Bug 2219603 - Missing Designate sRBAC overrides in TripleO when enabling secure RBAC [NEEDINFO]
Summary: Missing Designate sRBAC overrides in TripleO when enabling secure RBAC
Keywords:
Status: MODIFIED
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tripleo-heat-templates
Version: 17.1 (Wallaby)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: z1
: 17.1
Assignee: Nate Johnston
QA Contact: Lilach Avraham
URL:
Whiteboard:
Depends On:
Blocks: 2124618
TreeView+ depends on / blocked
 
Reported: 2023-07-04 14:11 UTC by Lilach Avraham
Modified: 2023-08-15 19:52 UTC (History)
8 users (show)

Fixed In Version: openstack-tripleo-heat-templates-14.3.1-17.1.20230714001051.2dbbc7e.el9osttrunk
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:
ifrangs: needinfo? (njohnston)


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
OpenStack gerrit 888159 0 None MERGED Fix designate sRBAC overrides 2023-08-03 17:20:42 UTC
RDO 49219 0 None None None 2023-07-11 14:49:50 UTC
Red Hat Issue Tracker OSP-26302 0 None None None 2023-07-04 14:17:49 UTC

Description Lilach Avraham 2023-07-04 14:11:13 UTC
I've run the Designate SRBAC job [1] with the configuration we've used to run the RBAC test [2].

we have 14 tests that still fail [3], and most of them get this traceback.

Traceback (most recent call last):
  File "/home/stack/plugins/designate-tempest-plugin/designate_tempest_plugin/tests/api/v2/test_recordset.py", line 509, in test_admin_list_all_recordsets_for_a_project
    item['id'] for item in self.admin_client.list_recordset(
  File "/home/stack/plugins/designate-tempest-plugin/designate_tempest_plugin/services/dns/json/base.py", line 39, in wrapper
    return f(*args, **kwargs)
  File "/home/stack/plugins/designate-tempest-plugin/designate_tempest_plugin/services/dns/v2/json/recordset_client.py", line 150, in list_recordset
    return self._list_request(
  File "/home/stack/plugins/designate-tempest-plugin/designate_tempest_plugin/services/dns/json/base.py", line 187, in _list_request
    resp, body = self.get(uri, headers=headers)
  File "/home/stack/.virtualenvs/.tempest/lib64/python3.9/site-packages/tempest/lib/common/rest_client.py", line 322, in get
    return self.request('GET', url, extra_headers, headers,
  File "/home/stack/.virtualenvs/.tempest/lib64/python3.9/site-packages/tempest/lib/common/rest_client.py", line 742, in request
    self._error_checker(resp, resp_body)
  File "/home/stack/.virtualenvs/.tempest/lib64/python3.9/site-packages/tempest/lib/common/rest_client.py", line 847, in _error_checker
    raise exceptions.Forbidden(resp_body, resp=resp)
tempest.lib.exceptions.Forbidden: Forbidden
Details: {'code': 403, 'type': 'forbidden', 'request_id': 'req-a5977a6a-2324-410b-beb4-23c86269fa26'}


[1]- https://rhos-ci-staging-jenkins.lab.eng.tlv2.redhat.com/view/DFG/view/network/view/openstack-designate/job/DFG-network-openstack-designate-17.1_director-rhel-virthost-3cont_2comp-ipv4-geneve-srbac/32/
[2]- http://rhos-ci-logs.lab.eng.tlv2.redhat.com/logs/staging/DFG-network-openstack-designate-17.1_director-rhel-virthost-3cont_2comp-ipv4-geneve-srbac/32/undercloud-0/home/stack/tempest-dir/etc/tempest.conf.gz
[3]- http://rhos-ci-logs.lab.eng.tlv2.redhat.com/logs/staging/DFG-network-openstack-designate-17.1_director-rhel-virthost-3cont_2comp-ipv4-geneve-srbac/32/test_results/tempest-results-designate.1.html


Note You need to log in before you can comment on or make changes to this bug.