DNM: enforced-scope test

Change-Id: Ie74709072d014a6b71249e8c707ae45232f6f357

.zuul.yaml

@@ -1,31 +1,52 @@
 - project:
-    templates:
-      - openstack-cover-jobs
-      - openstack-python3-zed-jobs
-      - release-notes-jobs-python3
     check:
       jobs:
         - python-tempestconf-tempest-devstack-admin
-        # TODO(kopecmartin) this job requires the following fix on devstack's
-        # side - https://review.opendev.org/c/openstack/devstack/+/844774
-        # Although that fix requires further work so in the meantime let's
-        # mark this job as non-voting to unblock the gates
-        - python-tempestconf-tempest-devstack-admin-victoria:
-            voting: false
+        #- python-tempestconf-tempest-devstack-admin-ussuri
+        #- python-tempestconf-tempest-devstack-admin-victoria
+        #- python-tempestconf-tempest-devstack-admin-wallaby
+        #- python-tempestconf-tempest-devstack-admin-xena
+        #- python-tempestconf-tempest-devstack-admin-yoga
+        #- python-tempestconf-tempest-devstack-demo
+        #- python-tempestconf-tempest-devstack-admin-plugins
+        #- python-tempestconf-tempest-packstack-admin:
+        #    voting: false
+        #- python-tempestconf-tempest-packstack-demo:
+        #    voting: false
+        #- refstack-client-devstack-master:
+        #- tripleo-ci-centos-9-content-provider:
+        #    irrelevant-files: *irrelevant-files
+        #- tripleo-ci-centos-9-scenario002-standalone:
+        #    irrelevant-files: *irrelevant-files
+        #    dependencies:
+        #      - tripleo-ci-centos-9-content-provider
+        #- tripleo-ci-centos-9-standalone:
+        #    irrelevant-files: *irrelevant-files
+        #    vars: *standalone
+        #    dependencies:
+        #      - tripleo-ci-centos-9-content-provider
+        #- tripleo-ci-centos-9-scenario010-standalone:
+        #    irrelevant-files: *irrelevant-files
+        #    voting: false
+        #    vars:
+        #      consumer_job: true
+        #      build_container_images: false
+        #      tags:
+        #        - standalone
+        #        - octavia
+        #    dependencies:
+        #      - tripleo-ci-centos-9-content-provider
+        #- opendev-tox-docs
+    gate:
+      jobs:
+        - python-tempestconf-tempest-devstack-admin
+        - python-tempestconf-tempest-devstack-admin-ussuri
+        - python-tempestconf-tempest-devstack-admin-victoria
         - python-tempestconf-tempest-devstack-admin-wallaby
         - python-tempestconf-tempest-devstack-admin-xena
         - python-tempestconf-tempest-devstack-admin-yoga
         - python-tempestconf-tempest-devstack-demo
         - python-tempestconf-tempest-devstack-admin-plugins
-        - python-tempestconf-tempest-packstack-admin:
-            voting: false
-        - python-tempestconf-tempest-packstack-demo:
-            voting: false
-        # TODO(kopecmartin) refstack-client jobs are broken - tempest version
-        # in those jobs must be bumped in order to be incompatible with
-        # manila-tempest-plugin - right now they fail to install the plugin,
-        # until the following patch is merged, let's mark this non-voting
-        # https://review.opendev.org/c/openinfra/refstack-client/+/846370
         - refstack-client-devstack-master:
             voting: false
             irrelevant-files: &irrelevant-files
@@ -49,50 +70,6 @@
             vars: *standalone
             dependencies:
               - tripleo-ci-centos-9-content-provider
-        - tripleo-ci-centos-9-scenario010-standalone:
-            irrelevant-files: *irrelevant-files
-            voting: false
-            vars:
-              consumer_job: true
-              build_container_images: false
-              tags:
-                - standalone
-                - octavia
-            dependencies:
-              - tripleo-ci-centos-9-content-provider
-        - opendev-tox-docs
-    gate:
-      jobs:
-        - python-tempestconf-tempest-devstack-admin
-        # TODO(kopecmartin) this job requires the following fix on devstack's
-        # side - https://review.opendev.org/c/openstack/devstack/+/844774
-        # Although that fix requires further work so in the meantime let's
-        # mark this job as non-voting to unblock the gates
-        #- python-tempestconf-tempest-devstack-admin-victoria
-        - python-tempestconf-tempest-devstack-admin-wallaby
-        - python-tempestconf-tempest-devstack-admin-xena
-        - python-tempestconf-tempest-devstack-admin-yoga
-        - python-tempestconf-tempest-devstack-demo
-        - python-tempestconf-tempest-devstack-admin-plugins
-        # TODO(kopecmartin) refstack-client jobs are broken - tempest version
-        # in those jobs must be bumped in order to be incompatible with
-        # manila-tempest-plugin - right now they fail to install the plugin,
-        # until the following patch is merged, let's skip this job
-        # https://review.opendev.org/c/openinfra/refstack-client/+/846370
-        #- refstack-client-devstack-master:
-        #    irrelevant-files: *irrelevant-files
-        - tripleo-ci-centos-9-content-provider:
-            irrelevant-files: *irrelevant-files
-        - tripleo-ci-centos-9-scenario002-standalone:
-            irrelevant-files: *irrelevant-files
-            vars: *standalone
-            dependencies:
-              - tripleo-ci-centos-9-content-provider
-        - tripleo-ci-centos-9-standalone:
-            irrelevant-files: *irrelevant-files
-            vars: *standalone
-            dependencies:
-              - tripleo-ci-centos-9-content-provider
         - opendev-tox-docs
     promote:
       jobs:
@@ -163,6 +140,48 @@
         barbican: True
     irrelevant-files: *irrelevant-files
 
