@Akihiro: I reproduced this issue by installing fresh devstack with patrole devstack plugin enabled.
Than I had to edit /opt/stack/tempest/etc/tempest.conf file and set:
[patrole]
rbac_test_roles = member
And then, running test like:
tempest run --regex patrole_tempest_plugin.tests.api.network.test_flavor_service_profile_rbac.FlavorsServiceProfileExtRbacTest.test_delete_flavor_service_profile
failed with exactly same error like described in this bug.
So I started debuging this issue and I found that it is failing to enforce policy on match rule:
@Akihiro: I reproduced this issue by installing fresh devstack with patrole devstack plugin enabled. tempest/ etc/tempest. conf file and set:
Than I had to edit /opt/stack/
[patrole]
rbac_test_roles = member
And then, running test like:
tempest run --regex patrole_ tempest_ plugin. tests.api. network. test_flavor_ service_ profile_ rbac.FlavorsSer viceProfileExtR bacTest. test_delete_ flavor_ service_ profile
failed with exactly same error like described in this bug.
So I started debuging this issue and I found that it is failing to enforce policy on match rule:
{'kind': 'rule', 'match': 'get_flavor_ service_ profile' }
Also, I was looking into e.g. rocky branch, where old policy.json file exists and we have such action defined there.