Tempest: remove test duplication for Compute legacy networking API and Neutron API calls

[Lajos Katona]

In Tempest there are many tests under tempest.api.compute which calls Nova legacy API to create security-groups FIPs and similar.
These APIs are legacy in Nova, and the calls only proxied toward Neutron (see [1] as example).
There are similar tests under tempest.api.network and under tempest.scenario.
I suggest to remove these calls, check if we can remove any tests that are redundant or move them to scenario group and change them to use Neutron API.

[1]: https://opendev.org/openstack/nova/src/branch/master/nova/network/security_group_api.py#L370-L401

[sean mooney (sean-k-mooney)]

we cant really do this unless we raise the min micro version in nova which is very controversial
they could be extracted into a nova tempest plugin perhaps if someone is willing to do that effort so that we can run them only in the nova gates.
but that can already be achieved via the test regex so I'm not sure this is worth the effort.

they were deprecated in 2.36
https://docs.openstack.org/nova/latest/reference/api-microversion-history.html#microversion
our min microversion is 2.1

i would personally like to see it raised to 2.60 but I'm not sure we will ever be allowed to do that. https://docs.openstack.org/nova/latest/reference/api-microversion-history.html#maximum-in-queens specifically i want use to get to at least 2.57 to remove file injection but 2.60 is the next highest microverion that aligns to a release, in this case queens.

[Lajos Katona (lajos-katona)]

Some extra comments from the discussion on #openstack-nova (see [1]): As in comment #1 Sean wrote these APIs and testing for them should be kept, but we can check if a job can test them in Nova and other projects should be "free", so other jobs should execute only the tests that call Neutron API for security-groups for example.

I don't want to mix things but if I understand well this can be useful for other legacy APIs like image or volume APIs in Nova.

[1]: https://meetings.opendev.org/irclogs/%23openstack-nova/%23openstack-nova.2023-04-20.log.html

[Ghanshyam Mann (ghanshyammann)]

I agree with Sean, as long as we have the APIs (nova proxy APIs) even they are deprecated but keep/should work for older microversion, having tempest test is good coverage for them and we should not remove them. Once those APIs are removed then we can think of removing the tests. But than also Tempest need to test them until they are gone from all supported branch by Tempest master. And removing those APIs from Nova is another complex thing as increasing he min microversion is not easy thing.

[Lajos Katona (lajos-katona)]

Thanks for the comments.
I think the solution from #2 (https://bugs.launchpad.net/neutron/+bug/2017023/comments/2) can be a way forward, keep the APIs in Nova (keep the min. microversion), keep the tests in Tempests, but execute those tests from a "nova-only" job, and change the jobs of other projects to exclude those tests and use the tests which we have in tempest/api/network/test_security_groups.*.py.

What is important to check what we have in tempest/api/network/test_security_group.*.py provides the same coverage as the tests in compute/security_groups.

Or is it enough if we say that we have now up-to-date scenario tests in tempest for security-groups?

By-the-way: the same is true for tempest/compute/floating_ips

[Martin Kopec (mkopec)]

This effort is tracked in: https://etherpad.opendev.org/p/neutron-tempest-test_duplications
There is only one tempest patch that has been merged already: https://review.opendev.org/c/openstack/tempest/+/892677
The rest of the patches tracked in the etherpad belong to neutron-tempest-plugin.

Therefore, I'm closing this for tempest.

[Balazs Gibizer (balazs-gibizer)]

If I understand correctly the proposed solution did not need changes in nova but changes in other projects to disable some nova specific tests. So I close this for nova.