User with Reader role can extend/reserve/retype/unreserve/update_readonly volume

[Evelina Shames]

A user with a reader role can extend, reserve, retype, unreserve, update_readonly a volume while these operations should be forbidden for a reader role.

extend:
2023-05-19 15:28:24,029 90285 INFO [tempest.lib.common.rest_client] Request (ProjectReaderTests:test_extend_volume): 202 POST https://173.231.255.168/volume/v3/69772943f27d4a20b2b7cb007e2197bf/volumes/1d57d984-3c2d-464d-bdd9-a0fa27baf523/action 0.170s
2023-05-19 15:28:24,029 90285 DEBUG [tempest.lib.common.rest_client] Request - Headers: {'Content-Type': 'application/json', 'Accept': 'application/json', 'X-Auth-Token': '<omitted>'}
        Body: {"os-extend": {"new_size": 2}}
    Response - Headers: {'date': 'Fri, 19 May 2023 15:28:23 GMT', 'server': 'Apache/2.4.52 (Ubuntu)', 'x-compute-request-id': 'req-1ff74c45-c63a-433b-a9a5-f1e37e567fdc', 'content-length': '0', 'content-type': 'application/json', 'openstack-api-version': 'volume 3.0', 'vary': 'OpenStack-API-Version', 'x-openstack-request-id': 'req-1ff74c45-c63a-433b-a9a5-f1e37e567fdc', 'connection': 'close', 'status': '202', 'content-location': 'https://173.231.255.168/volume/v3/69772943f27d4a20b2b7cb007e2197bf/volumes/1d57d984-3c2d-464d-bdd9-a0fa27baf523/action'}
        Body: b''

reserve:
2023-05-19 15:28:28,859 90285 INFO [tempest.lib.common.rest_client] Request (ProjectReaderTests:test_reserve_volume): 202 POST https://173.231.255.168/volume/v3/69772943f27d4a20b2b7cb007e2197bf/volumes/0740cbe7-17c9-455f-a4b2-728c9d8c1ba9/action 0.034s
2023-05-19 15:28:28,859 90285 DEBUG [tempest.lib.common.rest_client] Request - Headers: {'Content-Type': 'application/json', 'Accept': 'application/json', 'X-Auth-Token': '<omitted>'}
        Body: {"os-reserve": {}}
    Response - Headers: {'date': 'Fri, 19 May 2023 15:28:28 GMT', 'server': 'Apache/2.4.52 (Ubuntu)', 'x-compute-request-id': 'req-5e428ea6-a6b0-456c-9ec1-4472537bce71', 'content-length': '0', 'content-type': 'application/json', 'openstack-api-version': 'volume 3.0', 'vary': 'OpenStack-API-Version', 'x-openstack-request-id': 'req-5e428ea6-a6b0-456c-9ec1-4472537bce71', 'connection': 'close', 'status': '202', 'content-location': 'https://173.231.255.168/volume/v3/69772943f27d4a20b2b7cb007e2197bf/volumes/0740cbe7-17c9-455f-a4b2-728c9d8c1ba9/action'}
        Body: b''

unreserve:
2023-05-19 15:28:37,449 90285 INFO [tempest.lib.common.rest_client] Request (ProjectReaderTests:test_unreserve_volume): 202 POST https://173.231.255.168/volume/v3/69772943f27d4a20b2b7cb007e2197bf/volumes/e064d6cb-a92c-4f07-97b1-d781f8353be1/action 0.027s
2023-05-19 15:28:37,449 90285 DEBUG [tempest.lib.common.rest_client] Request - Headers: {'Content-Type': 'application/json', 'Accept': 'application/json', 'X-Auth-Token': '<omitted>'}
        Body: {"os-unreserve": {}}
    Response - Headers: {'date': 'Fri, 19 May 2023 15:28:37 GMT', 'server': 'Apache/2.4.52 (Ubuntu)', 'x-compute-request-id': 'req-585d933c-eaa6-44bb-bf94-9f82d6f674fe', 'content-length': '0', 'content-type': 'application/json', 'openstack-api-version': 'volume 3.0', 'vary': 'OpenStack-API-Version', 'x-openstack-request-id': 'req-585d933c-eaa6-44bb-bf94-9f82d6f674fe', 'connection': 'close', 'status': '202', 'content-location': 'https://173.231.255.168/volume/v3/69772943f27d4a20b2b7cb007e2197bf/volumes/e064d6cb-a92c-4f07-97b1-d781f8353be1/action'}
        Body: b''

update_readonly:
2023-05-19 15:28:40,983 90285 INFO [tempest.lib.common.rest_client] Request (ProjectReaderTests:test_update_volume_readonly): 202 POST https://173.231.255.168/volume/v3/69772943f27d4a20b2b7cb007e2197bf/volumes/7af6233a-95a7-4c62-a043-9403b622c752/action 0.087s
2023-05-19 15:28:40,984 90285 DEBUG [tempest.lib.common.rest_client] Request - Headers: {'Content-Type': 'application/json', 'Accept': 'application/json', 'X-Auth-Token': '<omitted>'}
        Body: {"os-update_readonly_flag": {"readonly": true}}
    Response - Headers: {'date': 'Fri, 19 May 2023 15:28:40 GMT', 'server': 'Apache/2.4.52 (Ubuntu)', 'x-compute-request-id': 'req-76b0ff42-acd1-4f55-979f-d1a10a78a58e', 'content-length': '0', 'content-type': 'application/json', 'openstack-api-version': 'volume 3.0', 'vary': 'OpenStack-API-Version', 'x-openstack-request-id': 'req-76b0ff42-acd1-4f55-979f-d1a10a78a58e', 'connection': 'close', 'status': '202', 'content-location': 'https://173.231.255.168/volume/v3/69772943f27d4a20b2b7cb007e2197bf/volumes/7af6233a-95a7-4c62-a043-9403b622c752/action'}
        Body: b''

