Advanced scenario tests for Neutron

Introduction:

Currently, tempest verifies only basic networking scenarios, mostly booting an instance on a neutron network and accessing an instance via a floating IP. However this covers only a little percentage of scenarios available with Neutron.
Therefore the aim of this blueprint is to provide additional scenarios which are representative of production use cases.

High level description:

This blueprint will presumably be divided in several work items, one for each identified use case.
The work will be presumably completed in the icehouse timeframe and will hopefully involve several contributors.

Scenarios to enable within the scope of this blueprint should pertain to the core Neutron API and the most used extensions (l3 and security groups). Some examples are:

- Instance connectivity across routers
- External gateway connectivity (with and without SNAT)
- Moving floating IPs across routers
- Public (or shared) networks
- Denying access / Allowing access to a service editing security group rules
- Adding / Removing security groups to a port
- Access to metadata server via metadata agent

Tests for other neutron extensions, such as load balancing, or vpn, are probably outside the scope of this blueprint
It is also worth noting that the current API tests only verify that neutron service correctly fulfills the request. They do not verify that the corresponding operation is actually performed (for instance these tests would pass even if no neutron agent is running)
Tempest infrastructure changes:

If needed, some changes might be required to tempest's built in network client. No other changes are forecasted at this stage.
New scenarios should be added to smoke/gate tests only once they're stable enough.

Also, while these tests are aimed at upstream gate jobs and will therefore mainly target the ML2 plugin, they're supposed to be executed against any plugin; therefore these tests will not validate, for instance, that the appropriate configuration has been applied to the L3 agent, but rather they will verify that network traffic is handled as expected according to the configured scenario.

-- Full specification on wiki to follow up --