Deprecate enable_rbac configuration option

The ``[patrole].enable_rbac`` option is deprecated and will be removed
during the "S" release. This is a legacy option that was meaningful
downstream when Patrole was a suite of tests inside Tempest itself. Now
that Patrole exists upstream as a Tempest plugin, it is paradoxical to
install the Patrole plugin yet have an option that allows all Patrole
tests to be skipped. This option is at odds with current Patrole
architecture.

To skip RBAC tests going forward, with Patrole Tempest plugin already
installed, use an appropriate regex.

Change-Id: I0cc39184c7891fb9133a45488a36ba220592915f

patrole_tempest_plugin/config.py

@@ -22,11 +22,18 @@ patrole_group = cfg.OptGroup(name='patrole', title='Patrole Testing Options')
 PatroleGroup = [
     cfg.StrOpt('rbac_test_role',
                default='admin',
-               help="""The current RBAC role against which to run Patrole
-tests."""),
+               help="""The current RBAC role against which to run
+Patrole tests."""),
     cfg.BoolOpt('enable_rbac',
                 default=True,
-                help="Enables RBAC tests."),
+                deprecated_for_removal=True,
+                deprecated_reason="""This is a legacy option that was
+meaningful when Patrole existed downstream as a suite of tests inside Tempest.
+Installing the Patrole plugin necessarily means that RBAC tests should be run.
+This option is paradoxical with the Tempest plugin architecture.
+""",
+                deprecated_since='R',
+                help="Enables Patrole RBAC tests."),
     cfg.ListOpt('custom_policy_files',
                 default=['/etc/%s/policy.json'],
                 help="""List of the paths to search for policy files. Each

patrole_tempest_plugin/rbac_utils.py

@@ -17,6 +17,7 @@ from contextlib import contextmanager
 import time
 
 from oslo_log import log as logging
+from oslo_log import versionutils
 from oslo_utils import excutils
 
 from tempest import clients
@@ -220,6 +221,12 @@ class RbacUtilsMixin(object):
     @classmethod
     def skip_rbac_checks(cls):
         if not CONF.patrole.enable_rbac:
+            deprecation_msg = ("The `[patrole].enable_rbac` option is "
+                               "deprecated and will be removed in the S "
+                               "release. Patrole tests will always be enabled "
+                               "following installation of the Patrole Tempest "
+                               "plugin. Use a regex to skip tests.")
+            versionutils.report_deprecated_feature(LOG, deprecation_msg)
             raise cls.skipException(
                 'Patrole testing not enabled so skipping %s.' % cls.__name__)
 

releasenotes/notes/deprecate-enable-rbac-option-1e499bb0914cdee8.yaml

@@ -0,0 +1,13 @@
+---
+deprecations:
+  - |
+    The ``[patrole].enable_rbac`` option is deprecated and will be removed
+    during the "S" release. This is a legacy option that was meaningful
+    downstream when Patrole was a suite of tests inside Tempest itself. Now
+    that Patrole exists upstream as a Tempest plugin, it is paradoxical to
+    install the Patrole plugin yet have an option that allows all Patrole
+    tests to be skipped. This option is at odds with current Patrole
+    architecture.
+
+    To skip RBAC tests going forward, with Patrole Tempest plugin already
+    installed, use an appropriate regex.