Add octavia-v2-dsvm-scenario-centos-9-stream

Add extra args to the "scp" command to authorize the pubkey exchange
with a cirros VM.
Detect the openssh client version to enable the use of the SCP protocol
(starting with openssh 8.7, the SFTP protocol is the default protocol
with scp, SFTP is not supported by Cirros) when sending files to the
cirros VM.

Depends-On: https://review.opendev.org/828189

Change-Id: I689a50e6762fd22e1aaec8aa84ff5b075ff5bd45

This is a follow-up commit for 'Add type to allow ECDSA keys'
(I34ac429ab5442cef056ee8b63fcb2ba41e8b9b27), this commit allows
using octavia-tempest-plugin with older tempest releases
(ex: in our jobs on stable/train).
It catches the exception if [validation].ssh_key_type is not
supported and doesn't pass the ssh_key_type argument to tempest
functions.

Change-Id: I5c2db87975803b30ea230c3bbf5dab4b96da4614

We have stable/xena released so we should add
their job on master gate to keep branchless tempest
plugins compatible to stable branch.

This also removes the stable/train job as that is in EM
state now.

Ref: Tempest plugins guide for stable branch testing:
- https://docs.openstack.org/tempest/latest/stable_branch_testing_policy.html

Change-Id: Ia1ecf95d269af2f6edbd562f31fb69c2cc884cf0

Some tempest tests will fail under FIPS because they are trying to
ssh to a cirrus instance that has a version of dropbear that does
not support signatures other than using SHA-1 for RSA keys. This
is not allowed under FIPS.  The workaround until cirros is updated
is to use ECDSA keys.  This patch allows the key type to be
specified.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/807465
Change-Id: I34ac429ab5442cef056ee8b63fcb2ba41e8b9b27

noop-api tests have been frequently timing out since SQLAlchemy
1.4 release.
An analysis showed that some tests are 55% slower with 1.4, but we
haven't fixed it or improved the code yet. To unblock the gates, set the
timeout to 10800 sec (3h00) for those jobs. We might revert this commit
when we figure out how to improve test exec times.

Change-Id: I68a5357f58b74f0f759cab0bb89a517c384d05e0

Change-Id: I5bb7ee389e734c075f10ed38507bade9a442e51b

Two-node job was failing because devstack tried to compile the
test_server.go file on controller2.
controller2 doesn't have tempest installed, but octavia-tempest-plugin
was installed. The compilation step was failing and is not necessary
there.

Fix octavia-v2-act-stdby-dsvm-scenario-two-node definition, overrides
were not applied.
Fix the "zuul_copy_output" section.

Move to ML2/OVN backend.

Co-Authored-By: Carlos Goncalves <cgoncalves@redhat.com>
Change-Id: I24976e93e9ea8f7f50c9da014c2627965512893c

All the load balancer service clients are registered via the plugin interface[1],
that way Tempest register and create the lazy initialization of registered clients
so that they can be access from there in consistent way.

But octavia-tempest-client create a separate instance of those and access instead of
accessing the registered service client in Tempest. This commit makes all the service clients
access from Tempest registry and remove the separate objects.

[1] https://github.com/openstack/octavia-tempest-plugin/blob/cac3eefc44afca458692e9dadb539c0cb17dc9e4/octavia_tempest_plugin/plugin.py#L54

Change-Id: Ie24909b49baf2c6a886e2ff711e641e36ffe6b50

Change-Id: If96d611a098627b01fbbd544c22619ba0ce06a19

Fix except_timeout_error call to make_request. In case of an IPv6
address and a TCP-based protocol, make_request expects brackets around
the address (ex: [2001:12::2]).

Some tests failed with the following error: "Validate URL got exception:
Failed to parse: http://fd22:262a:41e1:1::f5:97. Retrying.". Then the
requests timed out because each retry failed and not for the excepted
reason (which is: SG update was applied)
Because of that issue, some IPv6 tests based on
_test_listener_with_allowed_cidrs may have failed because the tests
considered that the SG were applied, while the traffic could still pass.

Change-Id: I2e6d108a8d4ce197ae657ea10b10f63b1a5850c4

Depends-On: https://review.opendev.org/797069

Change-Id: Ic80b256f771a7e61d2714644852cffb5271b1612

It's possible to use the same VIP port for TCP and UDP protocols.
Two listeners: UDP and TCP are being created using the same VIP port.
UDP and TCP traffic validation, both should PASS.

Change-Id: Ie93829be86b8a2442911ce212cdd0bc98237b962

Fix functions and callers where "listener_id" wasn't actually used.

Change-Id: I7ca3b4011918d7047ad9a16306653b9054e36c4a

Move master and victoria jobs to ubuntu focal.
ussuri and train jobs still use bionic.

Change-Id: I4181a989514389ba18ff7874f8f4332f392d1189

This test covers LB "insert HTTP headers" functionality.
It’s a traffic based scenario and validation is done using real HTTP headers
being received on backend side.

Change-Id: I97efd6bcc793e1378356c18209d5345597f39a00

lb_observer and lb_global_observer don't have any meaning when
admin_or_owner policy override in enabled.
This commit disables client creation for those roles and removes their
uses from API tests (the behavior of the owner_or_admin tests are now
similar to their behavior before the introduction of the new RBAC
tests).

Requires the following configuration in tempest.conf:

[load_balancer]
RBAC_test_type = owner_or_admin
member_role = member
admin_role = admin

Change-Id: I2231384933d5974b962a558e8c0b3bffb1140b5a

This patch refactors the RBAC enforcement checks in the API tests.
It also updates those test for keystone scoped tokens and default roles.

Change-Id: I6fad03f5a89c213562918ca258884aac34ba7ce7

The IPv6+TCP+LC scenario test have randomly failed with an incorrect
dispatch. Adding a delay between requests seems to fix this behavior
(shamelessly inspired by the IPv4 LC scenario tests).

Change-Id: I68baab227f844a057f2abf77b295c3af287a333e

This patch adds a pool re-encryption scenario test that covers
TLS enabled pools, pools with CA validation, and pools with
certificate revocation lists.

Co-Authored-By: Gregory Thiemonge <gthiemon@redhat.com>

Change-Id: Ib3d8d766b8eb358b48da74f8634f6d24510394b4

Change-Id: I00b3e8172c3d90ef7cabb65d588508728ea658cf

The IPv6 VIP subnet used in the tests is created using devstack's
default IPv6 subnetpool.
Devstack ensures that any CIDR from this subnetpool is routable from the
devstack node if the subnet is plugged into devstack's router1.

Change-Id: Iaf3113087a344787add3405208fb229838a56d0b

This patch creates the required pki resources and enables HTTPS
on the test web servers. It sets up port 443 for regular HTTPS and
port 9443 for HTTPS that will require a valid client certificate.

Change-Id: Ib7cee4c8600fd1be4a9d7027d3ca1f413a0b1007
Story: 2003858
Task: 41170