[#363] Updates for sanity scope

Signed-off-by: a.berezin <a.berezin@yadro.com>

.forgejo/workflows/dco.yml

@@ -0,0 +1,26 @@
+# yamllint disable rule:truthy
+
+name: DCO check
+on:
+  pull_request:
+
+jobs:
+  dco:
+    name: DCO
+    runs-on: docker
+    container:
+      image: node:22-bookworm
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.22'
+
+      - name: Run commit format checker
+        uses: https://git.frostfs.info/TrueCloudLab/dco-go@v3
+        with:
+          from: 'origin/${{ github.event.pull_request.base.ref }}'

.github/workflows/dco.yml

@@ -1,22 +0,0 @@
-name: DCO check
-
-on:
-  pull_request:
-    branches:
-      - master
-      - develop
-
-jobs:
-  commits_check_job:
-    runs-on: ubuntu-latest
-    name: Commits Check
-    steps:
-    - name: Get PR Commits
-      id: 'get-pr-commits'
-      uses: tim-actions/get-pr-commits@master
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-    - name: DCO Check
-      uses: tim-actions/dco@master
-      with:
-        commits: ${{ steps.get-pr-commits.outputs.commits }}

.pre-commit-config.yaml

@@ -10,7 +10,7 @@ repos:
       - id: isort
         name: isort (python)
   - repo: https://git.frostfs.info/TrueCloudLab/allure-validator
-    rev: 1.1.0
+    rev: 1.1.1
     hooks:
       - id: allure-validator
         args: [

CODEOWNERS

@@ -1 +1,3 @@
-*       @JuliaKovshova @abereziny @d.zayakin @anikeev-yadro @anurindm @ylukoyan @i.niyazov
+.*          @TrueCloudLab/qa-committers
+.forgejo/.* @potyarkin
+Makefile    @potyarkin

pytest.ini

@@ -10,6 +10,7 @@ markers =
     staging: test to be excluded from run in verifier/pr-validation/sanity jobs and run test in staging job
     sanity: test runs in sanity testrun
     smoke: test runs in smoke testrun
+    exclude_sanity: tests which should not be in sanity scope
 #   controlling markers
     order: manual control of test order
     logs_after_session: Make the last test in session
@@ -37,11 +38,12 @@ markers =
     session_token: tests for operations with session token
     static_session: tests for operations with static session token
     bearer: tests for bearer tokens
-    acl: All tests for ACL
-    acl_basic: tests for basic ACL
-    acl_bearer: tests for ACL with bearer
-    acl_extended: tests for extended ACL
-    acl_filters: tests for extended ACL with filters and headers
+    ape: tests for APE
+    ape_allow: tests for APE allow rules
+    ape_deny: tests for APE deny rules
+    ape_container: tests for APE on container operations
+    ape_object: tests for APE on object operations
+    ape_namespace: tests for APE on namespace scope
     storage_group: tests for storage groups
     failover: tests for system recovery after a failure
     failover_panic: tests for system recovery after panic reboot of a node

pytest_tests/__init__.py

@@ -0,0 +1,3 @@
+import os
+
+TESTS_BASE_PATH = os.path.dirname(os.path.relpath(__file__))

pytest_tests/helpers/container_access.py

@@ -6,7 +6,7 @@ from frostfs_testlib.storage.cluster import Cluster
 from frostfs_testlib.storage.dataclasses import ape
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 
-from pytest_tests.helpers.object_access import (
+from ..helpers.object_access import (
     can_delete_object,
     can_get_head_object,
     can_get_object,
@@ -20,7 +20,10 @@ ALL_OBJECT_OPERATIONS = ape.ObjectOperations.get_all()
 
 FULL_ACCESS = {op: True for op in ALL_OBJECT_OPERATIONS}
 NO_ACCESS = {op: False for op in ALL_OBJECT_OPERATIONS}
-RO_ACCESS = {op: True if op not in [ape.ObjectOperations.PUT, ape.ObjectOperations.DELETE] else False for op in ALL_OBJECT_OPERATIONS}
+RO_ACCESS = {
+    op: True if op not in [ape.ObjectOperations.PUT, ape.ObjectOperations.DELETE, ape.ObjectOperations.PATCH] else False
+    for op in ALL_OBJECT_OPERATIONS
+}
 
 
 def assert_access_to_container(

pytest_tests/helpers/container_creation.py

@@ -0,0 +1,87 @@
+import json
+import time
+
+from frostfs_testlib import reporter
+from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
+from frostfs_testlib.resources.common import MORPH_BLOCK_TIME
+from frostfs_testlib.shell.interfaces import Shell
+from frostfs_testlib.steps.cli.container import create_container, search_nodes_with_container
+from frostfs_testlib.storage.cluster import Cluster
+from frostfs_testlib.storage.dataclasses import ape
+from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
+from frostfs_testlib.testing.parallel import parallel
+from frostfs_testlib.utils import datetime_utils
+
+from .container_request import ContainerRequest, MultipleContainersRequest
+
+
+def create_container_with_ape(
+    container_request: ContainerRequest,
+    frostfs_cli: FrostfsCli,
+    wallet: WalletInfo,
+    shell: Shell,
+    cluster: Cluster,
+    endpoint: str,
+) -> str:
+    with reporter.step("Create container"):
+        cid = _create_container_by_spec(container_request, wallet, shell, cluster, endpoint)
+
+    if container_request.ape_rules:
+        with reporter.step("Apply APE rules for container"):
+            _apply_ape_rules(cid, frostfs_cli, endpoint, container_request.ape_rules)
+
+        with reporter.step("Wait for one block"):
+            time.sleep(datetime_utils.parse_time(MORPH_BLOCK_TIME))
+
+    with reporter.step("Search nodes holding the container"):
+        container_holder_nodes = search_nodes_with_container(wallet, cid, shell, cluster.default_rpc_endpoint, cluster)
+        report_data = {node.id: node.host_ip for node in container_holder_nodes}
+
+    reporter.attach(json.dumps(report_data, indent=2), "container_nodes.json")
+
+    return cid
+
+
+@reporter.step("Create multiple containers with APE")
+def create_containers_with_ape(
+    frostfs_cli: FrostfsCli,
+    wallet: WalletInfo,
+    shell: Shell,
+    cluster: Cluster,
+    endpoint: str,
+    multiple_containers_request: MultipleContainersRequest,
+) -> list[str]:
+    cids_futures = parallel(create_container_with_ape, multiple_containers_request, frostfs_cli, wallet, shell, cluster, endpoint)
+    return [future.result() for future in cids_futures]
+
+
+@reporter.step("Create container by spec {container_request}")
+def _create_container_by_spec(
+    container_request: ContainerRequest,
+    wallet: WalletInfo,
+    shell: Shell,
+    cluster: Cluster,
+    endpoint: str,
+) -> str:
+    return create_container(
+        wallet,
+        shell,
+        endpoint,
+        container_request.parsed_rule(cluster),
+        wait_for_creation=False,
+        nns_zone=container_request.ns_zone,
+        nns_name=container_request.ns_name,
+    )
+
+
+def _apply_ape_rules(cid: str, frostfs_cli: FrostfsCli, endpoint: str, ape_rules: list[ape.Rule]):
+    for ape_rule in ape_rules:
+        rule_str = ape_rule.as_string()
+        with reporter.step(f"Apply APE rule '{rule_str}' for container {cid}"):
+            frostfs_cli.ape_manager.add(
+                endpoint,
+                ape_rule.chain_id,
+                target_name=cid,
+                target_type="container",
+                rule=rule_str,
+            )

