Fix breaking typo and add functional test

Review [1] added a breaking typo to tasks/tempest_install.yml, which
we correct in this commit.

Additionally, this commit adds a functional test to os_tempest role
which deploys os_tempest itself and then runs some arbitrary keystone
tempest tests.  Having this test in place will prevent basic issues
like the one introduced in [1] from being commited.

Note that we deploy galera into a container, however we can probably
skip that.  Having it in a container gives us the ability to easily add
in more services if necessary.  The installation of rabbitmq has been
excluded since that should not be necessary in the context of this
testing.

[1] https://review.openstack.org/#/c/309034/

Change-Id: I144118b5e70f558554107345088cb36693a85e25

tasks/tempest_install.yml

@@ -130,7 +130,7 @@
     dest: "/opt/{{ item.name }}_{{ item.branch|replace('/', '_') }}"
     version: "{{ item.branch }}"
     force: yes
-  with_items: "{{ tempest_plugins) }}"
+  with_items: "{{ tempest_plugins }}"
   register: git_clone
   until: git_clone|success
   retries: 5

tests/ansible-role-requirements.yml

@@ -10,6 +10,30 @@
   src: https://git.openstack.org/openstack/openstack-ansible-pip_lock_down
   scm: git
   version: master
+- name: memcached_server
+  src: https://git.openstack.org/openstack/openstack-ansible-memcached_server
+  scm: git
+  version: master
+- name: lxc_hosts
+  src: https://git.openstack.org/openstack/openstack-ansible-lxc_hosts
+  scm: git
+  version: master
+- name: lxc_container_create
+  src: https://git.openstack.org/openstack/openstack-ansible-lxc_container_create
+  scm: git
+  version: master
+- name: galera_client
+  src: https://git.openstack.org/openstack/openstack-ansible-galera_client
+  scm: git
+  version: master
+- name: galera_server
+  src: https://git.openstack.org/openstack/openstack-ansible-galera_server
+  scm: git
+  version: master
+- name: os_keystone
+  src: https://git.openstack.org/openstack/openstack-ansible-os_keystone
+  scm: git
+  version: master
 - name: openstack_openrc
   src: https://git.openstack.org/openstack/openstack-ansible-openstack_openrc
   scm: git

tests/group_vars/all_containers.yml

@@ -0,0 +1,27 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ansible_ssh_host: "{{ ansible_host }}"
+container_name: "{{ inventory_hostname }}"
+container_networks:
+  management_address:
+    address: "{{ ansible_host }}"
+    bridge: "lxcbr0"
+    interface: "eth1"
+    netmask: "255.255.252.0"
+    type: "veth"
+physical_host: localhost
+properties:
+  service_name: "{{ inventory_hostname }}"

tests/inventory

@@ -1,2 +1,15 @@
 [all]
 localhost ansible_connection=local ansible_become=True
+infra1 ansible_host=10.100.100.2 ansible_become=True ansible_user=root
+
+[all_containers]
+infra1
+
+[galera_all]
+infra1
+
+[service_all:children]
+galera_all
+
+[keystone_all]
+infra1

tests/test-install-infra.yml

@@ -0,0 +1,30 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Playbook for deploying infra services
+  hosts: service_all
+  user: root
+  gather_facts: true
+  roles:
+    - role: "galera_server"
+      galera_root_password: secrete
+      galera_root_user: root
+      galera_innodb_buffer_pool_size: 512M
+      galera_innodb_log_buffer_size: 32M
+      galera_server_id: "{{ inventory_hostname | string_2_int }}"
+      galera_wsrep_node_name: "{{ inventory_hostname }}"
+      galera_wsrep_provider_options:
+        - { option: "gcache.size", value: "32M" }
+      galera_server_id: "{{ inventory_hostname | string_2_int }}"

tests/test-install-keystone.yml

@@ -0,0 +1,48 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Playbook for deploying keystone
+  hosts: keystone_all
+  user: root
+  gather_facts: true
+  pre_tasks:
+    - name: Create DB for service
+      mysql_db:
+        login_user: "root"
+        login_password: "secrete"
+        login_host: "localhost"
+        name: "{{ keystone_galera_database }}"
+        state: "present"
+      delegate_to: "10.100.100.2"
+      when: inventory_hostname == groups['keystone_all'][0]
+    - name: Grant access to the DB for the service
+      mysql_user:
+        login_user: "root"
+        login_password: "secrete"
+        login_host: "localhost"
+        name: "{{ keystone_galera_database }}"
+        password: "{{ keystone_container_mysql_password }}"
+        host: "{{ item }}"
+        state: "present"
+        priv: "{{ keystone_galera_database }}.*:ALL"
+      with_items:
+        - "localhost"
+        - "%"
+      delegate_to: "10.100.100.2"
+      when: inventory_hostname == groups['keystone_all'][0]
+  roles:
+    - role: os_keystone
+  vars_files:
+    - test-vars.yml

tests/test-install-tempest.yml

@@ -0,0 +1,24 @@
+
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Playbook for deploying tempest
+  hosts: infra1
+  user: root
+  gather_facts: true
+  roles:
+    - role: "{{ rolename | basename }}"
+  vars_files:
+    - test-vars.yml

tests/test-prepare-containers.yml

@@ -0,0 +1,33 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Playbook for creating containers
+  hosts: all_containers
+  connection: local
+  gather_facts: false
+  roles:
+    - role: "lxc_container_create"
+      lxc_container_release: trusty
+      lxc_container_backing_store: dir
+      global_environment_variables:
+        PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+  post_tasks:
+    - name: Wait for ssh to be available
+      local_action:
+        module: wait_for
+        port: "{{ ansible_ssh_port | default('22') }}"
+        host: "{{ ansible_ssh_host | default(inventory_hostname) }}"
+        search_regex: OpenSSH
+        delay: 1

tests/test-prepare-host.yml

@@ -0,0 +1,60 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Playbook for configuring LXC host
+  hosts: localhost
+  pre_tasks:
+    # Make sure OS does not have a stale package cache.
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+      when: ansible_os_family == 'Debian'
+    - name: Ensure root's new public ssh key is in authorized_keys
+      authorized_key:
+        user: root
+        key: "{{ hostvars['localhost']['lxc_container_ssh_key'] }}"
+        manage_dir: no
+    - set_fact:
+        lxc_container_ssh_key: "{{ hostvars['localhost']['lxc_container_ssh_key'] }}"
+    - name: Check if this is an OpenStack-CI nodepool instance
+      stat:
+        path: /etc/nodepool/provider
+      register: nodepool
+    - name: Set the files to copy into the container cache for OpenStack-CI instances
+      set_fact:
+        lxc_container_cache_files:
+          - { src: '/etc/pip.conf', dest: '/etc/pip.conf' }
+          - { src: '/etc/apt/apt.conf.d/99unauthenticated', dest: '/etc/apt/apt.conf.d/99unauthenticated' }
+      when: nodepool.stat.exists | bool
+    - name: Determine the existing Ubuntu repo configuration
+      shell: 'awk "/^deb .*ubuntu\/? {{ ansible_distribution_release }} main/ {print \$2; exit}" /etc/apt/sources.list'
+      register: ubuntu_repo
+      changed_when: false
+    - name: Set apt repo facts based on discovered information
+      set_fact:
+        lxc_container_template_main_apt_repo: "{{ ubuntu_repo.stdout }}"
+        lxc_container_template_security_apt_rep: "{{ ubuntu_repo.stdout }}"
+  roles:
+    - role: "lxc_hosts"
+      lxc_net_address: 10.100.100.1
+      lxc_net_dhcp_range: 10.100.100.8,10.100.100.253
+      lxc_net_bridge: lxcbr0
+      lxc_kernel_options:
+        - { key: 'fs.inotify.max_user_instances', value: 1024 }
+      lxc_container_caches:
+        - url: "https://rpc-repo.rackspace.com/container_images/rpc-trusty-container.tgz"
+          name: "trusty.tgz"
+          sha256sum: "56c6a6e132ea7d10be2f3e8104f47136ccf408b30e362133f0dc4a0a9adb4d0c"
+          chroot_path: trusty/rootfs-amd64

tests/test-prepare-keys.yml

@@ -0,0 +1,33 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# NOTE: we use become_user because setting become: no or become: false
+#       doesn't seem to override the ansible_become=true in the
+#       inventory
+- name: Playbook for establishing ssh keys
+  hosts: localhost
+  become_user: "{{ ansible_ssh_user }}"
+  pre_tasks:
+    - name: Create ssh key pair for root
+      user:
+        name: "{{ ansible_ssh_user }}"
+        generate_ssh_key: "yes"
+        ssh_key_bits: 2048
+        ssh_key_file: ".ssh/id_rsa"
+    - name: Get the calling user's key
+      command: cat ~/.ssh/id_rsa.pub
+      register: key_get
+    - set_fact:
+        lxc_container_ssh_key: "{{ key_get.stdout }}"

tests/test-tempest-functional.yml

@@ -0,0 +1,28 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Playbook for functional testing of tempest
+  hosts: keystone_all
+  user: root
+  gather_facts: false
+  tasks:
+    - name: Run tempest
+      shell: |
+        . /opt/tempest_{{ tempest_git_install_branch }}/bin/activate
+        /opt/tempest_{{ tempest_git_install_branch }}/run_tempest.sh --no-virtual-env ${RUN_TEMPEST_OPTS} tempest.api.identity.v3
+      environment:
+        RUN_TEMPEST_OPTS: "--serial"
+  vars_files:
+    - test-vars.yml

