From 2ba7ed8e39c678973b03b6e7b6e1c85609ea1c22 Mon Sep 17 00:00:00 2001
From: Dan Smith <dansmith@redhat.com>
Date: Tue, 1 Oct 2024 07:33:09 -0700
Subject: [PATCH] Avoid image format tests if glance is enforcing

If glance refuses to allow bad images to be uploaded, then we cannot
even register them to then test against nova or other services. Gate
these tests on a knob indicating whether or not glance will allow
them to be uploaded. The ListUserImagesTest class depends entirely on
being able to upload random data as every format/container, which is
fundamentally not something we can do with glance enforcing content
rules.

This makes the tempest-slow-py3 job disable glance image format
inspection so that we can get the compute tests to run.

Depends-On: https://review.opendev.org/c/openstack/devstack/+/931026
Change-Id: I05bb233cf1482895b96396852a15532295d3829b
---
 .../image-enforcement-config-0bc67791a40bac56.yaml   |  8 ++++++++
 tempest/api/image/v2/test_images.py                  |  9 +++++++++
 tempest/api/image/v2/test_images_formats.py          | 12 ++++++++++++
 tempest/config.py                                    |  5 +++++
 zuul.d/integrated-gate.yaml                          |  1 +
 5 files changed, 35 insertions(+)
 create mode 100644 releasenotes/notes/image-enforcement-config-0bc67791a40bac56.yaml

diff --git a/releasenotes/notes/image-enforcement-config-0bc67791a40bac56.yaml b/releasenotes/notes/image-enforcement-config-0bc67791a40bac56.yaml
new file mode 100644
index 0000000000..2bbc82bc58
--- /dev/null
+++ b/releasenotes/notes/image-enforcement-config-0bc67791a40bac56.yaml
@@ -0,0 +1,8 @@
+---
+features:
+  - |
+    Add a new config option
+    `[image_feature_enabled]/image_format_enforcement` which tells tempest
+    that glance will do image format inspection and enforcement on upload. This
+    will disable tests that require glance to accept a bad image in order to
+    test another service (i.e. nova).
diff --git a/tempest/api/image/v2/test_images.py b/tempest/api/image/v2/test_images.py
index e9c7dbacff..9309c76de8 100644
--- a/tempest/api/image/v2/test_images.py
+++ b/tempest/api/image/v2/test_images.py
@@ -536,6 +536,15 @@ class ListUserImagesTest(base.BaseV2ImageTest):
                      for container_fmt in container_fmts
                      for disk_fmt in disk_fmts]
 
+        # NOTE(danms): This tests depends on being able to lie about image
+        # content. We can probably improve this in some way, but without a
+        # valid sample of each image format in each container format, there is
+        # no easy solution.
+        if CONF.image_feature_enabled.image_format_enforcement:
+            raise cls.skipException(
+                'Image format enforcement prevents testing with '
+                'bogus image data')
+
         for (container_fmt, disk_fmt) in all_pairs[:6]:
             LOG.debug("Creating an image "
                       "(Container format: %s, Disk format: %s).",
diff --git a/tempest/api/image/v2/test_images_formats.py b/tempest/api/image/v2/test_images_formats.py
index 48f13258f7..f0dec903d3 100644
--- a/tempest/api/image/v2/test_images_formats.py
+++ b/tempest/api/image/v2/test_images_formats.py
@@ -166,6 +166,12 @@ class ImagesFormatTest(base.BaseV2ImageTest,
             # a properly-formatted image for it, so skip it.
             self.skipTest(
                 'Format %s not allowed by config' % self.imgdef['format'])
+        if CONF.image_feature_enabled.image_format_enforcement:
+            # If glance rejects bad images during upload, we cannot get them
+            # registered so that we can test nova.
+            self.skipTest(
+                'Unable to test compute image formats if glance does not '
+                'allow them to be uploaded')
 
         # VMDK with footer was not supported by earlier service versions,
         # so we need to tolerate it passing and failing (skip for the latter).
@@ -191,6 +197,12 @@ class ImagesFormatTest(base.BaseV2ImageTest,
     @decorators.idempotent_id('ffe21610-e801-4992-9b81-e2d646e2e2e9')
     def test_compute_rejects_format_mismatch(self):
         """Make sure compute rejects any image with a format mismatch."""
+        if CONF.image_feature_enabled.image_format_enforcement:
+            # If glance rejects bad images during upload, we cannot get them
+            # registered so that we can test nova.
+            self.skipTest(
+                'Unable to test compute image formats if glance does not '
+                'allow them to be uploaded')
         # Lying about the disk_format should always fail
         override_fmt = (
             self.imgdef['format'] in ('raw', 'gpt') and 'qcow2' or 'raw')
diff --git a/tempest/config.py b/tempest/config.py
index 00d42cb146..e7442ea3cb 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -728,6 +728,11 @@ ImageFeaturesGroup = [
     cfg.BoolOpt('image_conversion',
                 default=False,
                 help=('Is image_conversion enabled in glance.')),
+    cfg.BoolOpt('image_format_enforcement',
+                default=True,
+                help=('Indicates that image format is enforced by glance, '
+                      'such that we should not expect to be able to upload '
+                      'bad images for testing other services.')),
 ]
 
 network_group = cfg.OptGroup(name='network',
diff --git a/zuul.d/integrated-gate.yaml b/zuul.d/integrated-gate.yaml
index 56c65c00d7..fb0829768f 100644
--- a/zuul.d/integrated-gate.yaml
+++ b/zuul.d/integrated-gate.yaml
@@ -330,6 +330,7 @@
       devstack_localrc:
         CINDER_ENABLED_BACKENDS: lvm:lvmdriver-1,lvm:lvmdriver-2
         ENABLE_VOLUME_MULTIATTACH: true
+        GLANCE_ENFORCE_IMAGE_FORMAT: false
       devstack_plugins:
         neutron: https://opendev.org/openstack/neutron
       devstack_services: