Initial class creds creation in test base class

Each test class may now define at class level which credentials
are needed, and they will be allocated automatically by the base
class. To start using this a test class that requires network
resources must implement the setup_credentials method and
define the required resources before super is invoked.

In this patch this only affects the creation of credentials
as defined in the various base classes. Other tests will be
migrated as part of the resource-cleanup bp. Note that this
changes baremetal, identity and orchestration tests to
honour the tenant isolation settings.

Partially-implements: bp resource-cleanup

Change-Id: Id36a6ebddb618a78cee7025c9537cd1e2746190e

27 files changed, 132 insertions, 259 deletions

diff --git a/tempest/api/baremetal/admin/base.py b/tempest/api/baremetal/admin/base.py
index 9aeea0ae9..0b5d7d959 100644
--- a/tempest/api/baremetal/admin/base.py
+++ b/tempest/api/baremetal/admin/base.py
@@ -15,8 +15,6 @@ import functools
 from tempest_lib.common.utils import data_utils
 from tempest_lib import exceptions as lib_exc
 
-from tempest import clients
-from tempest.common import credentials
 from tempest import config
 from tempest import test
 
@@ -54,6 +52,8 @@ def creates(resource):
 class BaseBaremetalTest(test.BaseTestCase):
     """Base class for Baremetal API tests."""
 
+    credentials = ['admin']
+
     @classmethod
     def skip_checks(cls):
         super(BaseBaremetalTest, cls).skip_checks()
@@ -68,18 +68,9 @@ class BaseBaremetalTest(test.BaseTestCase):
             raise cls.skipException(skip_msg)
 
     @classmethod
-    def setup_credentials(cls):
-        super(BaseBaremetalTest, cls).setup_credentials()
-        if (not hasattr(cls, 'isolated_creds') or
-            not cls.isolated_creds.name == cls.__name__):
-            cls.isolated_creds = credentials.get_isolated_credentials(
-                name=cls.__name__, network_resources=cls.network_resources)
-        cls.mgr = clients.Manager(cls.isolated_creds.get_admin_creds())
-
-    @classmethod
     def setup_clients(cls):
         super(BaseBaremetalTest, cls).setup_clients()
-        cls.client = cls.mgr.baremetal_client
+        cls.client = cls.os_admin.baremetal_client
 
     @classmethod
     def resource_setup(cls):
diff --git a/tempest/api/compute/base.py b/tempest/api/compute/base.py
index 9f1a5488a..eca634dbe 100644
--- a/tempest/api/compute/base.py
+++ b/tempest/api/compute/base.py
@@ -20,8 +20,6 @@ from oslo_utils import excutils
 from tempest_lib.common.utils import data_utils
 from tempest_lib import exceptions as lib_exc
 
-from tempest import clients
-from tempest.common import credentials
 from tempest.common import fixed_network
 from tempest import config
 from tempest import exceptions
@@ -38,6 +36,10 @@ class BaseComputeTest(tempest.test.BaseTestCase):
     _api_version = 2
     force_tenant_isolation = False
 
+    # TODO(andreaf) We should care also for the alt_manager here
+    # but only once client lazy load in the manager is done
+    credentials = ['primary']
+
     @classmethod
     def skip_checks(cls):
         super(BaseComputeTest, cls).skip_checks()
@@ -50,12 +52,6 @@ class BaseComputeTest(tempest.test.BaseTestCase):
     def setup_credentials(cls):
         cls.set_network_resources()
         super(BaseComputeTest, cls).setup_credentials()
-        # TODO(andreaf) WE should care also for the alt_manager here
-        # but only once client lazy load in the manager is done
-        cls.os = cls.get_client_manager()
-        # Note that we put this here and not in skip_checks because in
-        # the case of preprovisioned users we won't know if we can get
-        # two distinct users until we go and lock them
         cls.multi_user = cls.check_multi_user()
 
     @classmethod
@@ -350,18 +346,7 @@ class BaseV2ComputeTest(BaseComputeTest):
 class BaseComputeAdminTest(BaseComputeTest):
     """Base test case class for Compute Admin API tests."""
 
-    @classmethod
-    def skip_checks(cls):
-        super(BaseComputeAdminTest, cls).skip_checks()
-        if not credentials.is_admin_available():
-            msg = ("Missing Identity Admin API credentials in configuration.")
-            raise cls.skipException(msg)
-
-    @classmethod
-    def setup_credentials(cls):
-        super(BaseComputeAdminTest, cls).setup_credentials()
-        creds = cls.isolated_creds.get_admin_creds()
-        cls.os_adm = clients.Manager(credentials=creds)
+    credentials = ['primary', 'admin']
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/compute/servers/test_servers_negative.py b/tempest/api/compute/servers/test_servers_negative.py
index 853e2621a..46b18868b 100644
--- a/tempest/api/compute/servers/test_servers_negative.py
+++ b/tempest/api/compute/servers/test_servers_negative.py
@@ -20,7 +20,6 @@ from tempest_lib import exceptions as lib_exc
 import testtools
 
 from tempest.api.compute import base
-from tempest import clients
 from tempest import config
 from tempest import test
 
@@ -29,6 +28,8 @@ CONF = config.CONF
 
 class ServersNegativeTestJSON(base.BaseV2ComputeTest):
 
+    credentials = ['primary', 'alt']
+
     def setUp(self):
         super(ServersNegativeTestJSON, self).setUp()
         try:
@@ -41,15 +42,10 @@ class ServersNegativeTestJSON(base.BaseV2ComputeTest):
         super(ServersNegativeTestJSON, self).tearDown()
 