pytest_tests/helpers/container_request.py

@@ -0,0 +1,107 @@
+from dataclasses import dataclass
+from functools import partial
+
+import pytest
+from frostfs_testlib.steps.cli.container import DEFAULT_PLACEMENT_RULE
+from frostfs_testlib.storage.cluster import Cluster
+from frostfs_testlib.storage.dataclasses import ape
+
+APE_EVERYONE_ALLOW_ALL = [ape.Rule(ape.Verb.ALLOW, ape.ObjectOperations.WILDCARD_ALL)]
+# In case if we need container operations
+# ape.Rule(ape.Verb.ALLOW, ape.ContainerOperations.WILDCARD_ALL)]
+APE_OWNER_ALLOW_ALL = [ape.Rule(ape.Verb.ALLOW, ape.ObjectOperations.WILDCARD_ALL, ape.Condition.by_role(ape.Role.OWNER))]
+# In case if we need container operations
+# ape.Rule(ape.Verb.ALLOW, ape.ContainerOperations.WILDCARD_ALL, ape.Condition.by_role(ape.Role.OWNER))]
+
+
+@dataclass
+class ContainerRequest:
+    policy: str = None
+    ape_rules: list[ape.Rule] = None
+
+    short_name: str | None = None
+
+    ns_name: str | None = None
+    ns_zone: str | None = None
+
+    def __post_init__(self):
+        if self.ape_rules is None:
+            self.ape_rules = []
+
+        # For pytest instead of ids=[...] everywhere
+        self.__name__ = self.short_name
+
+    def parsed_rule(self, cluster: Cluster):
+        if self.policy is None:
+            return None
+
+        substitutions = {"%NODE_COUNT%": str(len(cluster.cluster_nodes))}
+
+        parsed_rule = self.policy
+        for sub, replacement in substitutions.items():
+            parsed_rule = parsed_rule.replace(sub, replacement)
+
+        return parsed_rule
+
+    def __repr__(self):
+        if self.short_name:
+            return self.short_name
+
+        spec_info: list[str] = []
+
+        if self.policy:
+            spec_info.append(f"policy='{self.policy}'")
+        if self.ape_rules:
+            ape_rules_list = ", ".join([f"'{rule.as_string()}'" for rule in self.ape_rules])
+            spec_info.append(f"ape_rules=[{ape_rules_list}]")
+
+        return f"({', '.join(spec_info)})"
+
+
+class MultipleContainersRequest(list[ContainerRequest]):
+    def __init__(self, iterable=None):
+        """Override initializer which can accept iterable"""
+        super(MultipleContainersRequest, self).__init__()
+        if iterable:
+            self.extend(iterable)
+        self.__set_name()
+
+    def __set_name(self):
+        self.__name__ = ", ".join([s.__name__ for s in self])
+
+
+PUBLIC_WITH_POLICY = partial(ContainerRequest, ape_rules=APE_EVERYONE_ALLOW_ALL, short_name="Custom_policy_with_allow_all_ape_rule")
+
+# REPS
+REP_1_1_1 = "REP 1 IN X CBF 1 SELECT 1 FROM * AS X"
+
+REP_2_1_2 = "REP 2 IN X CBF 1 SELECT 2 FROM * AS X"
+REP_2_1_4 = "REP 2 IN X CBF 1 SELECT 4 FROM * AS X"
+
+REP_2_2_2 = "REP 2 IN X CBF 2 SELECT 2 FROM * AS X"
+REP_2_2_4 = "REP 2 IN X CBF 2 SELECT 4 FROM * AS X"
+#
+
+# Public means it has APE rule which allows everything for everyone
+REP_1_1_1_PUBLIC = PUBLIC_WITH_POLICY(REP_1_1_1, short_name="REP 1 CBF 1 SELECT 1 (public)")
+
+REP_2_1_2_PUBLIC = PUBLIC_WITH_POLICY(REP_2_1_2, short_name="REP 2 CBF 1 SELECT 2 (public)")
+REP_2_1_4_PUBLIC = PUBLIC_WITH_POLICY(REP_2_1_4, short_name="REP 2 CBF 1 SELECT 4 (public)")
+
+REP_2_2_2_PUBLIC = PUBLIC_WITH_POLICY(REP_2_2_2, short_name="REP 2 CBF 2 SELECT 2 (public)")
+REP_2_2_4_PUBLIC = PUBLIC_WITH_POLICY(REP_2_2_4, short_name="REP 2 CBF 2 SELECT 4 (public)")
+#
+
+EVERYONE_ALLOW_ALL = ContainerRequest(policy=DEFAULT_PLACEMENT_RULE, ape_rules=APE_EVERYONE_ALLOW_ALL, short_name="Everyone_Allow_All")
+OWNER_ALLOW_ALL = ContainerRequest(policy=DEFAULT_PLACEMENT_RULE, ape_rules=APE_OWNER_ALLOW_ALL, short_name="Owner_Allow_All")
+PRIVATE = ContainerRequest(policy=DEFAULT_PLACEMENT_RULE, ape_rules=[], short_name="Private_No_APE")
+
+
+def requires_container(container_request: None | ContainerRequest | list[ContainerRequest] = None) -> pytest.MarkDecorator:
+    if container_request is None:
+        container_request = EVERYONE_ALLOW_ALL
+
+    if not isinstance(container_request, list):
+        container_request = [container_request]
+
+    return pytest.mark.parametrize("container_request", container_request, indirect=True)

pytest_tests/helpers/container_spec.py

@@ -1,23 +0,0 @@
-from dataclasses import dataclass
-
-from frostfs_testlib.steps.cli.container import DEFAULT_PLACEMENT_RULE
-from frostfs_testlib.storage.cluster import Cluster
-
-
-@dataclass
-class ContainerSpec:
-    rule: str = DEFAULT_PLACEMENT_RULE
-    basic_acl: str = None
-    allow_owner_via_ape: bool = False
-
-    def parsed_rule(self, cluster: Cluster):
-        if self.rule is None:
-            return None
-
-        substitutions = {"%NODE_COUNT%": str(len(cluster.cluster_nodes))}
-
-        parsed_rule = self.rule
-        for sub, replacement in substitutions.items():
-            parsed_rule = parsed_rule.replace(sub, replacement)
-
-        return parsed_rule

pytest_tests/helpers/object_access.py

@@ -2,7 +2,7 @@ from typing import Optional
 
 from frostfs_testlib import reporter
 from frostfs_testlib.resources.cli import CLI_DEFAULT_TIMEOUT
-from frostfs_testlib.resources.error_patterns import OBJECT_ACCESS_DENIED, OBJECT_NOT_FOUND
+from frostfs_testlib.resources.error_patterns import OBJECT_ACCESS_DENIED
 from frostfs_testlib.shell import Shell
 from frostfs_testlib.steps.cli.object import (
     delete_object,
@@ -20,10 +20,6 @@ from frostfs_testlib.utils.file_utils import get_file_hash
 
 OPERATION_ERROR_TYPE = RuntimeError
 
-# TODO: Revert to just OBJECT_ACCESS_DENIED when the issue is fixed
-# https://git.frostfs.info/TrueCloudLab/frostfs-node/issues/1297
-OBJECT_NO_ACCESS = rf"(?:{OBJECT_NOT_FOUND}|{OBJECT_ACCESS_DENIED})"
-
 
 def can_get_object(
     wallet: WalletInfo,
@@ -47,7 +43,7 @@ def can_get_object(
                 cluster=cluster,
             )
         except OPERATION_ERROR_TYPE as err:
-            assert string_utils.is_str_match_pattern(err, OBJECT_NO_ACCESS), f"Expected {err} to match {OBJECT_NO_ACCESS}"
+            assert string_utils.is_str_match_pattern(err, OBJECT_ACCESS_DENIED), f"Expected {err} to match {OBJECT_ACCESS_DENIED}"
             return False
         assert get_file_hash(file_name) == get_file_hash(got_file_path)
     return True
@@ -102,7 +98,7 @@ def can_delete_object(
                 endpoint=endpoint,
             )
         except OPERATION_ERROR_TYPE as err:
-            assert string_utils.is_str_match_pattern(err, OBJECT_NO_ACCESS), f"Expected {err} to match {OBJECT_NO_ACCESS}"
+            assert string_utils.is_str_match_pattern(err, OBJECT_ACCESS_DENIED), f"Expected {err} to match {OBJECT_ACCESS_DENIED}"
             return False
     return True
 
@@ -130,7 +126,7 @@ def can_get_head_object(
                 timeout=timeout,
             )
         except OPERATION_ERROR_TYPE as err:
-            assert string_utils.is_str_match_pattern(err, OBJECT_NO_ACCESS), f"Expected {err} to match {OBJECT_NO_ACCESS}"
+            assert string_utils.is_str_match_pattern(err, OBJECT_ACCESS_DENIED), f"Expected {err} to match {OBJECT_ACCESS_DENIED}"
             return False
     return True
 
@@ -159,7 +155,7 @@ def can_get_range_of_object(
                 timeout=timeout,
             )
         except OPERATION_ERROR_TYPE as err:
-            assert string_utils.is_str_match_pattern(err, OBJECT_NO_ACCESS), f"Expected {err} to match {OBJECT_NO_ACCESS}"
+            assert string_utils.is_str_match_pattern(err, OBJECT_ACCESS_DENIED), f"Expected {err} to match {OBJECT_ACCESS_DENIED}"
             return False
     return True
 
@@ -188,7 +184,7 @@ def can_get_range_hash_of_object(
                 timeout=timeout,
             )
         except OPERATION_ERROR_TYPE as err:
-            assert string_utils.is_str_match_pattern(err, OBJECT_NO_ACCESS), f"Expected {err} to match {OBJECT_NO_ACCESS}"
+            assert string_utils.is_str_match_pattern(err, OBJECT_ACCESS_DENIED), f"Expected {err} to match {OBJECT_ACCESS_DENIED}"
             return False
     return True
 
