Add Keystone-on-kind integration test (forge)

[berendt]

Summary

Adds the first integration test for openstack-project-manager: it deploys a live, Keystone-only Keystone on a kind cluster via forge, then drives the real tox -e create path as the admin account to create one project and asserts the result through the OpenStack SDK. This is the first thing in the repo that exercises a real openstack.connect() / keystone path instead of the mocks used by test/unit/.

Closes #293

Change set (in commit order)

1. 68776e6 Add forge Keystone deploy script and ControlPlane CR

   • test/integration/controlplane.yaml: a Keystone-only forge ControlPlane CR (release 2025.2, single replica, exposed at keystone.127-0-0-1.nip.io:8443/v3 via the openstack-gw gateway).
   • test/integration/deploy_keystone.sh: clones forge pinned to a known-good commit (FORGE_REF), uses forge's own install-test-deps to provide the pinned kind/kubectl toolchain, stands up the kind cluster + ControlPlane, then mints an ephemeral clouds.yaml from the operator-projected controlplane-keystone-admin-credentials Secret. It refuses to clobber an OS_CLIENT_CONFIG_FILE that points outside the dedicated in-tree path, serializes clouds.yaml with a YAML library (not a heredoc) so an arbitrary admin password can't corrupt the file, and pre-creates the member and load-balancer_member roles. The latter is needed because create.py indexes its role cache directly and a bare Keystone ships member but not load-balancer_member (Octavia normally provisions it) — create.py itself is left untouched.

2. b7bd7ec Add integration run.sh orchestration and SDK verifier

   • test/integration/run.sh: orchestrates deploy → tox -e create (as admin, with --nodomain-name-prefix so the project is named exactly opm-integration-test) → verify.py. An EXIT trap always tears down the kind cluster, but only when this run created it (a pre-existing debug cluster is reused and left in place); on failure it dumps diagnostics first. Best-effort project deletion keeps reruns idempotent unless KEEP_PROJECT=1.
   • test/integration/verify.py: a standalone openstacksdk script (deliberately not named test_*.py, so tox -e test never collects it) that asserts the default domain resolves, the opm-integration-test project exists in it, and the matching per-project group exists; it exits non-zero on any failed assertion.
   • .gitignore: ignores the generated test/integration/clouds.yaml.
   • tox.ini: passes OS_CLIENT_CONFIG_FILE through to the create env.

3. 1be0a3c Add Makefile integration targets

   • make integration (full provision/create/verify/teardown cycle), make integration-up (deploy and leave the cluster running for local debugging), make integration-down (delete the kind cluster).

4. b470a8e Add Ansible pre/test playbooks for integration job

   • playbooks/pre-integration.yml: prepares an IPv6-only Zuul node — ensure-pip/ensure-pipenv/ensure-docker roles, the libldap2-dev/libsasl2-dev build deps the create env needs, and an accept_ra=2 sysctl fix so the node keeps honouring router advertisements once kind enables IPv6 forwarding.
   • playbooks/test-integration.yml: installs tox + openstacksdk into a throwaway venv and runs make integration from the checkout.

5. bb61192 Add periodic-daily Zuul integration job

   • .zuul.yaml: defines openstack-project-manager-integration (ubuntu-noble, 2400s timeout) and adds it to periodic-daily only, so the heavy kind+Keystone job does not slow the check gate (which is left unchanged).

6. c3db56a Document the integration test harness

   • test/integration/README.md: prerequisites, the make targets, the environment overrides, what verify.py asserts, and the ephemeral-credentials handling.

Notes / divergences from the issue

• Keystone-only deploy: the issue asks to "deploy Keystone on kind (forge)". The harness applies a Keystone-only ControlPlane rather than a full forge control plane, keeping the job as light as feasible for the single happy-path assertion.
• load-balancer_member workaround: the only accommodation to the production code is pre-creating roles create.py expects (member, load-balancer_member) on the bare Keystone. create.py is intentionally left untouched; the workaround lives entirely in deploy_keystone.sh.
• CI placement: the job runs in periodic-daily, not the check pipeline, so PRs are not gated on the multi-minute kind+Keystone bring-up.
• The verifier checks not just the project but also the per-project group of the same name that create.py provisions, giving the happy path a slightly stronger assertion than the issue's minimal "create a project".

---

Implemented by planwerk-agent 84299e2 with Claude:claude-opus-4-8