     @classmethod
-    def setup_credentials(cls):
-        super(ServersNegativeTestJSON, cls).setup_credentials()
-        cls.alt_os = clients.Manager(cls.isolated_creds.get_alt_creds())
-
-    @classmethod
     def setup_clients(cls):
         super(ServersNegativeTestJSON, cls).setup_clients()
         cls.client = cls.servers_client
-        cls.alt_client = cls.alt_os.servers_client
+        cls.alt_client = cls.os_alt.servers_client
 
     @classmethod
     def resource_setup(cls):
diff --git a/tempest/api/compute/test_authorization.py b/tempest/api/compute/test_authorization.py
index 2baf608d2..435c1133c 100644
--- a/tempest/api/compute/test_authorization.py
+++ b/tempest/api/compute/test_authorization.py
@@ -20,7 +20,6 @@ from tempest_lib.common.utils import data_utils
 from tempest_lib import exceptions as lib_exc
 
 from tempest.api.compute import base
-from tempest import clients
 from tempest import config
 from tempest import test
 
@@ -31,6 +30,8 @@ LOG = logging.getLogger(__name__)
 
 class AuthorizationTestJSON(base.BaseV2ComputeTest):
 
+    credentials = ['primary', 'alt']
+
     @classmethod
     def skip_checks(cls):
         super(AuthorizationTestJSON, cls).skip_checks()
@@ -42,12 +43,6 @@ class AuthorizationTestJSON(base.BaseV2ComputeTest):
         # No network resources required for this test
         cls.set_network_resources()
         super(AuthorizationTestJSON, cls).setup_credentials()
-        if not cls.multi_user:
-            msg = "Need >1 user"
-            raise cls.skipException(msg)
-
-        creds = cls.isolated_creds.get_alt_creds()
-        cls.alt_manager = clients.Manager(credentials=creds)
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/data_processing/base.py b/tempest/api/data_processing/base.py
index 5a903b738..904cbb6db 100644
--- a/tempest/api/data_processing/base.py
+++ b/tempest/api/data_processing/base.py
@@ -225,6 +225,8 @@ DEFAULT_TEMPLATES = {
 
 class BaseDataProcessingTest(tempest.test.BaseTestCase):
 
+    credentials = ['primary']
+
     @classmethod
     def skip_checks(cls):
         super(BaseDataProcessingTest, cls).skip_checks()
@@ -233,11 +235,6 @@ class BaseDataProcessingTest(tempest.test.BaseTestCase):
         cls.default_plugin = cls._get_default_plugin()
 
     @classmethod
-    def setup_credentials(cls):
-        super(BaseDataProcessingTest, cls).setup_credentials()
-        cls.os = cls.get_client_manager()
-
-    @classmethod
     def setup_clients(cls):
         super(BaseDataProcessingTest, cls).setup_clients()
         cls.client = cls.os.data_processing_client
diff --git a/tempest/api/database/base.py b/tempest/api/database/base.py
index 1868f2326..f4c1881bb 100644
--- a/tempest/api/database/base.py
+++ b/tempest/api/database/base.py
@@ -25,6 +25,8 @@ LOG = logging.getLogger(__name__)
 class BaseDatabaseTest(tempest.test.BaseTestCase):
     """Base test case class for all Database API tests."""
 
+    credentials = ['primary']
+
     @classmethod
     def skip_checks(cls):
         super(BaseDatabaseTest, cls).skip_checks()
@@ -33,11 +35,6 @@ class BaseDatabaseTest(tempest.test.BaseTestCase):
             raise cls.skipException(skip_msg)
 
     @classmethod
-    def setup_credentials(cls):
-        super(BaseDatabaseTest, cls).setup_credentials()
-        cls.os = cls.get_client_manager()
-
-    @classmethod
     def setup_clients(cls):
         super(BaseDatabaseTest, cls).setup_clients()
         cls.database_flavors_client = cls.os.database_flavors_client
diff --git a/tempest/api/identity/base.py b/tempest/api/identity/base.py
index b83da3ead..5d66b9c73 100644
--- a/tempest/api/identity/base.py
+++ b/tempest/api/identity/base.py
@@ -17,9 +17,7 @@ from oslo_log import log as logging
 from tempest_lib.common.utils import data_utils
 from tempest_lib import exceptions as lib_exc
 
-from tempest import clients
 from tempest.common import cred_provider
-from tempest.common import credentials
 from tempest import config
 import tempest.test
 
@@ -66,6 +64,8 @@ class BaseIdentityTest(tempest.test.BaseTestCase):
 
 class BaseIdentityV2Test(BaseIdentityTest):
 
+    credentials = ['primary']
+
     @classmethod
     def setup_credentials(cls):
         super(BaseIdentityV2Test, cls).setup_credentials()
@@ -94,24 +94,13 @@ class BaseIdentityV2Test(BaseIdentityTest):
 
 class BaseIdentityV2AdminTest(BaseIdentityV2Test):
 
-    @classmethod
-    def setup_credentials(cls):
-        super(BaseIdentityV2AdminTest, cls).setup_credentials()
-        cls.os_adm = clients.Manager(cls.isolated_creds.get_admin_creds())
-
-    @classmethod
-    def skip_checks(cls):
-        if not credentials.is_admin_available():
-            raise cls.skipException('v2 Admin auth disabled')
-        super(BaseIdentityV2AdminTest, cls).skip_checks()
+    credentials = ['admin']
 