@@ -215,7 +211,7 @@ def can_search_object(
                 timeout=timeout,
             )
         except OPERATION_ERROR_TYPE as err:
-            assert string_utils.is_str_match_pattern(err, OBJECT_NO_ACCESS), f"Expected {err} to match {OBJECT_NO_ACCESS}"
+            assert string_utils.is_str_match_pattern(err, OBJECT_ACCESS_DENIED), f"Expected {err} to match {OBJECT_ACCESS_DENIED}"
             return False
         if oid:
             return oid in oids

pytest_tests/helpers/policy_validation.py

@@ -0,0 +1,26 @@
+from frostfs_testlib.shell.interfaces import Shell
+from frostfs_testlib.steps.cli.container import get_container
+from frostfs_testlib.storage.dataclasses.storage_object_info import NodeNetmapInfo
+
+from ..helpers.utility import placement_policy_from_container
+
+
+def validate_object_policy(wallet: str, shell: Shell, placement_rule: str, cid: str, endpoint: str):
+    got_policy = placement_policy_from_container(get_container(wallet, cid, shell, endpoint, False))
+    assert got_policy.replace("'", "") == placement_rule.replace(
+        "'", ""
+    ), f"Expected \n{placement_rule} and got policy \n{got_policy} are the same"
+
+
+def get_netmap_param(netmap_info: list[NodeNetmapInfo]) -> dict:
+    dict_external = dict()
+    for node in netmap_info:
+        dict_external[node.node] = {
+            "country": node.country,
+            "country_code": node.country_code,
+            "Price": node.price,
+            "continent": node.continent,
+            "un_locode": node.un_locode,
+            "location": node.location,
+        }
+    return dict_external

pytest_tests/helpers/utility.py

@@ -35,3 +35,16 @@ def wait_for_gc_pass_on_storage_nodes() -> None:
     wait_time = datetime_utils.parse_time(STORAGE_GC_TIME)
     with reporter.step(f"Wait {wait_time}s until GC completes on storage nodes"):
         time.sleep(wait_time)
+
+
+def are_numbers_similar(num1, num2, tolerance_percentage: float = 1.0):
+    """
+    if difference of numbers is less than permissible deviation than numbers are similar
+    """
+    # Calculate the permissible deviation
+    average = (num1 + num2) / 2
+    tolerance = average * (tolerance_percentage / 100)
+
+    # Calculate the real difference
+    difference = abs(num1 - num2)
+    return difference <= tolerance

pytest_tests/resources/common.py

@@ -1,5 +1,8 @@
 import os
 
+from .. import TESTS_BASE_PATH
+
 TEST_CYCLES_COUNT = int(os.getenv("TEST_CYCLES_COUNT", "1"))
 
 DEVENV_PATH = os.getenv("DEVENV_PATH", os.path.join("..", "frostfs-dev-env"))
+S3_POLICY_FILE_LOCATION = os.path.join(TESTS_BASE_PATH, "resources/files/policy.json")

pytest_tests/testsuites/access/acl/test_acl.py

@@ -1,106 +0,0 @@
-import allure
-import pytest
-from frostfs_testlib import reporter
-from frostfs_testlib.resources.wellknown_acl import PRIVATE_ACL_F, PUBLIC_ACL_F, READONLY_ACL_F
-from frostfs_testlib.shell import Shell
-from frostfs_testlib.steps.cli.object import put_object_to_random_node
-from frostfs_testlib.storage.cluster import Cluster
-from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
-from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
-
-from pytest_tests.helpers.container_access import assert_full_access_to_container, assert_no_access_to_container, assert_read_only_container
-
-from ....helpers.container_spec import ContainerSpec
-
-
-@pytest.mark.sanity
-@pytest.mark.smoke
-@pytest.mark.acl
-class TestACLBasic(ClusterTestBase):
-    @allure.title("Operations in public container available to everyone (obj_size={object_size})")
-    @pytest.mark.container(ContainerSpec(basic_acl=PUBLIC_ACL_F))
-    def test_basic_acl_public(
-        self,
-        default_wallet: WalletInfo,
-        other_wallet: WalletInfo,
-        client_shell: Shell,
-        container: str,
-        file_path: str,
-        cluster: Cluster,
-    ):
-        """
-        Test access to object operations in public container.
-        """
-
-        for wallet, role in ((default_wallet, "owner"), (other_wallet, "others")):
-            with reporter.step("Put objects to container"):
-                # We create new objects for each wallet because assert_full_access_to_container
-                # deletes the object
-                owner_object_oid = put_object_to_random_node(
-                    default_wallet,
-                    file_path,
-                    container,
-                    shell=self.shell,
-                    cluster=self.cluster,
-                    attributes={"created": "owner"},
-                )
-                other_object_oid = put_object_to_random_node(
-                    other_wallet,
-                    file_path,
-                    container,
-                    shell=self.shell,
-                    cluster=self.cluster,
-                    attributes={"created": "other"},
-                )
-
-            with reporter.step(f"Check {role} has full access to public container"):
-                assert_full_access_to_container(wallet, container, owner_object_oid, file_path, client_shell, cluster)
-                assert_full_access_to_container(wallet, container, other_object_oid, file_path, client_shell, cluster)
-
-    @allure.title("Operations in private container only available to owner (obj_size={object_size})")
-    @pytest.mark.container(ContainerSpec(basic_acl=PRIVATE_ACL_F))
-    def test_basic_acl_private(
-        self,
-        default_wallet: WalletInfo,
-        other_wallet: WalletInfo,
-        client_shell: Shell,
-        container: str,
-        file_path: str,
-        cluster: Cluster,
-    ):
-        """
-        Test access to object operations in private container.
-        """
-
-        with reporter.step("Put object to container"):
-            owner_object_oid = put_object_to_random_node(default_wallet, file_path, container, client_shell, cluster)
-
-        with reporter.step("Check no one except owner has access to operations with container"):
-            assert_no_access_to_container(other_wallet, container, owner_object_oid, file_path, client_shell, cluster)
-
-        with reporter.step("Check owner has full access to private container"):
-            assert_full_access_to_container(default_wallet, container, owner_object_oid, file_path, self.shell, cluster)
-
-    @allure.title("Read operations in readonly container available to others (obj_size={object_size})")
-    @pytest.mark.container(ContainerSpec(basic_acl=READONLY_ACL_F))
-    def test_basic_acl_readonly(
-        self,
-        default_wallet: WalletInfo,
-        other_wallet: WalletInfo,
-        client_shell: Shell,
-        container: str,
-        file_path: str,
-        cluster: Cluster,
-    ):
-        """
-        Test access to object operations in readonly container.
-        """
-
-        with reporter.step("Put object to container"):
-            object_oid = put_object_to_random_node(default_wallet, file_path, container, client_shell, cluster)
-
-        with reporter.step("Check others has read-only access to operations with container"):
-            assert_read_only_container(other_wallet, container, object_oid, file_path, client_shell, cluster)
-
-        with reporter.step("Check owner has full access to public container"):
-            assert_full_access_to_container(default_wallet, container, object_oid, file_path, client_shell, cluster)

pytest_tests/testsuites/access/ape/test_ape.py

@@ -2,24 +2,24 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
+from frostfs_testlib.resources.error_patterns import OBJECT_ACCESS_DENIED
 from frostfs_testlib.steps.cli.object import put_object_to_random_node
 from frostfs_testlib.steps.node_management import drop_object
 from frostfs_testlib.storage.dataclasses import ape
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
+from frostfs_testlib.storage.grpc_operations.interfaces import GrpcClientWrapper
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils import wallet_utils
 from frostfs_testlib.utils.failover_utils import wait_object_replication
 from frostfs_testlib.utils.file_utils import TestFile
 
-from pytest_tests.helpers.container_access import (
+from ....helpers.container_access import (
     ALL_OBJECT_OPERATIONS,
     assert_access_to_container,
     assert_full_access_to_container,
     assert_no_access_to_container,
 )
-
-from ....helpers.container_spec import ContainerSpec
+from ....helpers.container_request import APE_EVERYONE_ALLOW_ALL, OWNER_ALLOW_ALL, ContainerRequest
 
 
 @pytest.fixture
@@ -32,11 +32,15 @@ def allowed_wallet(default_wallet: WalletInfo, other_wallet: WalletInfo, role: a
     return default_wallet if role == ape.Role.OTHERS else other_wallet
 
