enable validation fails when swift endpoint is available

[Marian Gasparovic]

Recent changes to Sunbeam enable radosgw in microceph.
sunbeam enable validation then fails because of missing role

```
Traceback (most recent call last):
  File "/lib/python3.10/site-packages/tempest/cmd/account_generator.py", line 282, in take_action
    resources.extend(generate_resources(cred_provider,
  File "/lib/python3.10/site-packages/tempest/cmd/account_generator.py", line 171, in generate_resources
    resources.append((cred_type, cred_provider.get_credentials(
  File "/lib/python3.10/site-packages/tempest/lib/common/dynamic_creds.py", line 443, in get_credentials
    credentials = self._create_creds(roles=credential_type)
  File "/lib/python3.10/site-packages/tempest/lib/common/dynamic_creds.py", line 262, in _create_creds
    self.creds_client.assign_user_role(user, project, role)
  File "/lib/python3.10/site-packages/tempest/lib/common/cred_client.py", line 82, in assign_user_role
    raise lib_exc.NotFound(msg)
tempest.lib.exceptions.NotFound: Object not found
Details: No "ResellerAdmin" role found
```

[Samuel Allan (samuelallan)]

It appears that tempest account generator will try to generate an account with this role if it detects swift support[0]. It's currently crashing because the role doesn't exist. Some things we could investigate:

- what is this role for? Maybe it should exist in the deployment? Perhaps we can add it through microceph radosgw.
- we could disable swift user account support (probably by manually turning off swift support in tempest.conf)
- we could contribute to tempest to add an option to turn off just the ResellerAdmin role

[0]: https://opendev.org/openstack/tempest/src/commit/1be8cabb46b936337fdc759d3033da52bf8a89f0/tempest/cmd/account_generator.py#L159-L161

[James Page (james-page)]

For charmed openstack, this role is created as part of the configuration of the environment before tempest is executed:

https://github.com/openstack-charmers/zaza-openstack-tests/blob/master/zaza/openstack/charm_tests/keystone/__init__.py#L29

[James Page (james-page)]

ResellerAdmin is the default role name in swift for users that have permission to create and delete accounts:

# The reseller admin role has the ability to create and delete accounts
# reseller_admin_role = ResellerAdmin

I'm not sure it has equivalence in the RADOS Gateway.

[James Page (james-page)]

This is configurable in tempest:

https://docs.openstack.org/tempest/latest/sampleconf.html

[James Page (james-page)]

RGW allows configuration of accepted roles (defaults to Member,member) and knows about the Admin role, however it does not appear to support the same concept as Swift does for ResellerAdmin.

[James Page (james-page)]

I think that we just need to disable use of the ResellerAdmin role in tempest (use Admin instead?).

However I'm also a bit wary about how much of the Swift API RGW actually supports - we know its only a partial API compared to Swift and AFAICT tempest does not explicitly support RGW testing.

[Nobuto Murata (nobuto)]

> however it does not appear to support the same concept as Swift does for ResellerAdmin.

At least other implementations try to accommodate ResellerAdmin. e.g.
https://review.opendev.org/c/openstack/tripleo-heat-templates/+/637815

[James Page (james-page)]

I was just looking at that option :)

[James Page (james-page)]

In summary - we'll need an update into MicroCeph to enable support for ResellerAdmin and to request the creation of the Role when related to keystone.

[Hemanth Nakkina (hemanth-n)]

I do not see this problem on 2024.1/edge rev 554 and `sunbeam enable validation` command is successful.

Marian also confirmed this works on 2024.1/edge and fails on 2024.1/beta