     @classmethod
     def setup_clients(cls):
         super(BaseIdentityV2AdminTest, cls).setup_clients()
         cls.client = cls.os_adm.identity_client
         cls.token_client = cls.os_adm.token_client
-        if not cls.client.has_admin_extensions():
-            raise cls.skipException("Admin extensions disabled")
 
     @classmethod
     def resource_setup(cls):
@@ -126,6 +115,8 @@ class BaseIdentityV2AdminTest(BaseIdentityV2Test):
 
 class BaseIdentityV3Test(BaseIdentityTest):
 
+    credentials = ['primary']
+
     @classmethod
     def setup_credentials(cls):
         super(BaseIdentityV3Test, cls).setup_credentials()
@@ -155,16 +146,7 @@ class BaseIdentityV3Test(BaseIdentityTest):
 
 class BaseIdentityV3AdminTest(BaseIdentityV3Test):
 
-    @classmethod
-    def setup_credentials(cls):
-        super(BaseIdentityV3AdminTest, cls).setup_credentials()
-        cls.os_adm = clients.Manager(cls.isolated_creds.get_admin_creds())
-
-    @classmethod
-    def skip_checks(cls):
-        if not credentials.is_admin_available():
-            raise cls.skipException('v3 Admin auth disabled')
-        super(BaseIdentityV3AdminTest, cls).skip_checks()
+    credentials = ['admin']
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/image/base.py b/tempest/api/image/base.py
index 74044dc50..acf8272dc 100644
--- a/tempest/api/image/base.py
+++ b/tempest/api/image/base.py
@@ -17,8 +17,6 @@ from six import moves
 from tempest_lib.common.utils import data_utils
 from tempest_lib import exceptions as lib_exc
 
-from tempest import clients
-from tempest.common import credentials
 from tempest import config
 import tempest.test
 
@@ -30,6 +28,8 @@ LOG = logging.getLogger(__name__)
 class BaseImageTest(tempest.test.BaseTestCase):
     """Base test class for Image API tests."""
 
+    credentials = ['primary']
+
     @classmethod
     def skip_checks(cls):
         super(BaseImageTest, cls).skip_checks()
@@ -39,14 +39,11 @@ class BaseImageTest(tempest.test.BaseTestCase):
 
     @classmethod
     def setup_credentials(cls):
+        cls.set_network_resources()
         super(BaseImageTest, cls).setup_credentials()
-        cls.isolated_creds = credentials.get_isolated_credentials(
-            cls.__name__, network_resources=cls.network_resources)
-        cls.os = clients.Manager(cls.isolated_creds.get_primary_creds())
 
     @classmethod
     def resource_setup(cls):
-        cls.set_network_resources()
         super(BaseImageTest, cls).resource_setup()
         cls.created_images = []
 
@@ -96,10 +93,7 @@ class BaseV1ImageTest(BaseImageTest):
 
 class BaseV1ImageMembersTest(BaseV1ImageTest):
 
-    @classmethod
-    def setup_credentials(cls):
-        super(BaseV1ImageMembersTest, cls).setup_credentials()
-        cls.os_alt = clients.Manager(cls.isolated_creds.get_alt_creds())
+    credentials = ['primary', 'alt']
 
     @classmethod
     def setup_clients(cls):
@@ -138,11 +132,7 @@ class BaseV2ImageTest(BaseImageTest):
 
 class BaseV2MemberImageTest(BaseV2ImageTest):
 
-    @classmethod
-    def setup_credentials(cls):
-        super(BaseV2MemberImageTest, cls).setup_credentials()
-        creds = cls.isolated_creds.get_alt_creds()
-        cls.os_alt = clients.Manager(creds)
+    credentials = ['primary', 'alt']
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/messaging/base.py b/tempest/api/messaging/base.py
index c4214f27c..2ddc3fc4e 100644
--- a/tempest/api/messaging/base.py
+++ b/tempest/api/messaging/base.py
@@ -35,6 +35,8 @@ class BaseMessagingTest(test.BaseTestCase):
         messaging as True
     """
 
+    credentials = ['primary']
+
     @classmethod
     def skip_checks(cls):
         super(BaseMessagingTest, cls).skip_checks()
@@ -42,11 +44,6 @@ class BaseMessagingTest(test.BaseTestCase):
             raise cls.skipException("Zaqar support is required")
 
     @classmethod
-    def setup_credentials(cls):
-        super(BaseMessagingTest, cls).setup_credentials()
-        cls.os = cls.get_client_manager()
-
-    @classmethod
     def setup_clients(cls):
         super(BaseMessagingTest, cls).setup_clients()
         cls.client = cls.os.messaging_client
diff --git a/tempest/api/network/admin/test_floating_ips_admin_actions.py b/tempest/api/network/admin/test_floating_ips_admin_actions.py
index ce3e31982..afc32da00 100644
--- a/tempest/api/network/admin/test_floating_ips_admin_actions.py
+++ b/tempest/api/network/admin/test_floating_ips_admin_actions.py
@@ -16,7 +16,6 @@
 from tempest_lib.common.utils import data_utils
 
 from tempest.api.network import base
-from tempest import clients
 from tempest import config
 from tempest import test
 
@@ -25,11 +24,7 @@ CONF = config.CONF
 
 class FloatingIPAdminTestJSON(base.BaseAdminNetworkTest):
     force_tenant_isolation = True
-
-    @classmethod
-    def setup_credentials(cls):
-        super(FloatingIPAdminTestJSON, cls).setup_credentials()
-        cls.alt_manager = clients.Manager(cls.isolated_creds.get_alt_creds())
+    credentials = ['primary', 'alt', 'admin']
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/network/admin/test_load_balancer_admin_actions.py b/tempest/api/network/admin/test_load_balancer_admin_actions.py
index 5a32119cf..41f5caa99 100644
--- a/tempest/api/network/admin/test_load_balancer_admin_actions.py
+++ b/tempest/api/network/admin/test_load_balancer_admin_actions.py
@@ -27,6 +27,8 @@ class LoadBalancerAdminTestJSON(base.BaseAdminNetworkTest):
     Create health monitor for another tenant
     """
 