 
+@pytest.mark.nightly
 @pytest.mark.ape
 class TestApeContainer(ClusterTestBase):
+    # TODO: Without PATCH operation,
+    # since it requires specific permissions that do not apply when testing all operations at once
     @pytest.mark.sanity
     @allure.title("Deny operations via APE by role (role={role}, obj_size={object_size})")
     @pytest.mark.parametrize("role", [ape.Role.OWNER, ape.Role.OTHERS], indirect=True)
+    @pytest.mark.parametrize("objects", [4], indirect=True)
     def test_deny_operations_via_ape_by_role(
         self,
         denied_wallet: WalletInfo,
@@ -45,7 +49,7 @@ class TestApeContainer(ClusterTestBase):
         container: str,
         objects: list[str],
         role: ape.Role,
-        file_path: TestFile,
+        test_file: TestFile,
         rpc_endpoint: str,
     ):
         with reporter.step(f"Deny all operations for {role} via APE"):
@@ -59,10 +63,10 @@ class TestApeContainer(ClusterTestBase):
 
         with reporter.step(f"Assert denied role have no access to public container"):
             # access checks will try to remove object, so we use .pop() to ensure we have object before deletion
-            assert_no_access_to_container(denied_wallet, container, objects.pop(), file_path, self.shell, self.cluster)
+            assert_no_access_to_container(denied_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         with reporter.step(f"Assert allowed role have full access to public container"):
-            assert_full_access_to_container(allowed_wallet, container, objects.pop(), file_path, self.shell, self.cluster)
+            assert_full_access_to_container(allowed_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         with reporter.step(f"Remove deny rule from APE"):
             frostfs_cli.ape_manager.remove(rpc_endpoint, deny_rule.chain_id, target_name=container, target_type="container")
@@ -71,12 +75,15 @@ class TestApeContainer(ClusterTestBase):
             self.wait_for_blocks()
 
         with reporter.step("Assert allowed role have full access to public container"):
-            assert_full_access_to_container(allowed_wallet, container, objects.pop(), file_path, self.shell, self.cluster)
+            assert_full_access_to_container(allowed_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         with reporter.step("Assert denied role have full access to public container"):
-            assert_full_access_to_container(denied_wallet, container, objects.pop(), file_path, self.shell, self.cluster)
+            assert_full_access_to_container(denied_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
+    # TODO: Without PATCH operation,
+    # since it requires specific permissions that do not apply when testing all operations at once
     @allure.title("Deny operations for others via APE excluding single pubkey (obj_size={object_size})")
+    @pytest.mark.parametrize("objects", [2], indirect=True)
     def test_deny_opeartions_excluding_pubkey(
         self,
         frostfs_cli: FrostfsCli,
@@ -86,7 +93,7 @@ class TestApeContainer(ClusterTestBase):
         container: str,
         objects: list[str],
         rpc_endpoint: str,
-        file_path: TestFile,
+        test_file: TestFile,
     ):
         with reporter.step("Add deny APE rules for others except single wallet"):
             rule_conditions = [
@@ -104,26 +111,30 @@ class TestApeContainer(ClusterTestBase):
 
         with reporter.step("Assert others have no access to public container"):
             # access checks will try to remove object, so we use .pop() to ensure we have object before deletion
-            assert_no_access_to_container(other_wallet, container, objects[0], file_path, self.shell, self.cluster)
+            assert_no_access_to_container(other_wallet, container, objects[0], test_file, self.shell, self.cluster)
 
         with reporter.step("Assert owner have full access to public container"):
-            assert_full_access_to_container(default_wallet, container, objects.pop(), file_path, self.shell, self.cluster)
+            assert_full_access_to_container(default_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         with reporter.step("Assert allowed wallet have full access to public container"):
-            assert_full_access_to_container(other_wallet_2, container, objects.pop(), file_path, self.shell, self.cluster)
+            assert_full_access_to_container(other_wallet_2, container, objects.pop(), test_file, self.shell, self.cluster)
 
     @allure.title("Replication works with APE deny rules on OWNER and OTHERS (obj_size={object_size})")
-    @pytest.mark.container(ContainerSpec(f"REP %NODE_COUNT% IN X CBF 1 SELECT %NODE_COUNT% FROM * AS X", PUBLIC_ACL))
+    @pytest.mark.parametrize(
+        "container_request",
+        [ContainerRequest(f"REP %NODE_COUNT% IN X CBF 1 SELECT %NODE_COUNT% FROM * AS X", APE_EVERYONE_ALLOW_ALL, "custom")],
+        indirect=True,
+    )
     def test_replication_works_with_deny_rules(
         self,
         default_wallet: WalletInfo,
         frostfs_cli: FrostfsCli,
         container: str,
         rpc_endpoint: str,
-        file_path: TestFile,
+        test_file: TestFile,
     ):
         with reporter.step("Put object to container"):
-            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+            oid = put_object_to_random_node(default_wallet, test_file, container, self.shell, self.cluster)
 
         with reporter.step("Wait for object replication after upload"):
             wait_object_replication(container, oid, len(self.cluster.cluster_nodes), self.shell, self.cluster.storage_nodes)
@@ -148,22 +159,27 @@ class TestApeContainer(ClusterTestBase):
         with reporter.step("Wait for dropped object to be replicated"):
             wait_object_replication(container, oid, len(self.cluster.storage_nodes), self.shell, self.cluster.storage_nodes)
 
+    # TODO: Without PATCH operation,
+    # since it requires specific permissions that do not apply when testing all operations at once
     @allure.title("Deny operations via APE by role (role=ir, obj_size={object_size})")
+    @pytest.mark.parametrize("container_request", [OWNER_ALLOW_ALL], indirect=True)
+    @pytest.mark.parametrize("objects", [3], indirect=True)
     def test_deny_operations_via_ape_by_role_ir(
-        self, frostfs_cli: FrostfsCli, ir_wallet: WalletInfo, container: str, objects: list[str], rpc_endpoint: str, file_path: TestFile
+        self, frostfs_cli: FrostfsCli, ir_wallet: WalletInfo, container: str, objects: list[str], rpc_endpoint: str, test_file: TestFile
     ):
         default_ir_access = {
             ape.ObjectOperations.PUT: False,
             ape.ObjectOperations.GET: True,
             ape.ObjectOperations.HEAD: True,
-            ape.ObjectOperations.GET_RANGE: False,
+            ape.ObjectOperations.GET_RANGE: True,
             ape.ObjectOperations.GET_RANGE_HASH: True,
             ape.ObjectOperations.SEARCH: True,
+            ape.ObjectOperations.PATCH: False,
             ape.ObjectOperations.DELETE: False,
         }
 
         with reporter.step("Assert IR wallet access in default state"):
-            assert_access_to_container(default_ir_access, ir_wallet, container, objects[0], file_path, self.shell, self.cluster)
+            assert_access_to_container(default_ir_access, ir_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         with reporter.step("Add deny APE rule with deny all operations for IR role"):
             rule = ape.Rule(ape.Verb.DENY, ALL_OBJECT_OPERATIONS, [ape.Condition.by_role(ape.Role.IR.value)])
@@ -173,7 +189,7 @@ class TestApeContainer(ClusterTestBase):
             self.wait_for_blocks()
 
         with reporter.step("Assert IR wallet ignores APE rules"):
-            assert_access_to_container(default_ir_access, ir_wallet, container, objects[0], file_path, self.shell, self.cluster)
+            assert_access_to_container(default_ir_access, ir_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         with reporter.step("Remove APE rule"):
             frostfs_cli.ape_manager.remove(rpc_endpoint, rule.chain_id, target_name=container, target_type="container")
@@ -182,9 +198,13 @@ class TestApeContainer(ClusterTestBase):
             self.wait_for_blocks()
 
         with reporter.step("Assert IR wallet access is restored"):
-            assert_access_to_container(default_ir_access, ir_wallet, container, objects[0], file_path, self.shell, self.cluster)
+            assert_access_to_container(default_ir_access, ir_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
+    # TODO: Without PATCH operation,
+    # since it requires specific permissions that do not apply when testing all operations at once
     @allure.title("Deny operations via APE by role (role=container, obj_size={object_size})")
+    @pytest.mark.parametrize("container_request", [OWNER_ALLOW_ALL], indirect=True)
+    @pytest.mark.parametrize("objects", [3], indirect=True)
     def test_deny_operations_via_ape_by_role_container(
         self,
         frostfs_cli: FrostfsCli,
@@ -192,20 +212,21 @@ class TestApeContainer(ClusterTestBase):
         container: str,
         objects: list[str],
         rpc_endpoint: str,
-        file_path: TestFile,
+        test_file: TestFile,
     ):
         access_matrix = {
             ape.ObjectOperations.PUT: True,
             ape.ObjectOperations.GET: True,
             ape.ObjectOperations.HEAD: True,
-            ape.ObjectOperations.GET_RANGE: False,
+            ape.ObjectOperations.GET_RANGE: True,
             ape.ObjectOperations.GET_RANGE_HASH: True,
             ape.ObjectOperations.SEARCH: True,
-            ape.ObjectOperations.DELETE: False,
+            ape.ObjectOperations.PATCH: True,
+            ape.ObjectOperations.DELETE: True,
         }
 
         with reporter.step("Assert CONTAINER wallet access in default state"):
-            assert_access_to_container(access_matrix, container_node_wallet, container, objects[0], file_path, self.shell, self.cluster)
+            assert_access_to_container(access_matrix, container_node_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         rule = ape.Rule(ape.Verb.DENY, ALL_OBJECT_OPERATIONS, ape.Condition.by_role(ape.Role.CONTAINER.value))
 
