Skip to content

Re-apply "SCS-0128: Remove admin pass instance creation test" - #1253

Draft
toothstone wants to merge 2 commits into
mainfrom
fzahn/revert-1250
Draft

toothstone wants to merge 2 commits into
mainfrom
fzahn/revert-1250

Conversation

@toothstone

Copy link
Copy Markdown
Contributor

Recreation of #1245 after it was erroneously merged and had to be reverted in #1250

Only applicable once #1250 is merged.

depressiveRobot and others added 2 commits July 17, 2026 10:51
…admin pas…"

This reverts commit 0c8c8ce.

Signed-off-by: Friedrich Zahn <friedrich.zahn@alasca.cloud>
@toothstone

Copy link
Copy Markdown
Contributor Author

There was an agreement with @mbuechse that SCS-0128 will be amended to only require not failing any tests, so skipping tests is allowed.
This means I can just set the tempest feature flag controlling this as enable_instance_password = false and always skip the problematic test case, so if the revert goes through it's not a problem.

@toothstone toothstone closed this Jul 27, 2026
@toothstone

Copy link
Copy Markdown
Contributor Author

There was an agreement with @mbuechse that SCS-0128 will be amended to only require not failing any tests, so skipping tests is allowed. This means I can just set the tempest feature flag controlling this as enable_instance_password = false and always skip the problematic test case, so if the revert goes through it's not a problem.

This was reverted in #1285, so I'll reopen this PR.

There are valid security reasons to disallow instance creation with admin passwords, so SCS should not mandate this feature.

@toothstone toothstone reopened this Oct 5, 2026
@mbuechse

mbuechse commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

You are right: on 2026-07-23 we decided to

make SCS-0128-v1 more precise by specifying that the overall test is passed when Tempest has 0 failures (regardless of skips)

And the latest change contradicts that, for the standard now says:

[tempest] MUST NOT report any skipped test cases, except for well-founded cases.

However, there is a priori no reason why the test case in question cannot be (made) one of those well-founded exceptions.

Then again, it has to be discussed whether it should. The above-linked meeting minutes also state

instance creation with admin (read: root) password is not a mandatory feature, compliance checks can't know what the CSP configured

I don't know what is meant here by 'is not a mandatory feature'. Mandatory -- mandated by whom? Maybe it was mandatory in OpenStack-powered Compute, maybe it wasn't. Regardless, I think we, the SCS community, should reconsider this matter and come to a (loose) consensus what we want:

  1. keep it mandatory (no skip allowed),
  2. make it dependent on the advertised feature set (skip allowed if feature disabled),
  3. remove the testcase altogether.

So I'm adding this to the SIG agenda.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants