Use --non-admin for non admin users in zuul jobs

python-tempestconf-tempest-packstack/devstack-demo zuul job
uses generate-tempestconf-file role to generate tempest.conf.
Since demo is a non-admin user with non-admin user we cannot use
--create option but it was used since it is a bug, so we need to
check for admin/demo user then enable the proper option.

Used Jinja templates for creating tempest configuration script

Create test-demo-user role which prepares resources for a demo
user.
Create generate-accounts-file role, which generates accounts.yaml
file for Tempest needed for running tests as user who doesn't
have persmissions to create resources.

Change-Id: I727a6cfd154cb3f95c33da02440f25ae1765153f
Story: #2001695
Co-Authored-By: Martin Kopec <mkopec@redhat.com>

.zuul.yaml

@@ -66,6 +66,8 @@
     vars:
       user: demo
       cloud_user: devstack
+      test_demo: True
+      cloud_admin: devstack-admin
     irrelevant-files:
       - config_tempest/tests/.*$
       - ^doc/.*$
@@ -118,6 +120,8 @@
     vars:
       scenario: scenario000
       user: demo
+      test_demo: True
+      cloud_admin: packstack-admin
     irrelevant-files:
       - config_tempest/tests/.*$
       - ^doc/.*$

playbooks/python-tempestconf-tempest-devstack.yaml

@@ -12,6 +12,8 @@
     # (mkopec) That would end up with an HTTP MaxRetryError to <host>:5000,
     # therefor OS_AUTH_URL is defined manually
     set_auth_url: "OS_AUTH_URL=$SERVICE_PROTOCOL://$SERVICE_HOST/identity/v3"
+    devstack_base_dir: "/opt/stack"
+    test_demo_user: "{{ test_demo is defined }}"
   tasks:
     # setup-tempest-* and acl-devstack-files roles are inherited from
     # openstack/tempest project
@@ -36,7 +38,29 @@
     - name: Generate tempest configuration file based on cloud credentials
       include_role:
         name: generate-tempestconf-file-cloud
+    # Let's create tempest.conf with admin permissions needed for
+    # tempest accounts file generation
+    - name: Generate configuration file for Tempest as admin
+      include_role:
+        name: generate-tempestconf-file
+      vars:
+        aditional_tempestconf_params: "auth.tempest_roles Member"
+        output_path: "/etc/openstack/tempest_admin.conf"
+        source_credentials_commands: "export HOST_IP={{ ansible_default_ipv4.address }}; source {{ devstack_base_dir }}/devstack/openrc admin admin; {{ set_auth_url }}"
+        test_demo_user: False
+        user: admin
+      when: test_demo is defined
+    - name: Generate accounts file for Tempest
+      include_role:
+        name: generate-accounts-file
+      vars:
+        accounts_file_destination: "/etc/openstack"
+        source_credentials_commands: "export HOST_IP={{ ansible_default_ipv4.address }}; source {{ devstack_base_dir }}/devstack/openrc admin admin; {{ set_auth_url }}"
+        tempest_config_file: "/etc/openstack/tempest_admin.conf"
+      when: test_demo is defined
     # run-tempest role is inherited from openstack/tempest project
     - name: Run Tempest Tests
       include_role:
         name: run-tempest
+      vars:
+        tempest_concurrency: 2

