openstack/barbican-tempest-plugin
Code Issues Proposed changes

Merge "Add enable_certificate_validation config option"

Browse Source
This commit is contained in:
Zuul 2023-05-04 08:42:21 +00:00 committed by Gerrit Code Review
commit dba97635a1
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
barbican_tempest_plugin/config.py
View File

@ -95,6 +95,10 @@ ImageSignatureVerificationGroup = [
default=True, default=True,
help="Does the test environment enforce glance image " help="Does the test environment enforce glance image "
"verification?"), "verification?"),
cfg.BoolOpt('certificate_validation',
default=True,
help="Does the test environment enforce image signature"
"certificate validation?")
] ]
barbican_rbac_scope_verification_group = cfg.OptGroup( barbican_rbac_scope_verification_group = cfg.OptGroup(

4
barbican_tempest_plugin/tests/scenario/test_certificate_validation.py
View File

@ -11,6 +11,7 @@
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations # License for the specific language governing permissions and limitations
# under the License. # under the License.
import testtools
from oslo_log import log as logging from oslo_log import log as logging
from tempest.common import utils from tempest.common import utils
@ -79,6 +80,9 @@ class CertificateValidationTest(barbican_manager.BarbicanScenarioTest):
@decorators.idempotent_id('6d354881-35a6-4568-94b8-2204bbf67b29') @decorators.idempotent_id('6d354881-35a6-4568-94b8-2204bbf67b29')
@utils.services('compute', 'image') @utils.services('compute', 'image')
@testtools.skipUnless(
CONF.image_signature_verification.certificate_validation,
"Image signature certificate validation is not enforced")
def test_signed_image_invalid_cert_boot_failure(self): def test_signed_image_invalid_cert_boot_failure(self):
"""Test that Nova refuses to boot an unvalidated signed image. """Test that Nova refuses to boot an unvalidated signed image.