.org/docs/zuul-jobs/python-roles.html#rolevar-tox.tox_constraints_file
This allows to use lower-constraints file as more
readable way instead of UPPER_CONSTRAINTS_FILE=<lower-constraints file>.

Change-Id: I5e198c592742755f4285b68ac288820b9a33031b

Change-Id: Ia690ea0a284f1e1cfe7e223613acdb30e40a9980

As per victoria cycle testing runtime and community goal
we need to migrate upstream CI/CD to Ubuntu Focal(20.04).

Tempest based jobs are migrated automatically via devstack
base job start running on Focal but stable jobs testing stable
branch needs to keep running on their supported
distro version which is bionic from train till ussuri.

Also, remove stein support (removed from tempest)
and add a job for victoria.

Change-Id: I3d792925e81172ae8abe75c5ceb2d5a039fc84f7
Story: #2007865
Task: #40184

The openstack can have multiple glance stores deployed/available.
It may be a proper thing to copy newly created signed image into
all the available glance stores so barbican tempest tests can access
image regardless on which compute and storage backend they are ran on
and regardless on which glance store is local.
Additionally there is a nova-compute conf parameter[1] which can even
prevent instances being spawned from image which is not available in local
glance store.
The copy-image would happen only if import_image tempest cong option
is available which indicates glance multistore is available.

[1] https://review.opendev.org/#/c/657078/

Change-Id: I1f0d8be1b237da0c96e820c4b3dca09a83b29752

Current skip runs from the testcase and consumes time and resources.
Changed the skip to decorator.

Change-Id: Ia98fa1607c56b34ed1c764873f2909f423d1fffd

1.update barbican and tempest plugins links to the lastest ones

2.since we don't use launchpad to report bugs,replace it with
storyboard.openstack.org

Change-Id: I287563a7abfa57021cbdebeece35057e85691056

The repo is Python 3 now, so update hacking to version 3.0 which
supports Python 3.

Fix problems found.

Change-Id: Ia59a23a36ebb8548a20e894000f7342c73012eac

Change-Id: I1efa783233a435b6dbe134e035e0c2efb8ac1a6d

Remove six Replace the following items with Python 3 style code.
- six.moves.urllib
- six.binary_type

Change-Id: I234c3b205ee21b59953aa6ce7af5c2a1e4a6cfa6

It seems this dummy test has been around since the creation of the plugin,
but it is not really needed.

Change-Id: Ic17ac37472dc2742fa5d6299ff5724bfd9f7197e

author-email, home-page are aliases, replacing them for their final value

description-file -> long_description = file:

requires-python is old value and does not work, python-requires
is right metadata.

'python-requires' is introduced from PEP440 and requires-python was old value
in PEP345.
- https://packaging.python.org/guides/distributing-packages-using-setuptools/#python-requires
- https://www.python.org/dev/peps/pep-0345/#requires-python

Change-Id: I2d2cd5d660ef937bfe8445bae7cf6b279eb80b0f

in 'victoria' cycle, we should test py38 by default.

Change-Id: Id1b69b2e4fa56ade670a72f0775690beb09bf89d

The option is deprecated for more than 4 years already and it will
be removed soon, see the change in Tempest [1]

Starting Tempest 25.0.0 release, CONF.scenario.img_file need
a full path for the image. CONF.scenario.img_dir was deprecated
and will be removed in the next release. Till Tempest 25.0.0,
old behavior is maintained and keep working but starting
Tempest 26.0.0, you need to specify the full path in
CONF.scenario.img_file config option.

This patch does analogically the same change as was done in Tempest,
in order to give users of the plugin some time for removing img_dir.

[1] https://review.opendev.org/#/c/710996

Related-Bug: #1393881
Change-Id: I610d267eab287e3df8dd428621c4d3abace6dd0c

1. Tempest has an option CONF.compute.compute_volume_common_az to make
sure that Volume and Instance are created in common AZ If Availability
zones are used. The paramater is respected when instance is created
because tempest.common.compute.create_test_server() is used but not
respected when volume is created for test purpose. Let's make sure
AZ is set when volume is created if parameter is set.

2. The plain Encryptor provider is not support on ceph backends, the
test test_encrypted_cinder_volumes_cryptsetup fails on:
cinder.exception.VolumeDriverException: Volume driver reported an error:
Provider plain not supported.
This comes from [1] which is called in [2]. The Plain provider will be deprecated
in future completely.

[1] https://opendev.org/openstack/cinder/src/branch/master/cinder/volume/volume_utils.py#L1195
[2] https://opendev.org/openstack/cinder/src/branch/master/cinder/volume/drivers/rbd.py#L877

Change-Id: Ib6290ed1ad5779e4e6fed449f3335dbdada42f0d

As per victoria cycle testing runtime and community goal[1]
we need to migrate upstream CI/CD to Ubuntu Focal(20.04).

Fixing:
- bug#1886296
Bump the pyflakes to 2.1.1 as min version to run pep8 jobs
on py3.8 which is default python vesion in ubuntu focal.

Story: #2007865
Task: #40177

Closes-Bug: #1886296
[1] https://governance.openstack.org/tc/goals/selected/victoria/migrate-ci-cd-jobs-to-ubuntu-focal.html

Change-Id: I206a845b6a7e271b73aef762062fe57f228edcbe

Define here the barbican tempest plugin which rely on
barbican-tempest-plugin, following the common patterns:

- follow the rules for naming (repository name as prefix,
  remove some redundant details);
- define branch-specific jobs from the most basic job
  to catch regressions against older branches;
- remove barbican-simple-crypto-devstack-tempest-py35,
  long gone, from the experimental queue.

Change-Id: I106addbe99b1bd4ed72ab07aba16031067503483