playbooks/python-tempestconf-tempest-packstack.yaml

@@ -1,4 +1,6 @@
 - hosts: all
+  vars:
+    test_demo_user: "{{ test_demo is defined }}"
   tasks:
     # packstack-integration-tempest role is inherited from
     # openstack/packstack project
@@ -36,11 +38,30 @@
       vars:
         cloudname: "packstack-admin"
         source_credentials_commands: "source {{ ansible_user_dir }}/keystonerc_admin"
-    - name: Generate configuration file for python-tempestconf
+    - name: Generate configuration file for Tempest
       include_role:
         name: generate-tempestconf-file
       vars:
         source_credentials_commands: "source {{ ansible_user_dir }}/keystonerc_{{ user }}"
+    # Let's create tempest.conf with admin permissions needed for
+    # tempest accounts file generation
+    - name: Generate configuration file for Tempest as admin
+      include_role:
+        name: generate-tempestconf-file
+      vars:
+        output_path: "/etc/openstack/tempest_admin.conf"
+        source_credentials_commands: "source {{ ansible_user_dir }}/keystonerc_admin"
+        test_demo_user: False
+        user: admin
+      when: test_demo is defined
+    - name: Generate accounts file for Tempest
+      include_role:
+        name: generate-accounts-file
+      vars:
+        accounts_file_destination: "/etc/openstack"
+        source_credentials_commands: "source {{ ansible_user_dir }}/keystonerc_admin"
+        tempest_config_file: "/etc/openstack/tempest_admin.conf"
+      when: test_demo is defined
     # run-tempest role is inherited from openstack/tempest project
     - name: Run Tempest Tests
       include_role:

roles/create-clouds-yaml-file/tasks/main.yaml

@@ -2,15 +2,16 @@
     shell: |
       for key in $( set | awk '{FS="="}  /^OS_/ {print $1}' ); do unset $key ; done
       {{ source_credentials_commands }}
-      echo -n "{{cloudname}}: \
-        {'auth': \
-          { 'auth-url': '$OS_AUTH_URL', \
-            'username': '$OS_USERNAME', \
-            'password': '$OS_PASSWORD', \
-            $(if [ -n "$OS_USER_DOMAIN_NAME" ]; then echo "'user_domain_name': '${OS_USER_DOMAIN_NAME}',"; fi) \
-            $(if [ -n "$OS_PROJECT_DOMAIN_NAME" ]; then echo "'project_domain_name': '${OS_PROJECT_DOMAIN_NAME}',"; fi) \
-            'project-name': '${OS_PROJECT_NAME:-$OS_TENANT_NAME}' \
-          } $(if [ -n "$OS_IDENTITY_API_VERSION" ]; then echo ", 'identity_api_version': '${OS_IDENTITY_API_VERSION}'"; fi) }"
+      echo -n "clouds: \
+        { {{cloudname}}: \
+            {'auth': \
+              { 'auth-url': '$OS_AUTH_URL', \
+                'username': '$OS_USERNAME', \
+                'password': '$OS_PASSWORD', \
+                $(if [ -n "$OS_USER_DOMAIN_NAME" ]; then echo "'user_domain_name': '${OS_USER_DOMAIN_NAME}',"; fi) \
+                $(if [ -n "$OS_PROJECT_DOMAIN_NAME" ]; then echo "'project_domain_name': '${OS_PROJECT_DOMAIN_NAME}',"; fi) \
+                'project-name': '${OS_PROJECT_NAME:-$OS_TENANT_NAME}' \
+              } $(if [ -n "$OS_IDENTITY_API_VERSION" ]; then echo ", 'identity_api_version': '${OS_IDENTITY_API_VERSION}'"; fi) } }"
     register: cloud_details
     args:
       executable: /bin/bash
@@ -47,3 +48,8 @@
     with_items:
       - "{{ cloud_details.stdout|from_yaml|to_nice_yaml(indent=4) }}"
 
+  - name: Cat the created clouds.yaml file
+    become: yes
+    shell: |
+        set -ex
+        cat {{ clouds_file_path }}

roles/create-keystonerc-files/tasks/main.yaml

@@ -1,6 +1,5 @@
 - debug:
       var: ansible_all_ipv4_addresses
-      var: ansible_default_ipv4.address
 
