test_quotas.py failed because quota values could be set to zero

[Qiu Hua Qiao]

For cases test_security_groups_exceed_limit and test_security_groups_rules_exceed_limit, there will be error:
Traceback (most recent call last):
  File "/tmp/tempest/tempest/tempest/api/compute/admin/test_quotas.py", line 190, in test_security_groups_exceed_limit
    "sg-overlimit", "sg-desc")
  File "/usr/lib/python2.6/site-packages/testtools/testcase.py", line 394, in assertRaises
    self.assertThat(our_callable, matcher)
  File "/usr/lib/python2.6/site-packages/testtools/testcase.py", line 417, in assertThat
    raise MismatchError(matchee, matcher, mismatch, verbose)
MismatchError: <bound method SecurityGroupsClientJSON.create_security_group of <tempest.services.compute.json.security_groups_client.SecurityGroupsClientJSON object at 0x8e6a1400>> returned ({'status': '200', 'content-length': '178', 'x-compute-request-id': 'req-7fb30db2-ef33-4195-a0e2-89b46ed163f3', 'connection': 'close', 'date': 'Fri, 20 Sep 2013 18:46:37 GMT', 'content-type': 'application/json'}, {u'rules': [], u'tenant_id': u'9c85f972a02e4406a1fdf541708d723b', u'description': u'sg-desc', u'id': u'1be718c0-6f8a-4d89-8d1f-bd32652d39a9', u'name': u'sg-overlimit'})

There is code change that allow quota values to set to zero, seems the code of tempest need to be changed, too.
https://review.openstack.org/#/c/33161/

[Matt Riedemann (mriedem)]

If you're using allow_tenant_isolation=false that might be an issue here, otherwise nova bug 1186354 might have something to do with this.

[Qiu Hua Qiao (qhqiao)]

Yes, we used allow_tenant_isolation=false to ran this case.
I think I need to correct the description of the problem is that creation for security group was successful when the security_groups is 0 in quota.
Seems that /nova/api/openstack/compute/contrib/security_groups.py doesn't check for quota.

[Matt Riedemann (mriedem)]

I patched my system with https://review.openstack.org/#/c/43822/ and tried running test_quotas_negative (where the negative security group/rule tests live now) with neutron in the backend and it still fails because nova isn't proxying the quota update API call to neutron, so the test still fails.

Either nova needs to change to proxy the quota update API calls to neutron (preferable) or Tempest needs to use the neutron client when faking out the quota from the compute test when using neutron in the backend (hacky, but it would get the limits API changes tested until the nova quota API is changed to proxy to neutron).