@@ -216,7 +237,7 @@ class TestApeContainer(ClusterTestBase):
             self.wait_for_blocks()
 
         with reporter.step("Assert CONTAINER wallet ignores APE rule"):
-            assert_access_to_container(access_matrix, container_node_wallet, container, objects[0], file_path, self.shell, self.cluster)
+            assert_access_to_container(access_matrix, container_node_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         with reporter.step("Remove APE rule"):
             frostfs_cli.ape_manager.remove(rpc_endpoint, rule.chain_id, target_name=container, target_type="container")
@@ -225,4 +246,152 @@ class TestApeContainer(ClusterTestBase):
             self.wait_for_blocks()
 
         with reporter.step("Assert CONTAINER wallet access after rule was removed"):
-            assert_access_to_container(access_matrix, container_node_wallet, container, objects[0], file_path, self.shell, self.cluster)
+            assert_access_to_container(access_matrix, container_node_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
+
+    # ^
+    @allure.title("Deny PATCH operation via APE (object_size={object_size})")
+    @pytest.mark.parametrize("objects", [1], indirect=True)
+    def test_patch_object_with_deny_rule(
+        self,
+        frostfs_cli: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        grpc_client_with_other_wallet: GrpcClientWrapper,
+        grpc_client_with_container_wallet: GrpcClientWrapper,
+        grpc_client_with_ir_wallet: GrpcClientWrapper,
+        container: str,
+        objects: list[str],
+        test_file: TestFile,
+    ):
+        patch_params = {
+            "cid": container,
+            "oid": objects[0],
+            "endpoint": self.cluster.default_rpc_endpoint,
+            "ranges": ["300:200"],
+            "payloads": [test_file],
+            "new_attrs": "owner=true",
+            "timeout": "200s",
+        }
+
+        with reporter.step("Check that PATCH is available with owner wallet"):
+            patched_oid = grpc_client.object.patch(**patch_params)
+            assert patched_oid != patch_params["oid"], "OID of patched object must be different from original one"
+            patch_params["oid"] = patched_oid
+
+        with reporter.step("Check that PATCH is available with another wallet"):
+            patch_params["ranges"] = ["100:50"]
+            patch_params["new_attrs"] = "other=true"
+
+            patched_oid = grpc_client_with_other_wallet.object.patch(**patch_params)
+            assert patched_oid != patch_params["oid"], "OID of patched object must be different from original one"
+            patch_params["oid"] = patched_oid
+
+        with reporter.step("Check that PATCH is available with container wallet"):
+            patch_params["ranges"] = ["600:0"]
+            patch_params["new_attrs"] = "container=true"
+
+            patched_oid = grpc_client_with_container_wallet.object.patch(**patch_params)
+            assert patched_oid != patch_params["oid"], "OID of patched object must be different from original one"
+            patch_params["oid"] = patched_oid
+
+        with reporter.step("Check that PATCH is available with ir wallet"):
+            patch_params["ranges"] = ["0:1000"]
+            patch_params["new_attrs"] = "ir=true"
+
+            patched_oid = grpc_client_with_ir_wallet.object.patch(**patch_params)
+            assert patched_oid != patch_params["oid"], "OID of patched object must be different from original one"
+            patch_params["oid"] = patched_oid
+
+        rule = ape.Rule(ape.Verb.DENY, ape.ObjectOperations.PATCH)
+        with reporter.step("Add APE rule with deny PATCH operation"):
+            frostfs_cli.ape_manager.add(
+                self.cluster.default_rpc_endpoint,
+                rule.chain_id,
+                target_name=container,
+                target_type="container",
+                rule=rule.as_string(),
+            )
+
+        with reporter.step("Wait for one block"):
+            self.wait_for_blocks(1)
+
+        with reporter.step("Check that PATCH is not allowed with owner wallet"):
+            patch_params["ranges"] = ["300:200"]
+            patch_params["new_attrs"] = "owner_2=false"
+
+            with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
+                grpc_client.object.patch(**patch_params)
+
+        with reporter.step("Check that PATCH is not allowed with another wallet"):
+            patch_params["ranges"] = ["100:50"]
+            patch_params["new_attrs"] = "other_2=false"
+
+            with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
+                grpc_client_with_other_wallet.object.patch(**patch_params)
+
+        with reporter.step("Check that PATCH is allowed with container wallet as rule is ignored"):
+            patch_params["ranges"] = ["600:0"]
+            patch_params["new_attrs"] = "container_2=true"
+
+            patched_oid = grpc_client_with_container_wallet.object.patch(**patch_params)
+            assert patched_oid != patch_params["oid"], "OID of patched object must be different from original one"
+            patch_params["oid"] = patched_oid
+
+        with reporter.step("Check that PATCH is not allowed with ir waller"):
+            patch_params["ranges"] = ["0:1000"]
+            patch_params["new_attrs"] = "ir_2=true"
+
+            with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
+                grpc_client_with_ir_wallet.object.patch(**patch_params)
+
+        with reporter.step("Remove APE rule"):
+            frostfs_cli.ape_manager.remove(
+                self.cluster.default_rpc_endpoint,
+                rule.chain_id,
+                target_name=container,
+                target_type="container",
+            )
+
+        with reporter.step("Wait for one block"):
+            self.wait_for_blocks(1)
+
+        with reporter.step("Check that PATCH is available with owner wallet"):
+            patch_params["ranges"] = ["300:200"]
+            patch_params["new_attrs"] = "owner_3=true"
+
+            patched_oid = grpc_client.object.patch(**patch_params)
+            assert patched_oid != patch_params["oid"], "OID of patched object must be different from original one"
+            patch_params["oid"] = patched_oid
+
+        with reporter.step("Check that PATCH is available with another wallet"):
+            patch_params["ranges"] = ["100:50"]
+            patch_params["new_attrs"] = "other_3=true"
+
+            patched_oid = grpc_client_with_other_wallet.object.patch(**patch_params)
+            assert patched_oid != patch_params["oid"], "OID of patched object must be different from original one"
+            patch_params["oid"] = patched_oid
+
+        with reporter.step("Check that PATCH is available with container wallet"):
+            patch_params["ranges"] = ["600:0"]
+            patch_params["new_attrs"] = "container_3=true"
+
+            patched_oid = grpc_client_with_container_wallet.object.patch(**patch_params)
+            assert patched_oid != patch_params["oid"], "OID of patched object must be different from original one"
+            patch_params["oid"] = patched_oid
+
+        with reporter.step("Check that PATCH is available with ir wallet"):
+            patch_params["ranges"] = ["0:1000"]
+            patch_params["new_attrs"] = "ir_3=true"
+
+            patched_oid = grpc_client_with_ir_wallet.object.patch(**patch_params)
+            assert patched_oid != patch_params["oid"], "OID of patched object must be different from original one"
+            patch_params["oid"] = patched_oid
+
+        attrs = {"owner", "other", "container", "ir", "container_2", "owner_3", "other_3", "container_3", "ir_3"}
+
+        with reporter.step("Ensure that all attributes match expected values"):
+            object_info: dict = grpc_client.object.head(container, patch_params["oid"], self.cluster.default_rpc_endpoint)
+            object_attrs: dict = object_info["header"]["attributes"]
+            assert attrs <= {k for k in object_attrs.keys()}, f"Received attributes do not match expected ones: {object_attrs}"
+            assert all(
+                v == "true" for k, v in object_attrs.items() if k in attrs
+            ), f"Received attributes do not match expected ones: {object_attrs}"

pytest_tests/testsuites/access/ape/test_ape_filters.py

@@ -10,19 +10,19 @@ from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.test_control import expect_not_raises
 from frostfs_testlib.utils.file_utils import TestFile
 
-from pytest_tests.helpers.bearer_token import create_bearer_token
-from pytest_tests.helpers.container_access import (
+from ....helpers.bearer_token import create_bearer_token
+from ....helpers.container_access import (
     ALL_OBJECT_OPERATIONS,
     FULL_ACCESS,
     assert_access_to_container,
     assert_full_access_to_container,
     assert_no_access_to_container,
 )
-from pytest_tests.helpers.object_access import OBJECT_NO_ACCESS
-
-from ....helpers.container_spec import ContainerSpec
+from ....helpers.container_request import OWNER_ALLOW_ALL
+from ....helpers.object_access import OBJECT_ACCESS_DENIED
 
 
+@pytest.mark.nightly
 @pytest.mark.ape
 class TestApeFilters(ClusterTestBase):
     #  SPEC: https://github.com/nspcc-dev/neofs-spec/blob/master/01-arch/07-acl.md
@@ -216,10 +216,10 @@ class TestApeFilters(ClusterTestBase):
                 )
 
             with reporter.step("Check others have no access to objects with deny attribute"):
-                with pytest.raises(Exception, match=OBJECT_NO_ACCESS):
+                with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
                     head_object(other_wallet, container, deny_objects[0], self.shell, rpc_endpoint, xhdr=xhdr)
 