 - name: Create keystonerc_admin file
   shell: |

roles/generate-accounts-file/README.rst

@@ -0,0 +1,65 @@
+# Generate accounts.yaml file for tempest
+
+Installs tempest cloned from git and generates accounts.yaml file.
+accounts.yaml file will be saved inside the cloned folder in etc/ subfolder.
+
+The tempest configuration file, which is needed to generate tempest
+accounts.yaml file will be copied into etc/ as well, however it will be
+renamed to tempest_admin.conf so that, it doesn't conflict with tempest.conf
+which may be there.
+
+
+**Role Variables**
+
+.. zuul:rolevar:: tempest_concurrency
+   :default: 2
+
+    The number of parallel test processes.
+
+.. zuul:rolevar:: tempest_config_file
+   :type: string
+   :default: None
+
+    A path to a tempest configuration file. It must contain credentials
+    which allows to create resources.
+
+.. zuul:rolevar: source_credentials_commands
+   :type: string
+   :default: None
+
+   Commands divided by a semicolon which defines sourcing credentials for
+   a user who has permissions to create resources. They need to be defined
+   in the playbook the role is called from.
+   For example for devstack:
+
+   `source ./openrc admin admin`
+
+   and for packstack:
+
+   `source ./keystonerc_admin`
+
+.. zuul:rolevar:: virtualenvs
+   :type: dict
+
+    A dictionary of paths to virtual environments.
+
+   .. zuul:rolevar:: tempest
+      :default: ~/.virtualenvs/.tempest
+
+       The path to the virtual environment of Tempest.
+
+.. zuul:rolevar:: tempest_src_relative_path
+   :type: string
+
+    A relative path to Tempest project which is by default cloned to the
+    Zuul home directory. Value of the variable is set in the role to that
+    default path. If needed, the variable can be overridden from the
+    playbook where the role is called.
+
+.. zuul:rolevar:: accounts_file_destination
+   :type: string
+   :default: None
+
+    If the variable is defined, the newly generated accounts.yaml file
+    will be copied to the directory specified by the variable.
+

roles/generate-accounts-file/defaults/main.yaml

@@ -0,0 +1,3 @@
+tempest_concurrency: 2
+virtualenvs:
+    tempest: ~/.virtualenvs/.tempest

roles/generate-accounts-file/tasks/main.yaml

@@ -0,0 +1,80 @@
+- block:
+  - name: Create tempest venv with latest pip, setuptools and pbr
+    pip:
+       virtualenv: "{{ virtualenvs.tempest }}"
+       name: "{{ item }}"
+       state: latest
+    with_items:
+       - pip
+       - setuptools
+       - pbr
+
+  - name: Install tempest
+    pip:
+        name: "."
+        virtualenv: "{{ virtualenvs.tempest }}"
+        chdir: "{{ tempest_src_relative_path }}"
+
+  # Need to have these tasks until this bug:
+  # https://bugs.launchpad.net/tempest/+bug/1624066 is resolved
+  # (mkopec) The bug should be resolved, but it's probably not,
+  # so meanwhile let's have these tasks
+  - name: Backup etc/tempest.conf if exists
+    shell: |
+        mv ./etc/tempest.conf ./etc/tempest.conf.orig
+    ignore_errors: yes
+    args:
+        executable: /bin/bash
+        chdir: "{{ tempest_src_relative_path }}"
+
+  - name: Copy the provided tempest.conf to etc/
+    become: yes
+    shell: |
+        set -ex
+        cp {{ tempest_config_file }} ./etc/tempest.conf
+        ls -all ./etc/
+    args:
+        executable: /bin/bash
+        chdir: "{{ tempest_src_relative_path }}"
+
+  - name: Generate tempest accounts.yaml file
+    shell: |
+        set -ex
+        export PATH=$PATH:/usr/local/sbin:/usr/sbin
+        source {{ virtualenvs.tempest }}/bin/activate
+        {{ source_credentials_commands }}
+        printenv
+        tempest account-generator \
+            --config-file ./etc/tempest.conf \
+            --concurrency {{ tempest_concurrency }} \
+            etc/accounts.yaml
+    args:
+        executable: /bin/bash
+        chdir: "{{ tempest_src_relative_path }}"
+
+  - name: Restore etc/tempest.conf
+    shell: |
+        mv ./etc/tempest.conf.orig ./etc/tempest.conf
+    ignore_errors: yes
+    args:
+        executable: /bin/bash
+        chdir: "{{ tempest_src_relative_path }}"
+
+  - name: Cat generated accounts.yaml file
+    shell: |
+        cat ./etc/accounts.yaml
+    args:
+       executable: /bin/bash
+       chdir: "{{ tempest_src_relative_path }}"
+
+  - name: Copy generated accounts.yaml file
+    become: yes
+    shell: |
+        cp ./etc/accounts.yaml {{ accounts_file_destination }}/accounts.yaml
+    args:
+       executable: /bin/bash
+       chdir: "{{ tempest_src_relative_path }}"
+    when: accounts_file_destination is defined
+
+  vars:
+    tempest_src_relative_path: "{{ zuul.projects['git.openstack.org/openstack/tempest'].src_dir }}"

