Patrole borrows the following commandments from Tempest; refer to Tempest’s Commandments for more information:
Note
The original Tempest Commandments do not include Patrole-specific paths. Patrole-specific paths replace the Tempest-specific paths within Patrole’s hacking checks.
The following are Patrole’s specific Commandments:
rbac_rule_validation.action
decorator must be applied toself.client
must not be used as a client alias; this allows forCorrect role switching is vital to correct RBAC testing within Patrole. If a
test does not call rbac_utils.switch_role
with toggle_rbac_role=True
within the RBAC test, then the test is not a valid RBAC test: The API
endpoint under test will be performed with admin credentials, which is always
wrong unless CONF.patrole.rbac_test_role
is admin.
Note
Switching back to the admin role for setup and clean up is automatically
performed. Toggling switch_role
with toggle_rbac_role=False
within
the context of a test should never be performed and doing so will likely
result in an error being thrown.
Patrole does not have a hacking check for role switching, but does use a
built-in mechanism for verifying that role switching is being correctly
executed across tests. If a test does not call switch_role
with
toggle_rbac_role=True
, then an RbacResourceSetupFailed
exception
will be raised.
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.