-                with pytest.raises(Exception, match=OBJECT_NO_ACCESS):
+                with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
                     get_object_from_random_node(other_wallet, container, deny_objects[0], self.shell, self.cluster, xhdr=xhdr)
 
             with reporter.step("Check others have access to objects with deny attribute and using bearer token"):
@@ -241,8 +241,7 @@ class TestApeFilters(ClusterTestBase):
 
     @allure.title("Operations with allow APE rule with resource filters (match_type={match_type}, obj_size={object_size})")
     @pytest.mark.parametrize("match_type", [ape.MatchType.EQUAL, ape.MatchType.NOT_EQUAL])
-    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
-    @pytest.mark.container(ContainerSpec(basic_acl="0", allow_owner_via_ape=True))
+    @pytest.mark.parametrize("object_size, container_request", [("simple", OWNER_ALLOW_ALL)], indirect=True)
     def test_ape_allow_filters_object(
         self,
         frostfs_cli: FrostfsCli,
@@ -261,7 +260,7 @@ class TestApeFilters(ClusterTestBase):
             deny_objects = objects_with_other_attributes
             allow_attribute = self.HEADER
             deny_attribute = self.OTHER_HEADER
-            no_attributes_match_context = pytest.raises(Exception, match=OBJECT_NO_ACCESS)
+            no_attributes_match_context = pytest.raises(Exception, match=OBJECT_ACCESS_DENIED)
         else:
             allow_objects = objects_with_other_attributes
             deny_objects = objects_with_attributes
@@ -321,13 +320,13 @@ class TestApeFilters(ClusterTestBase):
 
         with reporter.step("Check others cannot get and put objects without attributes matching the filter"):
             oid = deny_objects[0]
-            with pytest.raises(Exception, match=OBJECT_NO_ACCESS):
+            with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
                 head_object(other_wallet, container, oid, self.shell, rpc_endpoint)
 
-            with pytest.raises(Exception, match=OBJECT_NO_ACCESS):
+            with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
                 assert get_object_from_random_node(other_wallet, container, oid, self.shell, self.cluster)
 
-            with pytest.raises(Exception, match=OBJECT_NO_ACCESS):
+            with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
                 assert put_object_to_random_node(other_wallet, file_path, container, self.shell, self.cluster, attributes=deny_attribute)
 
         with reporter.step("Check others can get and put objects without attributes matching the filter with bearer token"):
@@ -342,7 +341,7 @@ class TestApeFilters(ClusterTestBase):
                 put_object_to_random_node(other_wallet, file_path, container, self.shell, self.cluster, bearer, attributes=allow_attribute)
 
     @allure.title("PUT and GET object using bearer with objectID in filter (obj_size={object_size}, match_type=NOT_EQUAL)")
-    @pytest.mark.container(ContainerSpec(basic_acl="0", allow_owner_via_ape=True))
+    @pytest.mark.parametrize("container_request", [OWNER_ALLOW_ALL], indirect=True)
     def test_ape_filter_object_id_not_equals(
         self,
         frostfs_cli: FrostfsCli,
@@ -366,11 +365,11 @@ class TestApeFilters(ClusterTestBase):
                 put_object_to_random_node(other_wallet, file_path, container, self.shell, self.cluster, bearer)
 
         with reporter.step("Others should not be able to get object matching the filter"):
-            with pytest.raises(Exception, match=OBJECT_NO_ACCESS):
+            with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
                 get_object_from_random_node(other_wallet, container, oid, self.shell, self.cluster, bearer)
 
     @allure.title("PUT and GET object using bearer with objectID in filter (obj_size={object_size}, match_type=EQUAL)")
-    @pytest.mark.container(ContainerSpec(basic_acl="0", allow_owner_via_ape=True))
+    @pytest.mark.parametrize("container_request", [OWNER_ALLOW_ALL], indirect=True)
     def test_ape_filter_object_id_equals(
         self,
         frostfs_cli: FrostfsCli,
@@ -390,7 +389,7 @@ class TestApeFilters(ClusterTestBase):
             bearer = create_bearer_token(frostfs_cli, temp_directory, container, rule, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Others should not be able to put object using bearer token"):
-            with pytest.raises(Exception, match=OBJECT_NO_ACCESS):
+            with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
                 put_object_to_random_node(other_wallet, file_path, container, self.shell, self.cluster, bearer)
 
         with reporter.step("Others should be able to get object matching the filter"):

pytest_tests/testsuites/access/ape/test_bearer.py

@@ -2,13 +2,15 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
+from frostfs_testlib.resources.error_patterns import OBJECT_ACCESS_DENIED
 from frostfs_testlib.storage.dataclasses import ape
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
+from frostfs_testlib.storage.grpc_operations.interfaces import GrpcClientWrapper
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils.file_utils import TestFile
 
-from pytest_tests.helpers.bearer_token import create_bearer_token
-from pytest_tests.helpers.container_access import (
+from ....helpers.bearer_token import create_bearer_token
+from ....helpers.container_access import (
     ALL_OBJECT_OPERATIONS,
     assert_access_to_container,
     assert_full_access_to_container,
@@ -16,12 +18,17 @@ from pytest_tests.helpers.container_access import (
 )
 
 
+@pytest.mark.nightly
 @pytest.mark.sanity
 @pytest.mark.bearer
 @pytest.mark.ape
+@pytest.mark.parametrize("user_tag", ["ApeBearer"], indirect=True)  # provide dedicated user with no APE side-policies
 class TestApeBearer(ClusterTestBase):
+    # TODO: Without PATCH operation,
+    # since it requires specific permissions that do not apply when testing all operations at once
     @allure.title("Operations with BearerToken (role={role}, obj_size={object_size})")
     @pytest.mark.parametrize("role", [ape.Role.OWNER, ape.Role.OTHERS], indirect=True)
+    @pytest.mark.parametrize("objects", [4], indirect=True)
     def test_bearer_token_operations(
         self,
         container: str,
@@ -30,11 +37,11 @@ class TestApeBearer(ClusterTestBase):
         temp_directory: str,
         test_wallet: WalletInfo,
         role: ape.Role,
-        file_path: TestFile,
+        test_file: TestFile,
         rpc_endpoint: str,
     ):
         with reporter.step(f"Check {role} has full access to container without bearer token"):
-            assert_full_access_to_container(test_wallet, container, objects.pop(), file_path, self.shell, self.cluster)
+            assert_full_access_to_container(test_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         with reporter.step(f"Deny all operations for everyone via APE"):
             rule = ape.Rule(ape.Verb.DENY, ALL_OBJECT_OPERATIONS)
@@ -53,10 +60,10 @@ class TestApeBearer(ClusterTestBase):
             )
 
         with reporter.step(f"Check {role} without token has no access to all operations with container"):
-            assert_no_access_to_container(test_wallet, container, objects.pop(), file_path, self.shell, self.cluster)
+            assert_no_access_to_container(test_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         with reporter.step(f"Check {role} with token has access to all operations with container"):
-            assert_full_access_to_container(test_wallet, container, objects.pop(), file_path, self.shell, self.cluster, bearer)
+            assert_full_access_to_container(test_wallet, container, objects.pop(), test_file, self.shell, self.cluster, bearer)
 
         with reporter.step(f"Remove deny rule from APE"):
             frostfs_cli.ape_manager.remove(rpc_endpoint, rule.chain_id, target_name=container, target_type="container")
@@ -65,19 +72,131 @@ class TestApeBearer(ClusterTestBase):
             self.wait_for_blocks()
 