roles/generate-tempestconf-file/README.rst

@@ -1,4 +1,4 @@
-Generate configuration file for tempest
+# Generate configuration file for tempest
 
 Installs python-tempestconf cloned from git and generates tempest.conf which
 is then copied to tempest directory.
@@ -58,3 +58,42 @@ is then copied to tempest directory.
    Additional parameters for tempestconf if more specific parameters are
    needed, different from the ones which are the same for devstack and tempest.
 
+.. zuul:rolevar:: test_demo_user
+   :type: Boolean
+   :default: False
+
+   If checking of demo user abilities is desired to be enabled, set this
+   variable to True.
+   When True, a set of tasks, where generation of tempest configuration is
+   intended to fail, is included. The set includes also tasks, which create
+   tempest resources. After that, the generation of the tempest configuration is
+   suppossed to pass.
+   NOTE: If the variable is set to True, it's needed to set cloud_admin variable
+   as well, see info below.
+
+.. zuul:rolevar:: output_path
+   :type: string
+   :default: None
+
+   If the variable is defined, the newly generated tempest.conf will be saved
+   accordingly.
+   Example:
+   output_path: /etc/openstack/tempest.conf
+   Result:
+   The generated tempest.conf file will be saved as /etc/openstack/tempest.conf
+
+.. zuul:rolevar:: cloud_admin
+   :type: string
+   :default: None
+
+   Name of credentials from clouds.yaml file, which will be used to create
+   tempest resources in case, test_demo_user variable is set to True.
+
+.. zuul:rolevar:: test_accounts_file
+   :type: string
+   :default: /etc/openstack/accounts.yaml
+
+   A path to a tempest accounts file. This path will be injected to
+   test_accounts_file option in auth section of tempest.conf, when
+   test_demo_user is set to True.
+

roles/generate-tempestconf-file/defaults/main.yaml

@@ -1,5 +1,8 @@
 devstack_base_dir: /opt/stack
 virtualenvs:
+    tempest: ~/.virtualenvs/.tempest
     tempestconf: ~/.virtualenvs/.tempestconf
 url_cirros_image: "http://download.cirros-cloud.net/0.3.5/cirros-0.3.5-x86_64-disk.img"
 aditional_tempestconf_params: ""
+test_demo_user: False
+test_accounts_file: /etc/openstack/accounts.yaml

roles/generate-tempestconf-file/tasks/generate-tempestconf.sh.j2

@@ -0,0 +1,22 @@
+# Script to generate tempest.conf
+set -ex
+export PATH=$PATH:/usr/local/sbin:/usr/sbin
+source {{ virtualenvs.tempestconf }}/bin/activate
+{{ source_credentials_commands }}
+printenv
+discover-tempest-config \
+--debug \
+-v \
+{% if user == "admin" %}
+--create \
+{% else %}
+--non-admin \
+{% endif %}
+{% if test_demo_user %}
+--test-accounts {{ test_accounts_file }} \
+{% endif %}
+identity.uri $OS_AUTH_URL \
+identity.admin_password $OS_PASSWORD \
+service_available.swift False \
+{{ aditional_tempestconf_params }} \
+image.http_image {{ url_cirros_image }}

roles/generate-tempestconf-file/tasks/main.yaml

@@ -12,7 +12,7 @@
         - setuptools
         - pbr
 
-  - name: Debug, list tempetsconf dir
+  - name: Debug, list tempestconf dir
     shell: |
         set -ex
         ls -all .
@@ -34,34 +34,42 @@
     args:
        executable: /bin/bash
 
-  - name: Generate tempest configuration file
-    shell: |
-        set -ex
-        export PATH=$PATH:/usr/local/sbin:/usr/sbin
-        source {{ virtualenvs.tempestconf }}/bin/activate
-        {{ source_credentials_commands }}
-        printenv
-        discover-tempest-config \
-          --debug \
-          -v \
-          --create \
-          identity.uri $OS_AUTH_URL \
-          identity.admin_password $OS_PASSWORD \
-          service_available.swift False \
-          {{ aditional_tempestconf_params }} \
-          image.http_image {{ url_cirros_image }}
-    args:
-        chdir: "{{ tempestconf_src_relative_path }}"
-        executable: /bin/bash
+  - name: Generate tempest configuration script
+    template:
+        src: generate-tempestconf.sh.j2
+        dest: "{{ tempestconf_src_relative_path }}/generate-tempestconf.sh"
+        mode: 0744
 
-  - name: Print generated tempest.conf and copy it to tempest directory
+  - include: test-demo-user.yaml
+    when: test_demo_user
+
+  - name: Generate tempest configuration filea
+    shell: |
+        ./generate-tempestconf.sh
+    args:
+      chdir: "{{ tempestconf_src_relative_path }}"
+      executable: /bin/bash
+
+  - name: Print generated tempest.conf
     shell: |
         set -x
-        cat {{ tempestconf_src_relative_path }}/etc/tempest.conf
-        ls /opt/stack/
-        ls /opt/stack/tempest
         ls /opt/stack/tempest/etc
+        cat {{ tempestconf_src_relative_path }}/etc/tempest.conf
+
+  # tempest role which will run tests has tempest in {{ devstack_base_dir }}
+  # location, therefore the file is copied there
+  - name: Copy tempest.conf to the tempest directory
+    shell: |
+        set -x
         cp {{ tempestconf_src_relative_path }}/etc/tempest.conf {{ devstack_base_dir }}/tempest/etc/tempest.conf
+    when: output_path is not defined
+
+  - name: Copy tempest.conf to the specified location
+    become: yes
+    shell: |
+        set -x
+        cp  {{ tempestconf_src_relative_path }}/etc/tempest.conf {{ output_path }}
+    when: output_path is defined
 
   vars:
     tempestconf_src_relative_path: "{{ zuul.projects['git.openstack.org/openstack/python-tempestconf'].src_dir }}"

roles/generate-tempestconf-file/tasks/test-demo-user.yaml

@@ -0,0 +1,40 @@
+  - name: Generate tempest configuration file as demo user (expected to fail)
+    shell: |
+        ./generate-tempestconf.sh
+    args:
+      chdir: "{{ tempestconf_src_relative_path }}"
+      executable: /bin/bash
+    register: result
+    failed_when: result.rc == 0
+
+  - name: Create m1.nano and m1.micro flavors for demo user
+    shell: |
+        set -x
+        openstack flavor create --os-cloud {{ cloud_admin }} \
+          --public \
+          --ram {{ item.ram }} \
+          --vcpus 1 \
+          --disk 0 \
+          {{ item.name }}
+    with_items:
+      - { name: "m1.nano", ram: 64 }
+      - { name: "m1.micro", ram: 128 }
+
+  - name: Download cirros image
+    get_url:
+      url: "{{ url_cirros_image }}"
+      dest: "{{ tempestconf_src_relative_path }}/etc/"
+      mode: 0660
+
+  - name: Create image and image alt for demo user
+    shell: |
+        set -x
+        openstack image create --os-cloud {{ cloud_admin }} \
+          --disk-format qcow2 \
+          --public \
+          --file {{ tempestconf_src_relative_path }}/etc/{{ url_cirros_image | basename }} \
+          {{ item }}
+    with_items:
+      - "{{ url_cirros_image | basename }}"
+      - '{{ url_cirros_image | basename }}_alt'
+