Clean orphan security groups

It removes all security groups which are not owned by a project.
This approach seems suitable as it works even if dynamic accounts
(tempest and rally). All other OpenStack resources are still
removed by the underlying framework.

It lists all orphan security groups in use as debug to avoid
misunderstanding the testcase results (it could happen if cloud admin
removes accounts without cleaning the virtual machines).

Change-Id: I033d96e077b4277d59233a3de4ca6d41ed91f743
Signed-off-by: Cédric Ollivier <cedric.ollivier@orange.com>

2 files changed, 23 insertions, 1 deletions

diff --git a/functest/core/singlevm.py b/functest/core/singlevm.py
index dce6d819b..0473a21da 100644
--- a/functest/core/singlevm.py
+++ b/functest/core/singlevm.py
@@ -237,6 +237,25 @@ class VmReady1(tenantnetwork.TenantNetwork1):
         self.__logger.error("cannot find regex '%s' in console", regex)
         return False
 
+    def clean_orphan_security_groups(self):
+        """Clean all security groups which are not owned by an existing tenant
+
+        It lists all orphan security groups in use as debug to avoid
+        misunderstanding the testcase results (it could happen if cloud admin
+        removes accounts without cleaning the virtual machines)
+        """
+        sec_groups = self.orig_cloud.list_security_groups()
+        for sec_group in sec_groups:
+            if not sec_group.tenant_id:
+                continue
+            if not self.orig_cloud.get_project(sec_group.tenant_id):
+                self.__logger.debug("Cleaning security group %s", sec_group.id)
+                try:
+                    self.orig_cloud.delete_security_group(sec_group.id)
+                except Exception:  # pylint: disable=broad-except
+                    self.__logger.debug(
+                        "Orphan security group %s in use", sec_group.id)
+
     def run(self, **kwargs):
         """Boot the new VM
 
@@ -273,6 +292,8 @@ class VmReady1(tenantnetwork.TenantNetwork1):
                 self.cloud.delete_image(self.image.id)
             if self.flavor:
                 self.orig_cloud.delete_flavor(self.flavor.id)
+            if env.get('CLEAN_ORPHAN_SECURITY_GROUPS').lower() == 'true':
+                self.clean_orphan_security_groups()
         except Exception:  # pylint: disable=broad-except
             self.__logger.exception("Cannot clean all resources")
 
diff --git a/functest/utils/env.py b/functest/utils/env.py
index c5869e449..8c003092d 100644
--- a/functest/utils/env.py
+++ b/functest/utils/env.py
@@ -35,7 +35,8 @@ INPUTS = {
     'NAMESERVER': '8.8.8.8',
     'NEW_USER_ROLE': 'Member',
     'USE_DYNAMIC_CREDENTIALS': 'True',
-    'BLOCK_MIGRATION': 'True'
+    'BLOCK_MIGRATION': 'True',
+    'CLEAN_ORPHAN_SECURITY_GROUPS': 'True'
 }