         with reporter.step(f"Check {role} without token has access to all operations with container"):
-            assert_full_access_to_container(test_wallet, container, objects.pop(), file_path, self.shell, self.cluster)
+            assert_full_access_to_container(test_wallet, container, objects.pop(), test_file, self.shell, self.cluster)
+
+    # ^
+    @allure.title("Patch operation with BearerToken (object_size={object_size})")
+    @pytest.mark.parametrize("objects", [1], indirect=True)
+    def test_patch_object_with_bearer_token(
+        self,
+        frostfs_cli: FrostfsCli,
+        grpc_client_with_other_wallet: GrpcClientWrapper,
+        container: str,
+        objects: list[str],
+        test_file: TestFile,
+        temp_directory: str,
+    ):
+        oid = objects[0]
+
+        with reporter.step("Check if the patch is available with another wallet"):
+            patched_oid = grpc_client_with_other_wallet.object.patch(
+                container,
+                oid,
+                self.cluster.default_rpc_endpoint,
+                ranges=["100:300"],
+                payloads=[test_file],
+                new_attrs="allow-patch=true",
+                timeout="200s",
+            )
+            assert patched_oid != oid, "OID of patched object must be different from original one"
+            oid = patched_oid
+
+        rule = ape.Rule(ape.Verb.DENY, ape.ObjectOperations.PATCH)
+
+        with reporter.step("Deny PATCH operation for everyone via APE"):
+            frostfs_cli.ape_manager.add(
+                self.cluster.default_rpc_endpoint,
+                rule.chain_id,
+                target_name=container,
+                target_type="container",
+                rule=rule.as_string(),
+            )
+
+        with reporter.step("Wait for one block"):
+            self.wait_for_blocks(1)
+
+        with reporter.step("Check that patch is not allowed with another wallet"):
+            with pytest.raises(Exception, match=OBJECT_ACCESS_DENIED):
+                grpc_client_with_other_wallet.object.patch(
+                    container,
+                    oid,
+                    self.cluster.default_rpc_endpoint,
+                    ranges=["100:300"],
+                    payloads=[test_file],
+                    new_attrs="deny-patch=true",
+                    timeout="200s",
+                )
+
+        with reporter.step("Create bearer token with all operations allowed"):
+            bearer = create_bearer_token(
+                frostfs_cli,
+                temp_directory,
+                container,
+                rule=ape.Rule(ape.Verb.ALLOW, ALL_OBJECT_OPERATIONS),
+                endpoint=self.cluster.default_rpc_endpoint,
+            )
+
+        with reporter.step("Check that patch is available with another wallet with BearerToken"):
+            patched_oid = grpc_client_with_other_wallet.object.patch(
+                container,
+                oid,
+                self.cluster.default_rpc_endpoint,
+                bearer=bearer,
+                ranges=["100:300"],
+                payloads=[test_file],
+                new_attrs="bearer-patch=true",
+                timeout="200s",
+            )
+            assert patched_oid != oid, "OID of patched object must be different from original one"
+            oid = patched_oid
+
+        with reporter.step(f"Remove deny rule from APE"):
+            frostfs_cli.ape_manager.remove(
+                self.cluster.default_rpc_endpoint,
+                rule.chain_id,
+                target_name=container,
+                target_type="container",
+            )
+
+        with reporter.step("Wait for one block"):
+            self.wait_for_blocks(1)
+
+        with reporter.step("Check if the patch is available with another wallet"):
+            patched_oid = grpc_client_with_other_wallet.object.patch(
+                container,
+                oid,
+                self.cluster.default_rpc_endpoint,
+                bearer=bearer,
+                ranges=["100:300"],
+                payloads=[test_file],
+                new_attrs="allow-patch-2=true",
+                timeout="200s",
+            )
+            assert patched_oid != oid, "OID of patched object must be different from original one"
+            oid = patched_oid
+
+        attrs = {"allow-patch", "bearer-patch", "allow-patch-2"}
+
+        with reporter.step("Ensure that all attributes match expected values"):
+            object_info: dict = grpc_client_with_other_wallet.object.head(container, oid, self.cluster.default_rpc_endpoint)
+            object_attrs: dict = object_info["header"]["attributes"]
+            assert attrs <= {k for k in object_attrs.keys()}, f"Received attributes do not match expected ones: {object_attrs}"
+            assert all(
+                v == "true" for k, v in object_attrs.items() if k in attrs
+            ), f"Received attributes do not match expected ones: {object_attrs}"
 
     @allure.title("BearerToken for compound operations (obj_size={object_size})")
+    @pytest.mark.parametrize("objects", [4], indirect=True)
     def test_bearer_token_compound_operations(
         self,
         frostfs_cli: FrostfsCli,
         temp_directory: str,
         default_wallet: WalletInfo,
         other_wallet: WalletInfo,
-        container: tuple[str, list[str], str],
+        container: str,
         objects: list[str],
         rpc_endpoint: str,
-        file_path: TestFile,
+        test_file: TestFile,
     ):
         """
         Bearer Token COMPLETLY overrides chains set for the specific target.
@@ -112,25 +231,24 @@ class TestApeBearer(ClusterTestBase):
 
         bt_access_map = {
             ape.Role.OWNER: {
-                ape.ObjectOperations.PUT: True,
-                ape.ObjectOperations.GET: True,
-                ape.ObjectOperations.HEAD: True,
-                ape.ObjectOperations.GET_RANGE: True,
-                ape.ObjectOperations.GET_RANGE_HASH: True,
-                ape.ObjectOperations.SEARCH: True,
-                ape.ObjectOperations.DELETE: True,
-            },
-            ape.Role.OTHERS: {
                 ape.ObjectOperations.PUT: True,
                 ape.ObjectOperations.GET: False,
                 ape.ObjectOperations.HEAD: True,
+                ape.ObjectOperations.GET_RANGE: True,
+                ape.ObjectOperations.GET_RANGE_HASH: False,
+                ape.ObjectOperations.SEARCH: False,
+                ape.ObjectOperations.DELETE: True,
+            },
+            # Bearer Token COMPLETLY overrides chains set for the specific target.
+            # Thus, any restictions or permissions should be explicitly defined in BT.
+            ape.Role.OTHERS: {
+                ape.ObjectOperations.PUT: False,
+                ape.ObjectOperations.GET: False,
+                ape.ObjectOperations.HEAD: False,
                 ape.ObjectOperations.GET_RANGE: False,
                 ape.ObjectOperations.GET_RANGE_HASH: False,
-                # Although SEARCH is denied by the APE chain defined in Policy contract,
-                # Bearer Token COMPLETLY overrides chains set for the specific target.
-                # Thus, any restictions or permissions should be explicitly defined in BT.
-                ape.ObjectOperations.SEARCH: True,
-                ape.ObjectOperations.DELETE: True,
+                ape.ObjectOperations.SEARCH: False,
+                ape.ObjectOperations.DELETE: False,
             },
         }
 
@@ -147,9 +265,11 @@ class TestApeBearer(ClusterTestBase):
         # Operations that we will allow for each role with bearer token
         bearer_map = {
             ape.Role.OWNER: [
-                ape.ObjectOperations.DELETE,
                 ape.ObjectOperations.PUT,
+                ape.ObjectOperations.HEAD,
                 ape.ObjectOperations.GET_RANGE,
+                # Delete also requires PUT (to make tombstone) and HEAD (to get simple objects header)
+                ape.ObjectOperations.DELETE,
             ],
             ape.Role.OTHERS: [
                 ape.ObjectOperations.GET,
@@ -177,7 +297,7 @@ class TestApeBearer(ClusterTestBase):
 
         for role, wallet in wallets_map.items():
             with reporter.step(f"Assert access to container without bearer token for {role}"):
-                assert_access_to_container(access_map[role], wallet, container, objects.pop(), file_path, self.shell, self.cluster)
+                assert_access_to_container(access_map[role], wallet, container, objects.pop(), test_file, self.shell, self.cluster)
 
         bearer_tokens = {}
         for role in wallets_map.keys():
@@ -189,5 +309,5 @@ class TestApeBearer(ClusterTestBase):
         for role, wallet in wallets_map.items():
             with reporter.step(f"Assert access to container with bearer token for {role}"):
                 assert_access_to_container(
-                    bt_access_map[role], wallet, container, objects.pop(), file_path, self.shell, self.cluster, bearer_tokens[role]
+                    bt_access_map[role], wallet, container, objects.pop(), test_file, self.shell, self.cluster, bearer_tokens[role]
                 )

pytest_tests/testsuites/access/conftest.py

@@ -1,24 +1,18 @@
 import json
-import time
 
-import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
-from frostfs_testlib.resources.common import MORPH_BLOCK_TIME
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
+from frostfs_testlib.resources.cli import FROSTFS_CLI_EXEC
 from frostfs_testlib.shell import Shell
-from frostfs_testlib.steps.cli.container import create_container, search_nodes_with_container
+from frostfs_testlib.steps.cli.container import search_nodes_with_container
 from frostfs_testlib.steps.cli.object import put_object_to_random_node
 from frostfs_testlib.storage.cluster import Cluster, ClusterNode
 from frostfs_testlib.storage.dataclasses import ape
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
+from frostfs_testlib.storage.grpc_operations.client_wrappers import CliClientWrapper
+from frostfs_testlib.storage.grpc_operations.interfaces import GrpcClientWrapper
 from frostfs_testlib.testing.parallel import parallel
-from frostfs_testlib.utils import datetime_utils
-
-from ...helpers.container_spec import ContainerSpec
-
-OBJECT_COUNT = 5
 
 
 @pytest.fixture(scope="session")
@@ -48,88 +42,22 @@ def test_wallet(default_wallet: WalletInfo, other_wallet: WalletInfo, role: ape.
     return role_to_wallet_map[role]
 
 
-@pytest.fixture
-def container(
+@pytest.fixture(scope="function", params=[5])
+def objects(
+    container: str,
     default_wallet: WalletInfo,
-    frostfs_cli: FrostfsCli,
     client_shell: Shell,
     cluster: Cluster,
+    test_file: str,
     request: pytest.FixtureRequest,
-    rpc_endpoint: str,
-) -> str:
-    container_spec = _get_container_spec(request)
-    cid = _create_container_by_spec(default_wallet, client_shell, cluster, rpc_endpoint, container_spec)
-    if container_spec.allow_owner_via_ape:
-        _allow_owner_via_ape(frostfs_cli, cluster, cid)
+):
+    object_count = request.param
 