+    force_tenant_isolation = True
+
     @classmethod
     def skip_checks(cls):
         super(LoadBalancerAdminTestJSON, cls).skip_checks()
@@ -35,12 +37,6 @@ class LoadBalancerAdminTestJSON(base.BaseAdminNetworkTest):
             raise cls.skipException(msg)
 
     @classmethod
-    def setup_credentials(cls):
-        super(LoadBalancerAdminTestJSON, cls).setup_credentials()
-        cls.manager = cls.get_client_manager()
-        cls.primary_creds = cls.isolated_creds.get_primary_creds()
-
-    @classmethod
     def setup_clients(cls):
         super(LoadBalancerAdminTestJSON, cls).setup_clients()
         cls.client = cls.manager.network_client
@@ -48,8 +44,7 @@ class LoadBalancerAdminTestJSON(base.BaseAdminNetworkTest):
     @classmethod
     def resource_setup(cls):
         super(LoadBalancerAdminTestJSON, cls).resource_setup()
-        cls.force_tenant_isolation = True
-        cls.tenant_id = cls.primary_creds.tenant_id
+        cls.tenant_id = cls.os.credentials.tenant_id
         cls.network = cls.create_network()
         cls.subnet = cls.create_subnet(cls.network)
         cls.pool = cls.create_pool(data_utils.rand_name('pool-'),
diff --git a/tempest/api/network/base.py b/tempest/api/network/base.py
index 26a31cb84..1cd138699 100644
--- a/tempest/api/network/base.py
+++ b/tempest/api/network/base.py
@@ -18,8 +18,6 @@ from oslo_log import log as logging
 from tempest_lib.common.utils import data_utils
 from tempest_lib import exceptions as lib_exc
 
-from tempest import clients
-from tempest.common import credentials
 from tempest import config
 from tempest import exceptions
 import tempest.test
@@ -52,6 +50,7 @@ class BaseNetworkTest(tempest.test.BaseTestCase):
     """
 
     force_tenant_isolation = False
+    credentials = ['primary']
 
     # Default to ipv4.
     _ip_version = 4
@@ -69,7 +68,6 @@ class BaseNetworkTest(tempest.test.BaseTestCase):
         # Create no network resources for these test.
         cls.set_network_resources()
         super(BaseNetworkTest, cls).setup_credentials()
-        cls.os = cls.get_client_manager()
 
     @classmethod
     def setup_clients(cls):
@@ -79,7 +77,6 @@ class BaseNetworkTest(tempest.test.BaseTestCase):
     @classmethod
     def resource_setup(cls):
         super(BaseNetworkTest, cls).resource_setup()
-
         cls.network_cfg = CONF.network
         cls.networks = []
         cls.subnets = []
@@ -426,19 +423,7 @@ class BaseNetworkTest(tempest.test.BaseTestCase):
 
 class BaseAdminNetworkTest(BaseNetworkTest):
 
-    @classmethod
-    def skip_checks(cls):
-        super(BaseAdminNetworkTest, cls).skip_checks()
-        if not credentials.is_admin_available():
-            msg = ("Missing Administrative Network API credentials "
-                   "in configuration.")
-            raise cls.skipException(msg)
-
-    @classmethod
-    def setup_credentials(cls):
-        super(BaseAdminNetworkTest, cls).setup_credentials()
-        creds = cls.isolated_creds.get_admin_creds()
-        cls.os_adm = clients.Manager(credentials=creds)
+    credentials = ['primary', 'admin']
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/object_storage/base.py b/tempest/api/object_storage/base.py
index c8697e1ad..8bc9b12b8 100644
--- a/tempest/api/object_storage/base.py
+++ b/tempest/api/object_storage/base.py
@@ -37,9 +37,11 @@ class BaseObjectTest(tempest.test.BaseTestCase):
     def setup_credentials(cls):
         cls.set_network_resources()
         super(BaseObjectTest, cls).setup_credentials()
+        operator_role = CONF.object_storage.operator_role
+        # There are no credentials by type used by object storage tests so
+        # isolated_creds must still be initialized
         cls.isolated_creds = credentials.get_isolated_credentials(
             cls.__name__, network_resources=cls.network_resources)
-        operator_role = CONF.object_storage.operator_role
         if not cls.isolated_creds.is_role_available(operator_role):
             skip_msg = ("%s skipped because the configured credential provider"
                         " is not able to provide credentials with the %s role "
diff --git a/tempest/api/orchestration/base.py b/tempest/api/orchestration/base.py
index d4b107e7a..beb4ac8eb 100644
--- a/tempest/api/orchestration/base.py
+++ b/tempest/api/orchestration/base.py
@@ -18,7 +18,6 @@ from tempest_lib import exceptions as lib_exc
 import yaml
 
 from tempest import clients
-from tempest.common import credentials
 from tempest import config
 import tempest.test
 
@@ -30,6 +29,8 @@ LOG = logging.getLogger(__name__)
 class BaseOrchestrationTest(tempest.test.BaseTestCase):
     """Base test case class for all Orchestration API tests."""
 
