Merge "install_pip: Use packaged pip on Fedora"
diff --git a/.zuul.yaml b/.zuul.yaml
index 5dc2169..8c275d8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -80,7 +80,7 @@
     name: devstack-single-node-fedora-latest
     nodes:
       - name: controller
-        label: fedora-32
+        label: fedora-34
     groups:
       - name: tempest
         nodes:
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 9f477ab..08ce4cb 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -63,7 +63,7 @@
 .. code-block:: console
 
     $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
-    $ sudo su - stack
+    $ sudo -u stack -i
 
 Download DevStack
 -----------------
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 691fffa..490132e 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -98,6 +98,7 @@
 openstack/solum                          `https://opendev.org/openstack/solum <https://opendev.org/openstack/solum>`__
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
+openstack/tap-as-a-service               `https://opendev.org/openstack/tap-as-a-service <https://opendev.org/openstack/tap-as-a-service>`__
 openstack/telemetry-tempest-plugin       `https://opendev.org/openstack/telemetry-tempest-plugin <https://opendev.org/openstack/telemetry-tempest-plugin>`__
 openstack/trove                          `https://opendev.org/openstack/trove <https://opendev.org/openstack/trove>`__
 openstack/trove-dashboard                `https://opendev.org/openstack/trove-dashboard <https://opendev.org/openstack/trove-dashboard>`__
@@ -179,7 +180,6 @@
 x/scalpels                               `https://opendev.org/x/scalpels <https://opendev.org/x/scalpels>`__
 x/slogging                               `https://opendev.org/x/slogging <https://opendev.org/x/slogging>`__
 x/stackube                               `https://opendev.org/x/stackube <https://opendev.org/x/stackube>`__
-x/tap-as-a-service                       `https://opendev.org/x/tap-as-a-service <https://opendev.org/x/tap-as-a-service>`__
 x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
 x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
 x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__
diff --git a/lib/keystone b/lib/keystone
index e282db0..66e867c 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -134,12 +134,6 @@
 # Cache settings
 KEYSTONE_ENABLE_CACHE=${KEYSTONE_ENABLE_CACHE:-True}
 
-# Flag to set the oslo_policy.enforce_scope. This is used to switch
-# the Identity API policies to start checking the scope of token. By Default,
-# this flag is False.
-# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
-KEYSTONE_ENFORCE_SCOPE=$(trueorfalse False KEYSTONE_ENFORCE_SCOPE)
-
 # Functions
 # ---------
 
@@ -287,11 +281,6 @@
         iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION
         iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT
     fi
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
-        iniset $KEYSTONE_CONF oslo_policy enforce_scope true
-        iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
-        iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
-    fi
 }
 
 # create_keystone_accounts() - Sets up common required keystone accounts
diff --git a/lib/libraries b/lib/libraries
old mode 100644
new mode 100755
index c7aa815..67ff21f
--- a/lib/libraries
+++ b/lib/libraries
@@ -59,6 +59,7 @@
 # Non oslo libraries are welcomed below as well, this prevents
 # duplication of this code.
 GITDIR["os-brick"]=$DEST/os-brick
+GITDIR["os-resource-classes"]=$DEST/os-resource-classes
 GITDIR["os-traits"]=$DEST/os-traits
 
 # Support entry points installation of console scripts
@@ -122,6 +123,7 @@
     #
     # os-traits for nova
     _install_lib_from_source "os-brick"
+    _install_lib_from_source "os-resource-classes"
     _install_lib_from_source "os-traits"
     #
     # python client libraries we might need from git can go here
diff --git a/lib/tempest b/lib/tempest
index a1c02ef..8fd54c5 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -600,15 +600,6 @@
         fi
     done
 
-    # ``enforce_scope``
-    # If services enable the enforce_scope for their policy
-    # we need to enable the same on Tempest side so that
-    # test can be run with scoped token.
-    if [[ "$KEYSTONE_ENFORCE_SCOPE" == True ]] ; then
-        iniset $TEMPEST_CONFIG enforce_scope keystone true
-        iniset $TEMPEST_CONFIG auth admin_system 'all'
-        iniset $TEMPEST_CONFIG auth admin_project_name ''
-    fi
     iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
 
     iniset $TEMPEST_CONFIG enforce_scope cinder "$CINDER_ENFORCE_SCOPE"
diff --git a/stack.sh b/stack.sh
index c439a72..e3d67f5 100755
--- a/stack.sh
+++ b/stack.sh
@@ -300,10 +300,14 @@
 }
 
 function _install_rdo {
-    # NOTE(ianw) 2020-04-30 : when we have future branches, we
-    # probably want to install the relevant branch RDO release as
-    # well.  But for now it's all master.
-    sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+    if [[ "$TARGET_BRANCH" == "master" ]]; then
+        # rdo-release.el8.rpm points to latest RDO release, use that for master
+        sudo dnf -y install https://rdoproject.org/repos/rdo-release.el8.rpm
+    else
+        # For stable branches use corresponding release rpm
+        rdo_release=$(echo $TARGET_BRANCH | sed "s|stable/||g")
+        sudo dnf -y install https://rdoproject.org/repos/openstack-${rdo_release}/rdo-release-${rdo_release}.el8.rpm
+    fi
     sudo dnf -y update
 }
 
diff --git a/stackrc b/stackrc
old mode 100644
new mode 100755
index 0501659..620b1fc
--- a/stackrc
+++ b/stackrc
@@ -548,6 +548,10 @@
 GITBRANCH["neutron-lib"]=${NEUTRON_LIB_BRANCH:-$TARGET_BRANCH}
 GITDIR["neutron-lib"]=$DEST/neutron-lib
 
+# os-resource-classes library containing a list of standardized resource classes for OpenStack
+GITREPO["os-resource-classes"]=${OS_RESOURCE_CLASSES_REPO=:-${GIT_BASE}/openstack/os-resource-classes.git}
+GITBRANCH["os-resource-classes"]=${OS_RESOURCE_CLASSES_BRANCH:-$TARGET_BRANCH}
+
 # os-traits library for resource provider traits in the placement service
 GITREPO["os-traits"]=${OS_TRAITS_REPO:-${GIT_BASE}/openstack/os-traits.git}
 GITBRANCH["os-traits"]=${OS_TRAITS_BRANCH:-$TARGET_BRANCH}
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 5b53389..ce1b344 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -44,7 +44,7 @@
 ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
-ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken"
+ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken os-resource-classes"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}