+- job:
+    name: python-tempestconf-devstack-enforced-scope
+    parent: devstack
+    description: Base job for python-tempestconf on a devstack environment
+    required-projects:
+      - openstack/heat
+      - openstack/python-manilaclient
+      - openinfra/python-tempestconf
+      - openstack/tempest
+      - openstack/devstack
+      - openstack/designate
+      - openstack/designate-tempest-plugin
+      - openstack/requirements
+    roles:
+      - zuul: openinfra/python-tempestconf
+      - zuul: openstack/tempest
+      - zuul: openstack/devstack
+    vars:
+      zuul_copy_output:
+        '{{ devstack_base_dir }}/tempest/tempest.log': logs
+        '{{ devstack_base_dir }}/tempest/etc/tempest.conf': logs
+        '{{ zuul.project.src_dir }}/etc/accounts.yaml': logs
+      tempestconf_pip_virtualenv_python: "python3"
+      devstack_plugins:
+        heat: https://opendev.org/openstack/heat
+        designate: https://opendev.org/openstack/designate
+      devstack_localrc:
+        USE_PYTHON3: True
+        LIBS_FROM_GIT: python-manilaclient
+      devstack_services:
+        h-eng: True
+        h-api: True
+        h-api-cfn: True
+        h-api-cw: True
+        designate: True
+        designate-central: True
+        designate-api: True
+        designate-worker: True
+        designate-producer: True
+        designate-mdns: True
+    irrelevant-files: *irrelevant-files
+
 - job:
     name: python-tempestconf-packstack-base
     parent: packstack-centos8s
@@ -221,7 +240,7 @@
 
 - job:
     name: python-tempestconf-tempest-devstack-admin
-    parent: python-tempestconf-devstack-base
+    parent: python-tempestconf-devstack-enforced-scope
     description: |
       Tempest job for python-tempestconf on a devstack environment as the admin user.
     run: playbooks/python-tempestconf-tempest-devstack.yaml
@@ -229,6 +248,12 @@
       user: admin
       cloud_user: devstack-admin
       tempest_concurrency: 2
+      devstack_localrc:
+        ENFORCE_SCOPE: true
+      devstack_services:
+        barbican: false
+        manila: false
+      
 
 - job:
     name: python-tempestconf-tempest-devstack-admin-victoria
@@ -329,4 +354,4 @@
     vars:
       user: demo
       test_demo: true
-      cloud_admin: packstack-admin
+      cloud_admin: packstack-admin

config_tempest/credentials.py

@@ -157,7 +157,8 @@ class Credentials(object):
                 self.tempest_creds,
                 self._conf.get_defaulted('identity', 'uri_v3'),
                 self.disable_ssl_certificate_validation,
-                self.ca_certs)
+                self.ca_certs,
+                scope='system')
         else:
             return auth.KeystoneV2AuthProvider(
                 self.tempest_creds,