commit 57b092dbceb95ed03f8d33f64a5cc60eabd57e50
author Ghanshyam Mann <gmann@ghanshyammann.com> Mon Feb 08 11:37:38 2021 -0600
committer Ghanshyam <gmann@ghanshyammann.com> Mon Feb 15 17:34:17 2021 +0000
tree 2bf3ef357090b50bf26d17f43170e984062a9147
parent aa2821eb89ab9c8048509d15fe41215c163d2f50

Stop configure 'member' role in tempest_roles

Config option auth.tempest_roles is used to set the
extra roles to all dynamic cred tests users.
- https://opendev.org/openstack/tempest/src/commit/9b6f441fdc2a970410ea631dc1318896349e010f/tempest/common/credentials_factory.py#L82

Devstack set the 'member' role in CONF.auth.tempest_roles
- https://opendev.org/openstack/devstack/src/commit/556f84aea90c572873fc9834292635b41e590224/lib/tempest#L628

This cause issue if any tests testing for speciifc rols and want
to exclude the 'member' role, basically this bug
- https://bugs.launchpad.net/devstack/+bug/1915740

Also with 'member' role assigned by default, Tempest will not be
able to test the secure RBAC new default 'reader' role.

Let's remove  this role assignment now and let test congfigure what
they want.

Closes-Bug: #1915740

Change-Id: I0b6ab9fb943c7b0925a0a0d2490a8bcdfa76cedc

lib/tempest

diff --git a/lib/tempest b/lib/tempest
index 8ee986d..04540e5 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -625,7 +625,6 @@
     rm -f $tmp_u_c_m
 
     # Auth:
-    iniset $TEMPEST_CONFIG auth tempest_roles "member"
     if [[ $TEMPEST_USE_TEST_ACCOUNTS == "True" ]]; then
         if [[ $TEMPEST_HAS_ADMIN == "True" ]]; then
             tox -evenv-tempest -- tempest account-generator -c $TEMPEST_CONFIG --os-username $admin_username --os-password "$password" --os-project-name $admin_project_name -r $TEMPEST_CONCURRENCY --with-admin etc/accounts.yaml