Unable to set "scope" for dynamic credentials

[Michael Johnson]

Tempest allows you to create credentials with a specific list of roles using the "credentials" list:

credentials = ['admin', 'primary',
              ['lb_member', CONF.load_balancer.member_role],
              ['lb_member2', CONF.load_balancer.member_role],
              ['lb_admin', CONF.load_balancer.admin_role]]

Now with token scoping in keystone, we need to be able to set a custom scope for these credentials as well.

For example, the 'lb_admin' credential (service specific, cross-project admin) needs the "system" scope to see the cross-project objects.

Currently in tempest there is no way (official) to specify the scope on these credentials.

To be able to test the full matrix of RBAC personas, we need to enhance the "credentials" list to allow the specification of the token scope for the credential.

[Ghanshyam Mann (ghanshyammann)]

this is left over from system scope support in Tempest. We need to add scope support in get_creds_by_roles also.

[Martin Kopec (mkopec)]

addressed by: https://review.opendev.org/c/openstack/tempest/+/778342 (seems the bot responsible for updating LPs is down)

[Michael Johnson (johnsom)]

Thanks for the fast turn around on this! Highly appreciated (though now I have more work to do, grin).

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tempest 26.1.0 release.

[Martin Kopec (mkopec)]

https://review.opendev.org/c/openstack/tempest/+/778342 got merged .. also the fix is part of Tempest 26.1.0 (see the previous comment)