+    credentials = ['primary']
+
     @classmethod
     def skip_checks(cls):
         super(BaseOrchestrationTest, cls).skip_checks()
@@ -39,10 +40,6 @@ class BaseOrchestrationTest(tempest.test.BaseTestCase):
     @classmethod
     def setup_credentials(cls):
         super(BaseOrchestrationTest, cls).setup_credentials()
-        if (not hasattr(cls, 'isolated_creds') or
-            not cls.isolated_creds.name == cls.__name__):
-            cls.isolated_creds = credentials.get_isolated_credentials(
-                name=cls.__name__, network_resources=cls.network_resources)
         stack_owner_role = CONF.orchestration.stack_owner_role
         if not cls.isolated_creds.is_role_available(stack_owner_role):
             skip_msg = ("%s skipped because the configured credential provider"
diff --git a/tempest/api/orchestration/stacks/test_swift_resources.py b/tempest/api/orchestration/stacks/test_swift_resources.py
index 6884c6b18..d4fd3f9d5 100644
--- a/tempest/api/orchestration/stacks/test_swift_resources.py
+++ b/tempest/api/orchestration/stacks/test_swift_resources.py
@@ -16,7 +16,6 @@
 from tempest_lib.common.utils import data_utils
 
 from tempest.api.orchestration import base
-from tempest import clients
 from tempest import config
 from tempest import test
 
@@ -32,11 +31,6 @@ class SwiftResourcesTestJSON(base.BaseOrchestrationTest):
             raise cls.skipException("Swift support is required")
 
     @classmethod
-    def setup_credentials(cls):
-        super(SwiftResourcesTestJSON, cls).setup_credentials()
-        cls.os = clients.Manager()
-
-    @classmethod
     def setup_clients(cls):
         super(SwiftResourcesTestJSON, cls).setup_clients()
         cls.account_client = cls.os.account_client
diff --git a/tempest/api/telemetry/base.py b/tempest/api/telemetry/base.py
index ed719c2b9..43180e5dd 100644
--- a/tempest/api/telemetry/base.py
+++ b/tempest/api/telemetry/base.py
@@ -27,6 +27,8 @@ class BaseTelemetryTest(tempest.test.BaseTestCase):
 
     """Base test case class for all Telemetry API tests."""
 
+    credentials = ['primary']
+
     @classmethod
     def skip_checks(cls):
         super(BaseTelemetryTest, cls).skip_checks()
@@ -37,7 +39,6 @@ class BaseTelemetryTest(tempest.test.BaseTestCase):
     def setup_credentials(cls):
         cls.set_network_resources()
         super(BaseTelemetryTest, cls).setup_credentials()
-        cls.os = cls.get_client_manager()
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/volume/admin/test_volume_quotas.py b/tempest/api/volume/admin/test_volume_quotas.py
index 3ec321942..f69f0e3c9 100644
--- a/tempest/api/volume/admin/test_volume_quotas.py
+++ b/tempest/api/volume/admin/test_volume_quotas.py
@@ -27,7 +27,7 @@ class BaseVolumeQuotasAdminV2TestJSON(base.BaseVolumeAdminTest):
     @classmethod
     def setup_credentials(cls):
         super(BaseVolumeQuotasAdminV2TestJSON, cls).setup_credentials()
-        cls.demo_tenant_id = cls.isolated_creds.get_primary_creds().tenant_id
+        cls.demo_tenant_id = cls.os.credentials.tenant_id
 
     @test.attr(type='gate')
     @test.idempotent_id('59eada70-403c-4cef-a2a3-a8ce2f1b07a0')
diff --git a/tempest/api/volume/admin/test_volume_quotas_negative.py b/tempest/api/volume/admin/test_volume_quotas_negative.py
index d7287f036..d1a6db0f4 100644
--- a/tempest/api/volume/admin/test_volume_quotas_negative.py
+++ b/tempest/api/volume/admin/test_volume_quotas_negative.py
@@ -25,8 +25,7 @@ class BaseVolumeQuotasNegativeV2TestJSON(base.BaseVolumeAdminTest):
     @classmethod
     def setup_credentials(cls):
         super(BaseVolumeQuotasNegativeV2TestJSON, cls).setup_credentials()
-        cls.demo_user = cls.isolated_creds.get_primary_creds()
-        cls.demo_tenant_id = cls.demo_user.tenant_id
+        cls.demo_tenant_id = cls.os.credentials.tenant_id
 
     @classmethod
     def resource_setup(cls):
diff --git a/tempest/api/volume/base.py b/tempest/api/volume/base.py
index 28676b007..7f56b1870 100644
--- a/tempest/api/volume/base.py
+++ b/tempest/api/volume/base.py
@@ -17,8 +17,6 @@ from oslo_log import log as logging
 from tempest_lib.common.utils import data_utils
 from tempest_lib import exceptions as lib_exc
 
-from tempest import clients
-from tempest.common import credentials
 from tempest.common import fixed_network
 from tempest import config
 from tempest import exceptions
@@ -33,6 +31,7 @@ class BaseVolumeTest(tempest.test.BaseTestCase):
     """Base test case class for all Cinder API tests."""
 
     _api_version = 2
+    credentials = ['primary']
 
     @classmethod
     def skip_checks(cls):
@@ -57,12 +56,10 @@ class BaseVolumeTest(tempest.test.BaseTestCase):
     def setup_credentials(cls):
         cls.set_network_resources()
         super(BaseVolumeTest, cls).setup_credentials()
-        cls.os = cls.get_client_manager()
 
     @classmethod
     def setup_clients(cls):
         super(BaseVolumeTest, cls).setup_clients()
-
         cls.servers_client = cls.os.servers_client
         cls.networks_client = cls.os.networks_client
 
@@ -175,18 +172,7 @@ class BaseVolumeTest(tempest.test.BaseTestCase):
 class BaseVolumeAdminTest(BaseVolumeTest):
     """Base test case class for all Volume Admin API tests."""
 
