Fix no _member_ role found

python-tempestconf sets _member_role by default, however,
the role is not created in devstack environment by default.
Therefore the patch adds logic which checks if the role is
present and if it's not, it tries to look for member role.
If the member role is not present as well, auth.tempest_roles
is not set at all.

Story: 2003550
Task: 24839

Change-Id: I0051bb4f870d58298403ac6fef6ae4ec454997af

.zuul.yaml

@@ -108,6 +108,7 @@
       Tempest job for python-tempestconf on a devstack environment as the demo user.
     run: playbooks/python-tempestconf-tempest-devstack.yaml
     vars:
+      aditional_tempestconf_params: "auth.tempest_roles member"
       user: demo
       cloud_user: devstack
       test_demo: true
@@ -163,6 +164,7 @@
       Tempest job for python-tempestconf on a devstack environment with python3 enabled
       for demo users.
     vars:
+      aditional_tempestconf_params: "auth.tempest_roles member"
       tempestconf_pip_virtualenv_python: "python3"
       devstack_localrc:
         USE_PYTHON3: true

config_tempest/tests/test_users.py

@@ -28,6 +28,7 @@ class TestUsers(BaseConfigTempestTest):
         # Story 2003388
         super(TestUsers, self).setUp()
         self.conf = self._get_conf("v2.0", "v3")
+        self.conf.set("auth", "tempest_roles", "_member_")
         projects_client = self._get_clients(self.conf).projects
         users_client = self._get_clients(self.conf).users
         roles_client = self._get_clients(self.conf).roles

config_tempest/users.py

@@ -71,6 +71,16 @@ class Users(object):
         user_ids = [u['id'] for u in users['users'] if u['name'] == username]
         user_id = user_ids[0]
         roles = self.roles_client.list_roles()
+        # check auth.tempest_roles
+        roles_names = [r['name'] for r in roles['roles']]
+        if self._conf.get('auth', 'tempest_roles') not in roles_names:
+            # try 'member', usually it's present in a system
+            if 'member' in roles_names:
+                self._conf.set('auth', 'tempest_roles', 'member')
+            else:
+                # the default role/role given by user or 'member' role are not
+                # present in the system, remove the option completely
+                self._conf.remove_option('auth', 'tempest_roles')
         role_ids = [r['id'] for r in roles['roles'] if r['name'] == role_name]
         if not role_ids:
             if role_required:

doc/source/user/default.rst

@@ -28,6 +28,9 @@ Here is the list of tempest options, which are set by default:
     img_dir = etc
 
     [auth]
+    ; if _member_ role is not present in the system, python-tempestconf
+    ; looks for member role and if the member is also not present
+    ; tempest_roles option is not set
     tempest_roles = _member_
     admin_username = admin
     admin_project_name = admin

playbooks/python-tempestconf-tempest-devstack.yaml

@@ -35,7 +35,6 @@
       vars:
         create_accounts_file: True
         source_credentials_commands: "export HOST_IP={{ ansible_default_ipv4.address }}; source {{ devstack_base_dir }}/devstack/openrc {{ user }} {{ user }}; {{ set_auth_url }}"
-        aditional_tempestconf_params: "auth.tempest_roles Member"
     - name: Generate tempest configuration file based on cloud credentials
       include_role:
         name: generate-tempestconf-file-cloud