From 16c2b389ed8efca70fa1e65395becdaea84f8b44 Mon Sep 17 00:00:00 2001
From: Ghanshyam Mann <gmann@ghanshyammann.com>
Date: Wed, 30 Nov 2022 14:24:07 -0600
Subject: [PATCH] Add RBAC scope and new defaults setting support for placement

Adding devstack flag to enable and test the Placement API policies
scope and new defaults.

Depends-On: https://review.opendev.org/c/openstack/tempest/+/866212
Change-Id: I6f56fc28f2c1e4cdde946deb2ae06afddf85ff0d
---
 lib/placement | 10 ++++++++++
 lib/tempest   |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/lib/placement b/lib/placement
index b7798669a1..bc22c564f4 100644
--- a/lib/placement
+++ b/lib/placement
@@ -48,6 +48,12 @@ fi
 PLACEMENT_SERVICE_PROTOCOL=${PLACEMENT_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
 PLACEMENT_SERVICE_HOST=${PLACEMENT_SERVICE_HOST:-$SERVICE_HOST}
 
+# Flag to set the oslo_policy.enforce_scope and oslo_policy.enforce_new_defaults.
+# This is used to switch the Placement API policies scope and new defaults.
+# By Default, these flag are False.
+# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
+PLACEMENT_ENFORCE_SCOPE=$(trueorfalse False PLACEMENT_ENFORCE_SCOPE)
+
 # Functions
 # ---------
 
@@ -111,6 +117,10 @@ function configure_placement {
     else
         _config_placement_apache_wsgi
     fi
+    if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
+        iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
+        iniset $PLACEMENT_CONF oslo_policy enforce_scope True
+    fi
 }
 
 # create_placement_accounts() - Set up required placement accounts
diff --git a/lib/tempest b/lib/tempest
index b232f24540..5cd4d18439 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -678,6 +678,10 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG enforce_scope nova true
     fi
 
+    if [[ "$PLACEMENT_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
+        iniset $TEMPEST_CONFIG enforce_scope placement true
+    fi
+
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $TEMPEST_CONFIG enforce_scope glance true
     fi