-    @classmethod
-    def skip_checks(cls):
-        super(BaseVolumeAdminTest, cls).skip_checks()
-        if not credentials.is_admin_available():
-            msg = ("Missing Identity Admin API credentials in configuration.")
-            raise cls.skipException(msg)
-
-    @classmethod
-    def setup_credentials(cls):
-        super(BaseVolumeAdminTest, cls).setup_credentials()
-        cls.adm_creds = cls.isolated_creds.get_admin_creds()
-        cls.os_adm = clients.Manager(credentials=cls.adm_creds)
+    credentials = ['primary', 'admin']
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/volume/test_volume_transfers.py b/tempest/api/volume/test_volume_transfers.py
index 4acab39e6..bcd3fa981 100644
--- a/tempest/api/volume/test_volume_transfers.py
+++ b/tempest/api/volume/test_volume_transfers.py
@@ -16,8 +16,6 @@
 from testtools import matchers
 
 from tempest.api.volume import base
-from tempest import clients
-from tempest.common import credentials
 from tempest import config
 from tempest import test
 
@@ -26,21 +24,7 @@ CONF = config.CONF
 
 class VolumesV2TransfersTest(base.BaseVolumeTest):
 
-    @classmethod
-    def skip_checks(cls):
-        super(VolumesV2TransfersTest, cls).skip_checks()
-        if not credentials.is_admin_available():
-            msg = "Missing Volume Admin API credentials in configuration."
-            raise cls.skipException(msg)
-
-    @classmethod
-    def setup_credentials(cls):
-        super(VolumesV2TransfersTest, cls).setup_credentials()
-        # Add another tenant to test volume-transfer
-        cls.os_alt = clients.Manager(cls.isolated_creds.get_alt_creds())
-        # Add admin tenant to cleanup resources
-        creds = cls.isolated_creds.get_admin_creds()
-        cls.os_adm = clients.Manager(credentials=creds)
+    credentials = ['primary', 'alt', 'admin']
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/common/credentials.py b/tempest/common/credentials.py
index c34df48ef..71d905f82 100644
--- a/tempest/common/credentials.py
+++ b/tempest/common/credentials.py
@@ -69,3 +69,25 @@ def is_admin_available():
         except exceptions.InvalidConfiguration:
             is_admin = False
     return is_admin
+
+
+# We want a helper function here to check and see if alt credentials
+# are available so we can do a single call from skip_checks if alt
+# creds area vailable.
+def is_alt_available():
+    # If tenant isolation is enabled admin will be available
+    if CONF.auth.allow_tenant_isolation:
+        return True
+    # Check whether test accounts file has the admin specified or not
+    if (CONF.auth.test_accounts_file and
+            os.path.isfile(CONF.auth.test_accounts_file)):
+        check_accounts = accounts.Accounts(name='check_alt')
+    else:
+        check_accounts = accounts.NotLockingAccounts(name='check_alt')
+    try:
+        if not check_accounts.is_multi_user():
+            return False
+        else:
+            return True
+    except exceptions.InvalidConfiguration:
+        return False
diff --git a/tempest/scenario/manager.py b/tempest/scenario/manager.py
index cc152d2c9..c7272fef7 100644
--- a/tempest/scenario/manager.py
+++ b/tempest/scenario/manager.py
@@ -23,7 +23,6 @@ from tempest_lib.common.utils import data_utils
 from tempest_lib import exceptions as lib_exc
 
 from tempest import clients
-from tempest.common import credentials
 from tempest.common import fixed_network
 from tempest.common.utils.linux import remote_client
 from tempest import config
@@ -39,16 +38,7 @@ LOG = log.getLogger(__name__)
 class ScenarioTest(tempest.test.BaseTestCase):
     """Base class for scenario tests. Uses tempest own clients. """
 
-    @classmethod
-    def setup_credentials(cls):
-        super(ScenarioTest, cls).setup_credentials()
-        # TODO(andreaf) Some of the code from this resource_setup could be
-        # moved into `BaseTestCase`
-        cls.isolated_creds = credentials.get_isolated_credentials(
-            cls.__name__, network_resources=cls.network_resources)
-        cls.manager = clients.Manager(
-            credentials=cls.credentials()
-        )
+    credentials = ['primary']
 
     @classmethod
     def setup_clients(cls):
@@ -72,21 +62,6 @@ class ScenarioTest(tempest.test.BaseTestCase):
         # Heat client
         cls.orchestration_client = cls.manager.orchestration_client
 
-    @classmethod
-    def credentials(cls):
-        return cls.isolated_creds.get_primary_creds()
-
-    @classmethod
-    def alt_credentials(cls):
-        return cls.isolated_creds.get_alt_creds()
-
-    @classmethod
-    def admin_credentials(cls):
-        try:
-            return cls.isolated_creds.get_admin_creds()
-        except NotImplementedError:
-            raise cls.skipException('Admin Credentials are not available')
-
     # ## Methods to handle sync and async deletes
 
     def setUp(self):
@@ -550,19 +525,13 @@ class NetworkScenarioTest(ScenarioTest):
 
     """
 
