test_security_groups_basic_ops is racey, leading to false positives

[Adam Gandelman]

Trying to figure out why test_security_basic_op's test_in_tenant_traffic was passing against baremetal, when it is known that it should not pass (baremetal devstack deploys using the noop firewall driver).

The test:
 1. boot an access point node
 2. boot a test server
 3. confirm test server cannot be pinged from access point
 4. create a security group rule allowing ICMP, confirm test server can be pinged from access point

The race /w baremetal, tho this is likely to affect environments with slow booting VMs:

 1. boot an access point node
    a. access point provisions, becomes ACTIVE, reboots
 2. boot a test server
    b. test server provisions, becomes ACTIVE, reboots
 3. confirm test server cannot be pinged from access point
    c. access point pings test server while it is in its post-provision boot POST/PXE/etc, ping fails, assertion succeeds.
 4. create a security group rule allowing ICMP, confirm test server can be pinged from access point
   d. access point pings test server while it is PXE booting (after it has DHCP'd and while it is fetching its kernel+ramdisk), ping succeeds and assertions succeeds.

For the purposes of the ironic testing, this entire scenario should be skipped since we deploy with the noop firewall driver. However, the test should be fixed to account for slow booting things.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/112660
Committed: https://git.openstack.org/cgit/openstack/tempest/commit/?id=9bac366163371000235714e02970b3686a150d3e
Submitter: Jenkins
Branch: master

commit 9bac366163371000235714e02970b3686a150d3e
Author: David Shrewsbury <email address hidden>
Date: Thu Aug 7 15:07:01 2014 -0400

    Fix network/secgroup scenario tests for ironic

    Because the ironic nodes in devstack are all on a shared network
    so they can communicate with the tftp server, all tenants must use
    this same network in the scenario tests. This fixes up the networking
    and security group tests to take this into account.

    Code from the setUp() methods has been moved to a new, separately
    called method, to speed up execution time when tests are skipped.
    Since setUp() is executed even if a test is skipped, we can avoid
    the time it takes to create an unneeded server by moving this to
    a new method.

    Co-Authored-By: Adam Gandelman <email address hidden>
    Partial-Bug: #1361904

    Change-Id: If711d69a79f19031dc1d8c529f1219680d22d9bb

[Itzik Brown (itzikb1)]

@David , what's the status of the bug. Are you working on it?

[Ken'ichi Ohmichi (oomichi)]

There was any activity for this bug report over 2 years, it is nice to drop this from our queue.