keystone-tempest-plugin 0.9.0 release

meta:version: 0.9.0
meta:diff-start: -
meta:series: yoga
meta:release-type: release
meta:pypi: no
meta:first: yes
meta:release:Author: Hervé Beraud <hberaud@redhat.com>
meta:release:Commit: Hervé Beraud <hberaud@redhat.com>
meta:release:Change-Id: I04d4fd5062beacba3e472fee3c282235824e4c20
meta:release:Code-Review+2: Hervé Beraud <herveberaud.pro@gmail.com>
meta:release:Code-Review+2: Elod Illes <elod.illes@est.tech>
meta:release:Workflow+1: Elod Illes <elod.illes@est.tech>

This patch replaces Identity client default endpoint type,
which is set to 'adminURL', to use the 'v3_endpoint_type'
from identity configuration.

Related-Bug: #1959930
Change-Id: Iee1fe30420d5ec4721a444e3a10985b31ec23601
Signed-off-by: Douglas Viroel <dviroel@redhat.com>

keystone-tempest-plugin 0.8.0 release

meta:version: 0.8.0
meta:diff-start: -
meta:series: xena
meta:release-type: release
meta:pypi: no
meta:first: yes
meta:release:Author: Ghanshyam Mann <gmann@ghanshyammann.com>
meta:release:Commit: Ghanshyam Mann <gmann@ghanshyammann.com>
meta:release:Change-Id: Ica4b732bb59f17b44cc0ad92a086e4da49f43021
meta:release:Code-Review+1: Lance Bragstad <lbragstad@redhat.com>
meta:release:Code-Review+1: Martin Kopec <mkopec@redhat.com>
meta:release:Code-Review+2: Hervé Beraud <herveberaud.pro@gmail.com>
meta:release:Workflow+1: Hervé Beraud <herveberaud.pro@gmail.com>

We have stable/victoria and stable/wallaby released so we
should add their job on master gate to keep branchless
tempest plugins compatible to those branch.

This also removes the stable/stein job as that is in EM
state now.

Ref: Tempest plugins guide for stable branch testing:
- https://docs.openstack.org/tempest/latest/stable_branch_testing_policy.html

Change-Id: Ic60d898969e730fcf1aebc4d103f06ec0baf24ed

keystone-tempest-plugin 0.7.0 release

meta:version: 0.7.0
meta:diff-start: -
meta:series: wallaby
meta:release-type: release
meta:pypi: no
meta:first: no
meta:release:Author: Hervé Beraud <hberaud@redhat.com>
meta:release:Commit: Hervé Beraud <hberaud@redhat.com>
meta:release:Change-Id: I902d4a57f892c03021c0858b5a3dd3954bbf50c1
meta:release:Code-Review+1: Ghanshyam Mann <gmann@ghanshyammann.com>
meta:release:Code-Review+1: yatin <ykarel@redhat.com>
meta:release:Code-Review+1: Kristi Nikolla <knikolla@bu.edu>
meta:release:Code-Review+2: Hervé Beraud <herveberaud.pro@gmail.com>
meta:release:Code-Review+2: Thierry Carrez <thierry@openstack.org>
meta:release:Code-Review+2: Elod Illes <elod.illes@est.tech>
meta:release:Workflow+1: Thierry Carrez <thierry@openstack.org>
meta:release:Workflow+1: Elod Illes <elod.illes@est.tech>

This commit updates the application credential protection tests to
ensure users can't craft paths that bypass application credential
ownership checks.

Depends-On: https://review.opendev.org/c/openstack/keystone/+/760972
Change-Id: I7729190d42a6a7199553c5fc058e1b93eecb2068
Related-Bug: 1901207

This change leverages the nine default personas available in tempest[1]
to demonstrate a potential framework for testing default policies. An
abstract base class is created that helps set up credentials and
outlines every policy that needs to be tested, then nine subclasses are
created to test every persona. Each test represents one policy rule, and
some tests make multiple requests in order to test the policy from
different approaches, for example, to check what happens if a different
domain is specified, or what happens if the resource does not exist.

The idea here is to be very verbose and explicit about what is being
tested: every policy gets one test in the base class, and each persona
is tested in a subclass. The layout should be easy to understand and
someone reading the code should not be left guessing whether a case is
missing or if there is magic happening in the background that is causing
a false positive or false negative.

This is intended to replace the unittest protection tests currently
in place.