+    credentials = ['primary', 'admin']
+
     @classmethod
     def skip_checks(cls):
         super(NetworkScenarioTest, cls).skip_checks()
         if not CONF.service_available.neutron:
             raise cls.skipException('Neutron not available')
-        if not credentials.is_admin_available():
-            msg = ("Missing Identity Admin API credentials in configuration.")
-            raise cls.skipException(msg)
-
-    @classmethod
-    def setup_credentials(cls):
-        super(NetworkScenarioTest, cls).setup_credentials()
-        cls.admin_manager = clients.Manager(cls.admin_credentials())
 
     @classmethod
     def resource_setup(cls):
@@ -1170,6 +1139,9 @@ class BaremetalProvisionStates(object):
 
 
 class BaremetalScenarioTest(ScenarioTest):
+
+    credentials = ['primary', 'admin']
+
     @classmethod
     def skip_checks(cls):
         super(BaremetalScenarioTest, cls).skip_checks()
@@ -1179,14 +1151,10 @@ class BaremetalScenarioTest(ScenarioTest):
             raise cls.skipException(msg)
 
     @classmethod
-    def setup_credentials(cls):
-        super(BaremetalScenarioTest, cls).setup_credentials()
+    def setup_clients(cls):
+        super(BaremetalScenarioTest, cls).setup_clients()
 
-        # use an admin client manager for baremetal client
-        manager = clients.Manager(
-            credentials=cls.admin_credentials()
-        )
-        cls.baremetal_client = manager.baremetal_client
+        cls.baremetal_client = cls.admin_manager.baremetal_client
 
     @classmethod
     def resource_setup(cls):
@@ -1308,18 +1276,12 @@ class EncryptionScenarioTest(ScenarioTest):
     Base class for encryption scenario tests
     """
 
-    @classmethod
-    def skip_checks(cls):
-        super(EncryptionScenarioTest, cls).skip_checks()
-        if not credentials.is_admin_available():
-            msg = ("Missing Identity Admin API credentials in configuration.")
-            raise cls.skipException(msg)
+    credentials = ['primary', 'admin']
 
     @classmethod
     def setup_clients(cls):
         super(EncryptionScenarioTest, cls).setup_clients()
-        admin_manager = clients.Manager(cls.admin_credentials())
-        cls.admin_volume_types_client = admin_manager.volume_types_client
+        cls.admin_volume_types_client = cls.os_adm.volume_types_client
 
     def _wait_for_volume_status(self, status):
         self.status_timeout(
diff --git a/tempest/scenario/test_aggregates_basic_ops.py b/tempest/scenario/test_aggregates_basic_ops.py
index b1d3418c2..0e158ed53 100644
--- a/tempest/scenario/test_aggregates_basic_ops.py
+++ b/tempest/scenario/test_aggregates_basic_ops.py
@@ -16,7 +16,6 @@
 from oslo_log import log as logging
 from tempest_lib.common.utils import data_utils
 
-from tempest.common import credentials
 from tempest.common import tempest_fixtures as fixtures
 from tempest.scenario import manager
 from tempest import test
@@ -34,23 +33,18 @@ class TestAggregatesBasicOps(manager.ScenarioTest):
     Removes host from aggregate
     Deletes aggregate
     """
-    @classmethod
-    def skip_checks(cls):
-        super(TestAggregatesBasicOps, cls).skip_checks()
-        if not credentials.is_admin_available():
-            msg = ("Missing Identity Admin API credentials in configuration.")
-            raise cls.skipException(msg)
+
+    credentials = ['primary', 'admin']
 
     @classmethod
     def setup_clients(cls):
         super(TestAggregatesBasicOps, cls).setup_clients()
+        # Use admin client by default
+        cls.manager = cls.admin_manager
+        super(TestAggregatesBasicOps, cls).resource_setup()
         cls.aggregates_client = cls.manager.aggregates_client
         cls.hosts_client = cls.manager.hosts_client
 
-    @classmethod
-    def credentials(cls):
-        return cls.admin_credentials()
-
     def _create_aggregate(self, **kwargs):
         aggregate = self.aggregates_client.create_aggregate(**kwargs)
         self.addCleanup(self._delete_aggregate, aggregate)
diff --git a/tempest/scenario/test_dashboard_basic_ops.py b/tempest/scenario/test_dashboard_basic_ops.py
index dd7376a9f..5aec01f25 100644
--- a/tempest/scenario/test_dashboard_basic_ops.py
+++ b/tempest/scenario/test_dashboard_basic_ops.py
@@ -96,7 +96,7 @@ class TestDashboardBasicOps(manager.ScenarioTest):
     @test.idempotent_id('4f8851b1-0e69-482b-b63b-84c6e76f6c80')
     @test.services('dashboard')
     def test_basic_scenario(self):
-        creds = self.credentials()
+        creds = self.os.credentials
         self.check_login_page()
         self.user_login(creds.username, creds.password)
         self.check_home_page()
diff --git a/tempest/scenario/test_security_groups_basic_ops.py b/tempest/scenario/test_security_groups_basic_ops.py
index 1ecc212ae..03d338b90 100644
--- a/tempest/scenario/test_security_groups_basic_ops.py
+++ b/tempest/scenario/test_security_groups_basic_ops.py
@@ -92,6 +92,8 @@ class TestSecurityGroupsBasicOps(manager.NetworkScenarioTest):
             its own router connected to the public network
     """
 
+    credentials = ['primary', 'alt', 'admin']
+
     class TenantProperties(object):
         """
         helper class to save tenant details
@@ -143,9 +145,6 @@ class TestSecurityGroupsBasicOps(manager.NetworkScenarioTest):
         # TODO(mnewby) Consider looking up entities as needed instead
         # of storing them as collections on the class.
 
