Tests failing with pre-provisioned admin credentials

[Dr. Jens Harbott]

Scenario: Tempest running with pre-provisioned credentials including admin accounts, but no admin account provided in the [auth] section of tempest.conf

This causes all test classes that set force_tenant_isolation=True to fail with a traceback like

{1} setUpClass (tempest.api.identity.admin.v3.test_list_users.UsersV3TestJSON) [0.000000s] ... FAILED

Captured traceback:
~~~~~~~~~~~~~~~~~~~
    Traceback (most recent call last):
      File "tempest/test.py", line 172, in setUpClass
        six.reraise(etype, value, trace)
      File "tempest/test.py", line 157, in setUpClass
        cls.setup_credentials()
      File "tempest/api/identity/base.py", line 30, in setup_credentials
        super(BaseIdentityTest, cls).setup_credentials()
      File "tempest/test.py", line 373, in setup_credentials
        credential_type=credentials_type)
      File "tempest/test.py", line 660, in get_client_manager
        cred_provider = cls._get_credentials_provider()
      File "tempest/test.py", line 638, in _get_credentials_provider
        force_tenant_isolation=force_tenant_isolation)
      File "tempest/common/credentials_factory.py", line 141, in get_credentials_provider
        **get_dynamic_provider_params(identity_version))
      File "tempest/common/credentials_factory.py", line 73, in get_dynamic_provider_params
        fill_in=True, identity_version=identity_version)
      File "tempest/common/credentials_factory.py", line 254, in get_configured_admin_credentials
        identity_version=identity_version, **params)
      File "tempest/common/credentials_factory.py", line 298, in get_credentials
        **params)
      File "tempest/lib/auth.py", line 647, in get_credentials
        http_timeout=http_timeout, proxy_url=proxy_url)
      File "tempest/lib/auth.py", line 265, in __init__
        super(KeystoneAuthProvider, self).__init__(credentials, scope)
      File "tempest/lib/auth.py", line 93, in __init__
        raise exceptions.InvalidCredentials(message)
    tempest.lib.exceptions.InvalidCredentials: Invalid Credentials
    Details: Credentials are: {'domain_id': None, 'project_id': None, 'user_domain_id': None, 'project_domain_id': None, 'tenant_name': None, 'user_domain_name': 'Default', 'username': None, 'project_name': None,
 'project_domain_name': 'Default', 'domain_name': 'Default', 'user_id': None, 'tenant_id': None} Password is not defined.

The reason is that tempest always uses the dynamic credential provider if force_tenant_isolation=True, but that only works when admin credentials are present in tempest.conf and not with the static admin account. But the skip_checks() only tests for is_admin_available() and that returns True when a static admin account is present.

[Doug Schveninger (ds6901)]

not sure what you mean by "static admin account", can you provide more details?

[Martin Kopec (mkopec)]

Moving to Confirmed due to a long inactivity.

Steps to reproduce:
1. generate accounts.yaml file (use also --with-admin arg) - in my case in /home/centos/tempest/accounts_admin.yaml
2 edit the tempest.conf to use pre-provisioned credentials, in my case the [auth] section changed from:
[auth]
tempest_roles = _member_
admin_username = admin
admin_project_name = admin
admin_domain_name = Default
admin_password = c8bb8d400db14d56
admin_project_id = cb2f16b119bc482eb18b7b8cb33748e1

to:
tempest_roles = _member_
use_dynamic_credentials = False
test_accounts_file = /home/centos/tempest/accounts_admin.yaml
admin_project_id = cb2f16b119bc482eb18b7b8cb33748e1

3. Run the tempest.api.identity.admin.v3.test_list_users.UsersV3TestJSON tests

Unless I add the following lines back to tempest.conf the tests are failing with the mentioned error which is also weird because per use_dynamic_credentials == False it shouldn't use dynamic creds.
admin_username = admin
admin_project_name = admin
admin_password = c8bb8d400db14d56

[Martin Kopec (mkopec)]

If force_tenant_isolation is False the tests pass, the question is if force_tenant_isolation should be False per the comment - https://opendev.org/openstack/tempest/src/commit/63aec891fca494bbb5b0841e3c52cb9b20674fe4/tempest/api/identity/base.py#L120-L127