diff --git a/tests/storage/data_import_cron/conftest.py b/tests/storage/data_import_cron/conftest.py index 52461587eb..3a4bca9409 100644 --- a/tests/storage/data_import_cron/conftest.py +++ b/tests/storage/data_import_cron/conftest.py @@ -1,9 +1,12 @@ import logging import pytest +from ocp_resources.cluster_role import ClusterRole from ocp_resources.data_import_cron import DataImportCron from ocp_resources.data_source import DataSource +from ocp_resources.resource import Resource +from tests.storage.utils import create_role_binding from utilities.constants import BIND_IMMEDIATE_ANNOTATION, OS_FLAVOR_RHEL, TIMEOUT_10MIN, Images from utilities.infra import create_ns from utilities.storage import create_dv, data_volume_template_with_source_ref_dict @@ -59,6 +62,7 @@ def data_import_cron_with_pvc_source( dv_source_for_data_import_cron, imported_data_source, storage_class_name_scope_module, + cdi_cloner_rbac, unprivileged_client, ): with DataImportCron( @@ -93,3 +97,41 @@ def data_import_cron_with_pvc_source( @pytest.fixture(scope="class") def imported_data_source(data_import_cron_pvc_target_namespace): yield DataSource(namespace=data_import_cron_pvc_target_namespace.name, name="target-data-source") + + +@pytest.fixture(scope="class") +def cdi_cloner_rbac(dv_source_for_data_import_cron, data_import_cron_pvc_target_namespace, admin_client): + """ + Creates a ClusterRole for DataVolume cloning and a RoleBinding in the source + namespace to allow the target namespace's ServiceAccount to clone DataVolumes. + + Args: + dv_source_for_data_import_cron: DataVolume fixture that provides the source + namespace. + data_import_cron_pvc_target_namespace: Namespace fixture representing the + target namespace. + admin_client: Admin client used to create and manage cluster-scoped RBAC + resources. + """ + + with ClusterRole( + name="datavolume-cloner", + client=admin_client, + rules=[ + { + "apiGroups": [Resource.ApiGroup.CDI_KUBEVIRT_IO], + "resources": ["datavolumes", "datavolumes/source"], + "verbs": ["*"], + } + ], + ) as cluster_role: + with create_role_binding( + name=f"allow-clone-to-{data_import_cron_pvc_target_namespace.name}", + namespace=dv_source_for_data_import_cron.namespace, + subjects_kind="ServiceAccount", + subjects_name="default", + subjects_namespace=data_import_cron_pvc_target_namespace.name, + role_ref_kind=cluster_role.kind, + role_ref_name=cluster_role.name, + ): + yield diff --git a/tests/storage/data_import_cron/test_data_import_cron_pvc_source.py b/tests/storage/data_import_cron/test_data_import_cron_pvc_source.py index 4a6179fb64..cd695a8a98 100644 --- a/tests/storage/data_import_cron/test_data_import_cron_pvc_source.py +++ b/tests/storage/data_import_cron/test_data_import_cron_pvc_source.py @@ -2,15 +2,9 @@ import pytest -from utilities.constants import QUARANTINED - LOGGER = logging.getLogger(__name__) -@pytest.mark.xfail( - reason=(f"{QUARANTINED}: Change in behavior caused setup to fail. tracked in CNV-75576"), - run=False, -) class TestDataImportCronPvcSource: @pytest.mark.polarion("CNV-11842") def test_data_import_cron_with_pvc_source_ready(