[1] https://review.opendev.org/686306 (this will require additional
devstack and keystone configuration to work properly in CI)

Depends-on: https://review.opendev.org/686306
Depends-on: https://review.opendev.org/699051
Depends-on: https://review.opendev.org/699519
Depends-on: https://review.opendev.org/700826
Depends-on: https://review.opendev.org/743853
Depends-on: https://review.opendev.org/744087
Depends-on: https://review.opendev.org/744268
Depends-on: https://review.opendev.org/731087

Change-Id: Icb5317b9297230490bd783fe9b07c8db244c06f8

This change is consistent with updates we landed in keystone:

  fb86048d0a83cc6f2b5dcf78124ed12202902092

Change-Id: Ibd1d6624fc3addbe60c7218766d80cb43ad732bc

keystone-tempest-plugin 0.5.0 release

meta:version: 0.5.0
meta:diff-start: -
meta:series: victoria
meta:release-type: release
meta:pypi: no
meta:first: yes
meta:release:Author: Sean McGinnis <sean.mcginnis@gmail.com>
meta:release:Commit: Sean McGinnis <sean.mcginnis@gmail.com>
meta:release:Change-Id: Ie4767286ec1588ddbef95776cc5f35a6f8a6b7fc
meta:release:Code-Review+2: Hervé Beraud <hberaud@redhat.com>
meta:release:Workflow+1: Hervé Beraud <hberaud@redhat.com>

As per victoria cycle testing runtime and community goal[1]
we need to migrate upstream CI/CD to Ubuntu Focal(20.04).

Most of the Tempest jobs will be migrate automatically once devstack
base job start running on Focal(Depends-On).

Stable jobs testing stable branch needs to keep running on their supported
distro version which is bionic from stein till ussuri.

[1] https://governance.openstack.org/tc/goals/selected/victoria/migrate-ci-cd-jobs-to-ubuntu-focal.html

Change-Id: I8c7c12202e5fd024999bb2010bb483b0b2582346
Story: #2007865
Task: #40190

This change adds tempest clients for the registered limits and limits
APIs. While those APIs are experimental, it's best to start development
of the tempest tests in the keystone plugin rather than in tempest. This
base can be used for both developing exhaustive API tests for these APIs
as well as for RBAC tests.

Change-Id: I30b5b2ac5f10fd457e436df876f872432059b655

assertItemsEqual was removed from Python's unittest.TestCase in
Python 3.3 [1][2]. We have been able to use them since then, because
testtools required unittest2, which still included it. With testtools
removing Python 2.7 support [3][4], we will lose support for
assertItemsEqual, so we should switch to use assertCountEqual.

[1] - https://bugs.python.org/issue17866
[2] - https://hg.python.org/cpython/rev/d9921cb6e3cd
[3] - testing-cabal/testtools#286
[4] - testing-cabal/testtools#277

Change-Id: I2edc09748de1739c558040a8ae6a15373ad1a93b

Update docs building and cleanup a bit:
* Update requirements for Sphinx and openstackdocstheme for
  python 3, create doc/requirements.txt for these
* Remove unneeded doc and translation sections from setup.cfg
* Remove install_command, it's unneeded, the default is fine,
  move constraints into deps, use TOX_CONSTRAINTS instead of
  obsolete UPPER_CONSTRAINTS
* Use new variables from updated openstackdocstheme

Change-Id: I659a8736195ff621032b4fb3bd7a72fa616cf8c6

This patch follows the sequence of adding addCleanup
just after creating a resource similar to whole
keystone-tempest-plugin repo. This is to avoid the
resource leakage issue if anything happen between
resource creation and addcleanup line.

Change-Id: I258c440417eaecb8f5ed4dc1e0eb6138edda883b

Do not use the admin user as a shadowed federated user for the K2K
tests. When trying to add expiring groups for the admin user, keystone
has trouble looking up the user in the cache and fails to add the groups
to the user. This sometimes results in test failures, which may be
masked as failure to clean up the identity provider in between tests and
resulting in a conflict trying to recreate it. This change instead uses
an ephemeral test user rather than the admin user, which is not meant to
be used for authentication tests anyway.

Change-Id: Ia4b53b41a0030772a2abdba949ad7529880d8f70

This patch add the jobs for stable/stein, stable/train and
stable/ussuri in keystone tempest plugin. Supported stable branch
use keystone-tempest-plugin master version to test them. Adding stable
job on master ensures that keystone-tempest-plugin master version is
compatible with stable branches testing.

Change-Id: I72bf38247f693a2efcdad2e64a8948023350ff53

This patch removes an unused function _add_cleanup() from
this plugin.

Change-Id: I3647b639618fcebc99a9e7275d80b87b034e2960

Without this patch, the stable keystone branches fail the K2K tests
because they don't support the assertion feature added in #1687593 and
we don't intend to backport it. This change allows the stable branches
to still be tested using a regular static group mapping.

Change-Id: Ie1be1cc0e961a1584c99247f0c1b0032576718d8

This patch adds the test case for the adddtion of
"openstack_groups" to the idp assertion.

Depends-on: https://review.opendev.org/#/c/588211/
Change-Id: I5dd932b34a2a8d1013641e08eabfdac84bb4092e