From 3d093c66f21c57afeb8cfc242390d0d032509ab3 Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Oct 04 2022 07:25:17 +0000
Subject: ipatests: mark xfail tests using dnssec


In fedora 37+, the signing of DNS zones is failing.
Mark xfail the gating tests impacted by this issue, to avoid
breaking the CI gating when we move to f37.

Related: https://pagure.io/freeipa/issue/9216

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

---

diff --git a/ipatests/test_integration/test_dnssec.py b/ipatests/test_integration/test_dnssec.py
index e1bfc48..256cb15 100644
--- a/ipatests/test_integration/test_dnssec.py
+++ b/ipatests/test_integration/test_dnssec.py
@@ -20,6 +20,7 @@ from ipatests.test_integration.base import IntegrationTest
 from ipatests.pytest_ipa.integration import tasks
 from ipatests.pytest_ipa.integration.firewall import Firewall
 from ipaplatform.tasks import tasks as platform_tasks
+from ipaplatform.osinfo import osinfo
 from ipaplatform.paths import paths
 from ipapython.dnsutil import DNSResolver
 
@@ -324,6 +325,9 @@ class TestInstallDNSSECFirst(IntegrationTest):
 
         super(TestInstallDNSSECFirst, cls).uninstall(mh)
 
+    @pytest.mark.xfail(
+        osinfo.id == 'fedora' and osinfo.version_number >= (37,),
+        reason='freeipa ticket 9216', strict=True)
     def test_sign_root_zone(self):
         dnszone_add_dnssec(self.master, root_zone)
 
@@ -355,6 +359,9 @@ class TestInstallDNSSECFirst(IntegrationTest):
             self.replicas[0].ip, root_zone, timeout=300
         ), "Zone %s is not signed (replica)" % root_zone
 
+    @pytest.mark.xfail(
+        osinfo.id == 'fedora' and osinfo.version_number >= (37,),
+        reason='freeipa ticket 9216', strict=True)
     def test_delegation(self):
         dnszone_add_dnssec(self.master, example_test_zone)
 
@@ -420,6 +427,9 @@ class TestInstallDNSSECFirst(IntegrationTest):
             rtype="DS"
         ), "No DS record of '%s' returned from replica" % example_test_zone
 
+    @pytest.mark.xfail(
+        osinfo.id == 'fedora' and osinfo.version_number >= (37,),
+        reason='freeipa ticket 9216', strict=True)
     def test_chain_of_trust_drill(self):
         """
         Validate signed DNS records, using our own signed root zone
@@ -467,6 +477,9 @@ class TestInstallDNSSECFirst(IntegrationTest):
         self.master.run_command(args)
         self.replicas[0].run_command(args)
 
+    @pytest.mark.xfail(
+        osinfo.id == 'fedora' and osinfo.version_number >= (37,),
+        reason='freeipa ticket 9216', strict=True)
     def test_chain_of_trust_delv(self):
         """
         Validate signed DNS records, using our own signed root zone