-        # get credentials for secondary tenant
-        cls.alt_creds = cls.isolated_creds.get_alt_creds()
-        cls.alt_manager = clients.Manager(cls.alt_creds)
         # Credentials from the manager are filled with both IDs and Names
         cls.alt_creds = cls.alt_manager.credentials
 
@@ -154,7 +153,7 @@ class TestSecurityGroupsBasicOps(manager.NetworkScenarioTest):
         super(TestSecurityGroupsBasicOps, cls).resource_setup()
         cls.floating_ips = {}
         cls.tenants = {}
-        creds = cls.credentials()
+        creds = cls.manager.credentials
         cls.primary_tenant = cls.TenantProperties(creds)
         cls.alt_tenant = cls.TenantProperties(cls.alt_creds)
         for tenant in [cls.primary_tenant, cls.alt_tenant]:
diff --git a/tempest/test.py b/tempest/test.py
index d57b1d832..80eba949a 100644
--- a/tempest/test.py
+++ b/tempest/test.py
@@ -232,6 +232,9 @@ class BaseTestCase(testtools.testcase.WithAttributes,
     setUpClassCalled = False
     _service = None
 
+    # NOTE(andreaf) credentials holds a list of the credentials to be allocated
+    # at class setup time. Credential types can be 'primary', 'alt' or 'admin'
+    credentials = []
     network_resources = {}
 
     # NOTE(sdague): log_format is defined inline here instead of using the oslo
@@ -317,15 +320,37 @@ class BaseTestCase(testtools.testcase.WithAttributes,
         If one is really needed it may be implemented either in the
         resource_setup or at test level.
         """
-        pass
+        if 'admin' in cls.credentials and not credentials.is_admin_available():
+            msg = "Missing Identity Admin API credentials in configuration."
+            raise cls.skipException(msg)
+        if 'alt' is cls.credentials and not credentials.is_alt_available():
+            msg = "Missing a 2nd set of API credentials in configuration."
+            raise cls.skipException(msg)
 
     @classmethod
     def setup_credentials(cls):
-        """Allocate credentials and the client managers from them."""
-        # TODO(andreaf) There is a fair amount of code that could me moved from
-        # base / test classes in here. Ideally tests should be able to only
-        # specify a list of (additional) credentials the need to use.
-        pass
+        """Allocate credentials and the client managers from them.
+        A test class that requires network resources must override
+        setup_credentials and defined the required resources before super
+        is invoked.
+        """
+        for credentials_type in cls.credentials:
+            # This may raise an exception in case credentials are not available
+            # In that case we want to let the exception through and the test
+            # fail accordingly
+            manager = cls.get_client_manager(
+                credential_type=credentials_type)
+            setattr(cls, 'os_%s' % credentials_type, manager)
+            # Setup some common aliases
+            # TODO(andreaf) The aliases below are a temporary hack
+            # to avoid changing too much code in one patch. They should
+            # be removed eventually
+            if credentials_type == 'primary':
+                cls.os = cls.manager = cls.os_primary
+            if credentials_type == 'admin':
+                cls.os_adm = cls.admin_manager = cls.os_admin
+            if credentials_type == 'alt':
+                cls.alt_manager = cls.os_alt
 
     @classmethod
     def setup_clients(cls):
@@ -379,7 +404,8 @@ class BaseTestCase(testtools.testcase.WithAttributes,
                                                    level=None))
 
     @classmethod
-    def get_client_manager(cls, identity_version=None):
+    def get_client_manager(cls, identity_version=None,
+                           credential_type='primary'):
         """
         Returns an OpenStack client manager
         """
@@ -394,7 +420,12 @@ class BaseTestCase(testtools.testcase.WithAttributes,
                 identity_version=identity_version
             )
 
-        creds = cls.isolated_creds.get_primary_creds()
+        credentials_method = 'get_%s_creds' % credential_type
+        if hasattr(cls.isolated_creds, credentials_method):
+            creds = getattr(cls.isolated_creds, credentials_method)()
+        else:
+            raise exceptions.InvalidCredentials(
+                "Invalid credentials type %s" % credential_type)
         os = clients.Manager(credentials=creds, service=cls._service)
         return os
 
@@ -470,7 +501,7 @@ class NegativeAutoTest(BaseTestCase):
     @classmethod
     def setUpClass(cls):
         super(NegativeAutoTest, cls).setUpClass()
-        os = cls.get_client_manager()
+        os = cls.get_client_manager(credential_type='primary')
         cls.client = os.negative_client
 
     @staticmethod
diff --git a/tempest/thirdparty/boto/test.py b/tempest/thirdparty/boto/test.py
index cd35e7f0a..2aef9109e 100644
--- a/tempest/thirdparty/boto/test.py
+++ b/tempest/thirdparty/boto/test.py
@@ -197,6 +197,8 @@ def friendly_function_call_str(call_able, *args, **kwargs):
 class BotoTestCase(tempest.test.BaseTestCase):
     """Recommended to use as base class for boto related test."""
 
+    credentials = ['primary']
+
     @classmethod
     def skip_checks(cls):
         super(BotoTestCase, cls).skip_checks()
@@ -207,11 +209,6 @@ class BotoTestCase(tempest.test.BaseTestCase):
             raise cls.skipException("Identity v2 is not available")
 
     @classmethod
-    def setup_credentials(cls):
-        super(BotoTestCase, cls).setup_credentials()
-        cls.os = cls.get_client_manager()
-
-    @classmethod
     def resource_setup(cls):
         super(BotoTestCase, cls).resource_setup()
         cls.conclusion = decision_maker()