tests/test-vars.yml

@@ -0,0 +1,54 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+external_lb_vip_address: 10.100.100.2
+galera_client_drop_config_file: false
+internal_lb_vip_address: 10.100.100.2
+keystone_admin_tenant_name: admin
+keystone_admin_user_name: admin
+keystone_auth_admin_password: "SuperSecretePassword"
+keystone_container_mysql_password: "SuperSecrete"
+keystone_developer_mode: true
+keystone_galera_address: 10.100.100.2
+keystone_galera_database: keystone
+keystone_git_install_branch: master
+keystone_messaging_enabled: false
+keystone_requirements_git_install_branch: master
+keystone_service_adminuri: "http://{{ internal_lb_vip_address }}:35357"
+keystone_service_adminuri_insecure: false
+keystone_service_adminurl: "{{ keystone_service_adminuri }}/v3"
+keystone_service_internaluri: "http://{{ internal_lb_vip_address }}:5000"
+keystone_service_internaluri_insecure: false
+keystone_service_internalurl: "{{ keystone_service_internaluri }}/v3"
+keystone_service_password: "secrete"
+keystone_venv_tag: "testing"
+openrc_os_auth_url: "http://127.0.0.1:5000/v3"
+openrc_os_domain_name: "Default"
+openrc_os_password: "{{ keystone_auth_admin_password }}"
+tempest_developer_mode: True
+tempest_git_repo: https://git.openstack.org/openstack/tempest
+tempest_git_install_branch: 534a8dc60dfef116156b8f9ee60071a9bf4e4f90
+tempest_git_dest: "/opt/tempest_{{ tempest_git_install_branch | replace('/', '_') }}"
+tempest_log_dir: "/var/log/"
+tempest_main_group: keystone_all
+tempest_service_available_aodh: False
+tempest_service_available_ceilometer: False
+tempest_service_available_cinder: False
+tempest_service_available_glance: False
+tempest_service_available_heat: False
+tempest_service_available_horizon: False
+tempest_service_available_neutron: False
+tempest_service_available_nova: False
+tempest_service_available_swift: False

tests/test.yml

@@ -13,8 +13,23 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: Playbook for role testing
-  hosts: localhost
-  connection: local
-  roles:
-    - role: "{{ rolename | basename }}"
+# Prepare the user ssh keys
+- include: test-prepare-keys.yml
+
+# Prepare the host
+- include: test-prepare-host.yml
+
+# Prepare the containers
+- include: test-prepare-containers.yml
+
+# Install RabbitMQ/MariaDB
+- include: test-install-infra.yml
+
+# Install Keystone
+- include: test-install-keystone.yml
+
+# Install Tempest
+- include: test-install-tempest.yml
+
+# Test Tempest
+- include: test-tempest-functional.yml

tox.ini

@@ -15,6 +15,7 @@ whitelist_externals =
     bash
     git
     rm
+    wget
 setenv =
     VIRTUAL_ENV={envdir}
     ANSIBLE_HOST_KEY_CHECKING = False
@@ -105,20 +106,20 @@ commands =
 
 [testenv:functional]
 commands =
-    echo -e "\n *******************************************************\n" \
-            "**** Functional Testing is still to be implemented ****\n" \
-            "**** TODO: Write tests here                        ****\n" \
-            "*******************************************************\n"
-    # As a temporary measure, while functional testing is being worked on, we
-    # will not execute the functional test. This allows other patches to be
-    # worked on while the functional testing is being worked out.
-    #rm -rf {homedir}/.ansible
-    #git clone https://git.openstack.org/openstack/openstack-ansible-plugins \
-    #          {homedir}/.ansible/plugins
-    #ansible-playbook -i {toxinidir}/tests/inventory \
-    #                 -e "rolename={toxinidir}" \
-    #                 -vv \
-    #                 {toxinidir}/tests/test.yml
+    rm -rf {homedir}/.ansible
+    git clone https://git.openstack.org/openstack/openstack-ansible-plugins \
+              {homedir}/.ansible/plugins
+    # This plugin makes the ansible-playbook output easier to read
+    wget -O {homedir}/.ansible/plugins/callback/human_log.py \
+      https://gist.githubusercontent.com/cliffano/9868180/raw/f360f306b3c6d689734a6aa8773a00edf16a0054/human_log.py
+    ansible-galaxy install \
+                   --role-file={toxinidir}/tests/ansible-role-requirements.yml \
+                   --ignore-errors \
+                   --force
+    ansible-playbook -i {toxinidir}/tests/inventory \
+                     -e "rolename={toxinidir}" \
+                     -vvvv \
+                     {toxinidir}/tests/test.yml
 
 
 [testenv:linters]