These issues were found while adding Volume Actions tests for srbac:
https://review.opendev.org/c/openstack/cinder-tempest-plugin/+/883182

[Yosi Ben Shimon (ybenshim)]

The same issue happens for:
- attach_volume
- detach_volume
- remove_image_metadata
- set_bootable_volume
- set_image_metadata
- terminate_volume_attachment

tests for "reader" role.

attach_volume:
2023-07-26 07:21:22,293 91796 INFO [tempest.lib.common.rest_client] Request (ProjectReaderTests:test_attach_volume): 202 POST https://10.209.128.25/volume/v3/58abb29ef9fd4c26a93f0caf6d20ebdf/volumes/f227cc6e-bb47-4626-a1da-116cd4ff169e/action 0.273s
2023-07-26 07:21:22,293 91796 DEBUG [tempest.lib.common.rest_client] Request - Headers: {'Content-Type': 'application/json', 'Accept': 'application/json', 'X-Auth-Token': '<omitted>'}
        Body: {"os-attach": {"instance_uuid": "1c79a19c-cb1b-4956-bd88-533f3ce29555", "mountpoint": "/dev/vdb"}}
    Response - Headers: {'date': 'Wed, 26 Jul 2023 07:21:22 GMT', 'server': 'Apache/2.4.52 (Ubuntu)', 'x-compute-request-id': 'req-41b8bdec-9d6e-4d17-96b2-1400df8ababe', 'content-length': '0', 'content-type': 'application/json', 'openstack-api-version': 'volume 3.0', 'vary': 'OpenStack-API-Version', 'x-openstack-request-id': 'req-41b8bdec-9d6e-4d17-96b2-1400df8ababe', 'connection': 'close', 'status': '202', 'content-location': 'https://10.209.128.25/volume/v3/58abb29ef9fd4c26a93f0caf6d20ebdf/volumes/f227cc6e-bb47-4626-a1da-116cd4ff169e/action'}
        Body: b''

detach_volume:
2023-07-26 07:21:32,118 91796 INFO [tempest.lib.common.rest_client] Request (ProjectReaderTests:test_detach_volume): 202 POST https://10.209.128.25/volume/v3/58abb29ef9fd4c26a93f0caf6d20ebdf/volumes/396107fc-32ba-4a31-981c-3e91c7547117/action 0.100s
2023-07-26 07:21:32,118 91796 DEBUG [tempest.lib.common.rest_client] Request - Headers: {'Content-Type': 'application/json', 'Accept': 'application/json', 'X-Auth-Token': '<omitted>'}
        Body: {"os-detach": {}}
    Response - Headers: {'date': 'Wed, 26 Jul 2023 07:21:32 GMT', 'server': 'Apache/2.4.52 (Ubuntu)', 'x-compute-request-id': 'req-161783a1-806b-4e14-900c-eea643160b3c', 'content-length': '0', 'content-type': 'application/json', 'openstack-api-version': 'volume 3.0', 'vary': 'OpenStack-API-Version', 'x-openstack-request-id': 'req-161783a1-806b-4e14-900c-eea643160b3c', 'connection': 'close', 'status': '202', 'content-location': 'https://10.209.128.25/volume/v3/58abb29ef9fd4c26a93f0caf6d20ebdf/volumes/396107fc-32ba-4a31-981c-3e91c7547117/action'}
        Body: b''

remove_image_metadata:
2023-07-26 07:21:51,752 91796 INFO [tempest.lib.common.rest_client] Request (ProjectReaderTests:test_remove_image_metadata): 200 POST https://10.209.128.25/volume/v3/58abb29ef9fd4c26a93f0caf6d20ebdf/volumes/1c1824f2-3151-4c8f-948e-8b74cf345a27/action 0.073s
2023-07-26 07:21:51,752 91796 DEBUG [tempest.lib.common.rest_client] Request - Headers: {'Content-Type': 'application/json', 'Accept': 'application/json', 'X-Auth-Token': '<omitted>'}
        Body: {"os-unset_image_metadata": {"key": "test_item_key_2"}}
    Response - Headers: {'date': 'Wed, 26 Jul 2023 07:21:51 GMT', 'server': 'Apache/2.4.52 (Ubuntu)', 'content-length': '0', 'content-type': 'text/html; charset=UTF-8', 'openstack-api-version': 'volume 3.0', 'vary': 'OpenStack-API-Version,Accept-Encoding', 'x-openstack-reque...