Test coverage for compute flavor_manage policies

This commit adds test coverage for the flavor_manage policies,
which includes tests only for the non-deprecated policy actions:

* "os_compute_api:os-flavor-manage:create"
* "os_compute_api:os-flavor-manage:delete"

This commit also renames _create_flavor in rbac_base for compute
module to be public since it is consumed by other files. It also
adds a wait_for_resource_deletion call.

Change-Id: I632235a1d81488ecc8fb1e92f801415a08c7e778

patrole_tempest_plugin/tests/api/compute/rbac_base.py

@@ -53,9 +53,12 @@ class BaseV2ComputeRbacTest(compute_base.BaseV2ComputeTest):
         for flavor in cls.flavors:
             test_utils.call_and_ignore_notfound_exc(
                 cls.flavors_client.delete_flavor, flavor['id'])
+        for flavor in cls.flavors:
+            test_utils.call_and_ignore_notfound_exc(
+                cls.flavors_client.wait_for_resource_deletion, flavor['id'])
 
     @classmethod
-    def _create_flavor(cls, **kwargs):
+    def create_flavor(cls, **kwargs):
         flavor_kwargs = {
             "name": data_utils.rand_name(cls.__name__ + '-flavor'),
             "ram": data_utils.rand_int_id(1, 10),

patrole_tempest_plugin/tests/api/compute/test_flavor_access_rbac.py

@@ -38,7 +38,7 @@ class FlavorAccessRbacTest(rbac_base.BaseV2ComputeRbacTest):
     @classmethod
     def resource_setup(cls):
         super(FlavorAccessRbacTest, cls).resource_setup()
-        cls.flavor_id = cls._create_flavor(is_public=False)['id']
+        cls.flavor_id = cls.create_flavor(is_public=False)['id']
         cls.public_flavor_id = CONF.compute.flavor_ref
         cls.tenant_id = cls.os_primary.credentials.tenant_id
 

patrole_tempest_plugin/tests/api/compute/test_flavor_extra_specs_rbac.py

@@ -34,7 +34,7 @@ class FlavorExtraSpecsRbacTest(rbac_base.BaseV2ComputeRbacTest):
     @classmethod
     def resource_setup(cls):
         super(FlavorExtraSpecsRbacTest, cls).resource_setup()
-        cls.flavor = cls._create_flavor()
+        cls.flavor = cls.create_flavor()
 
     @classmethod
     def resource_cleanup(cls):

patrole_tempest_plugin/tests/api/compute/test_flavor_manage_rbac.py

@@ -0,0 +1,53 @@
+#    Copyright 2017 AT&T Corporation.
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest.lib import decorators
+from tempest import test
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.tests.api.compute import rbac_base
+
+
+class FlavorManageRbacTest(rbac_base.BaseV2ComputeRbacTest):
+
+    # Need admin to wait for resource deletion below to avoid test role
+    # having to pass extra policies.
+    credentials = ['primary', 'admin']
+
+    @classmethod
+    def skip_checks(cls):
+        super(FlavorManageRbacTest, cls).skip_checks()
+        if not test.is_extension_enabled('OS-FLV-EXT-DATA', 'compute'):
+            msg = "OS-FLV-EXT-DATA extension not enabled."
+            raise cls.skipException(msg)
+
+    @decorators.idempotent_id('a4e7faec-7a4b-4809-9856-90d5b747ca35')
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-flavor-manage:create")
+    def test_create_flavor_manage(self):
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.create_flavor()
+
+    @decorators.idempotent_id('782e988e-061b-4c40-896f-a77c70c2b057')
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-flavor-manage:delete")
+    def test_delete_flavor_manage(self):
+        flavor_id = self.create_flavor()['id']
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.flavors_client.delete_flavor(flavor_id)
+        self.os_admin.flavors_client.wait_for_resource_deletion(flavor_id)

releasenotes/notes/flavor-manage-rbac-tests-eb78439316d67ab2.yaml

@@ -0,0 +1,8 @@
+---
+features:
+  - |
+    Add test coverage for the os-flavor-manage compute API, which includes
+    tests for the following policy actions:
+
+      * "os_compute_api:os-flavor-manage:create"
+      * "os_compute_api:os-flavor-manage:delete"