-    return cid
-
-
-def _create_container_by_spec(
-    default_wallet: WalletInfo, client_shell: Shell, cluster: Cluster, rpc_endpoint: str, container_spec: ContainerSpec
-) -> str:
-    # TODO: add container spec to step message
-    with reporter.step("Create container"):
-        cid = create_container(
-            default_wallet, client_shell, rpc_endpoint, basic_acl=container_spec.basic_acl, rule=container_spec.parsed_rule(cluster)
-        )
-
-    with reporter.step("Search nodes holding the container"):
-        container_holder_nodes = search_nodes_with_container(default_wallet, cid, client_shell, cluster.default_rpc_endpoint, cluster)
-        report_data = {node.id: node.host_ip for node in container_holder_nodes}
-
-    reporter.attach(json.dumps(report_data, indent=2), "container_nodes.json")
-
-    return cid
-
-
-def _get_container_spec(request: pytest.FixtureRequest) -> ContainerSpec:
-    container_marker = request.node.get_closest_marker("container")
-    # let default container to be public at the moment
-    container_spec = ContainerSpec(basic_acl=PUBLIC_ACL)
-
-    if container_marker:
-        if len(container_marker.args) != 1:
-            raise RuntimeError(f"Something wrong with container marker: {container_marker}")
-        container_spec = container_marker.args[0]
-
-    if "param" in request.__dict__:
-        container_spec = request.param
-
-    if not container_spec:
-        raise RuntimeError(
-            f"""Container specification is empty. 
-                            Either add @pytest.mark.container(ContainerSpec(...)) or 
-                            @pytest.mark.parametrize(\"container\", [ContainerSpec(...)], indirect=True) decorator"""
-        )
-
-    return container_spec
-
-
-def _allow_owner_via_ape(frostfs_cli: FrostfsCli, cluster: Cluster, container: str):
-    with reporter.step("Create allow APE rule for container owner"):
-        role_condition = ape.Condition.by_role(ape.Role.OWNER)
-        deny_rule = ape.Rule(ape.Verb.ALLOW, ape.ObjectOperations.WILDCARD_ALL, role_condition)
-
-        frostfs_cli.ape_manager.add(
-            cluster.default_rpc_endpoint,
-            deny_rule.chain_id,
-            target_name=container,
-            target_type="container",
-            rule=deny_rule.as_string(),
-        )
-
-    with reporter.step("Wait for one block"):
-        time.sleep(datetime_utils.parse_time(MORPH_BLOCK_TIME))
-
-
-@pytest.fixture
-def objects(container: str, default_wallet: WalletInfo, client_shell: Shell, cluster: Cluster, file_path: str):
     with reporter.step("Add test objects to container"):
         put_results = parallel(
-            [put_object_to_random_node] * OBJECT_COUNT,
+            [put_object_to_random_node] * object_count,
             wallet=default_wallet,
-            path=file_path,
+            path=test_file,
             cid=container,
             shell=client_shell,
             cluster=cluster,
@@ -153,3 +81,18 @@ def container_nodes(default_wallet: WalletInfo, container: str, client_shell: Sh
 @pytest.fixture
 def container_node_wallet(container_nodes: list[ClusterNode]) -> WalletInfo:
     return WalletInfo.from_node(container_nodes[0].storage_node)
+
+
+@pytest.fixture
+def grpc_client_with_container_wallet(client_shell: Shell, container_node_wallet: WalletInfo) -> GrpcClientWrapper:
+    return CliClientWrapper(FrostfsCli(client_shell, FROSTFS_CLI_EXEC, container_node_wallet.config_path))
+
+
+@pytest.fixture(scope="session")
+def grpc_client_with_other_wallet(client_shell: Shell, other_wallet: WalletInfo) -> GrpcClientWrapper:
+    return CliClientWrapper(FrostfsCli(client_shell, FROSTFS_CLI_EXEC, other_wallet.config_path))
+
+
+@pytest.fixture(scope="session")
+def grpc_client_with_ir_wallet(client_shell: Shell, ir_wallet: WalletInfo) -> GrpcClientWrapper:
+    return CliClientWrapper(FrostfsCli(client_shell, FROSTFS_CLI_EXEC, ir_wallet.config_path))

pytest_tests/testsuites/ape/conftest.py

@@ -0,0 +1,52 @@
+import pytest
+from frostfs_testlib import reporter
+from frostfs_testlib.cli import FrostfsCli
+from frostfs_testlib.resources.cli import FROSTFS_CLI_EXEC
+from frostfs_testlib.shell.interfaces import Shell
+from frostfs_testlib.steps.cli.object import put_object
+from frostfs_testlib.storage.cluster import Cluster
+from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
+from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
+from frostfs_testlib.utils.file_utils import generate_file
+
+
+@pytest.fixture(scope="session")
+def frostfs_cli_on_first_node(cluster: Cluster) -> FrostfsCli:
+    node = cluster.cluster_nodes[0]
+    shell = node.host.get_shell()
+
+    return FrostfsCli(shell, FROSTFS_CLI_EXEC, node.storage_node.get_remote_wallet_config_path())
+
+
+@pytest.fixture
+def object_id(
+    default_wallet: WalletInfo,
+    frostfs_cli_on_first_node: FrostfsCli,
+    simple_object_size: ObjectSize,
+    cluster: Cluster,
+    client_shell: Shell,
+    container: str,
+) -> str:
+    test_file = generate_file(simple_object_size.value)
+
+    with reporter.step("Allow PutObject on first node via local override"):
+        frostfs_cli_on_first_node.control.add_rule(
+            endpoint=cluster.storage_nodes[0].get_control_endpoint(),
+            target_type="container",
+            target_name=container,
+            chain_id="allowPutObject",
+            rule=f"allow Object.Put *",
+        )
+
+    with reporter.step("Put objects in container on the first node"):
+        object_id = put_object(default_wallet, test_file, container, client_shell, cluster.storage_nodes[0].get_rpc_endpoint())
+
+    with reporter.step("Remove PutObject local override from first node"):
+        frostfs_cli_on_first_node.control.remove_rule(
+            endpoint=cluster.storage_nodes[0].get_control_endpoint(),
+            target_type="container",
+            target_name=container,
+            chain_id="allowPutObject",
+        )
+
+    return object_id

pytest_tests/testsuites/ape/test_ape_local_container.py

@@ -0,0 +1,212 @@
+from time import sleep
+
+import allure
+import pytest
+from frostfs_testlib import reporter
+from frostfs_testlib.cli import FrostfsCli
+from frostfs_testlib.resources.cli import FROSTFS_CLI_EXEC
+from frostfs_testlib.resources.common import MORPH_BLOCK_TIME
+from frostfs_testlib.resources.error_patterns import RULE_ACCESS_DENIED_CONTAINER
+from frostfs_testlib.shell.interfaces import Shell
+from frostfs_testlib.storage.cluster import Cluster, ClusterNode
+from frostfs_testlib.storage.dataclasses.ape import Operations
+from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
+from frostfs_testlib.testing.parallel import parallel
+from frostfs_testlib.testing.test_control import expect_not_raises
+from frostfs_testlib.utils import datetime_utils
+
+from ...helpers.container_request import APE_EVERYONE_ALLOW_ALL, ContainerRequest, MultipleContainersRequest
+
+REP2 = ContainerRequest("REP 2", ape_rules=APE_EVERYONE_ALLOW_ALL, short_name="REP2_allow_all_ape")
+
+
+def remove_local_overrides_on_node(node: ClusterNode):
+    target = "Chain ID"
+    shell: Shell = node.host.get_shell()
+    remote_config: str = node.storage_node.get_remote_wallet_config_path()
+    cli = FrostfsCli(shell=shell, frostfs_cli_exec_path=FROSTFS_CLI_EXEC, config_file=remote_config)
+    with reporter.step(f"Check local overrides on {node.storage_node.id} node"):
+        rules = cli.control.list_rules(
+            endpoint=node.storage_node.get_control_endpoint(), target_name="root", target_type="namespace"
+        ).stdout
+        if target in rules:
+            with reporter.step("Delete rules"):
+                chain_ids = [i.split(" ")[2].strip() for i in rules.split("\n") if "Chain ID" in i]
+                for chain_id in chain_ids:
+                    cli.control.remove_rule(
+                        endpoint=node.storage_node.get_control_endpoint(),
+                        target_type="namespace",
+                        target_name="root",
+                        chain_id=chain_id,
+                    )
+            with reporter.step("Wait for one block"):
+                sleep(datetime_utils.parse_time(MORPH_BLOCK_TIME))
+
+
+@pytest.fixture(scope="session")
+def remove_local_ape_overrides(cluster: Cluster) -> None:
+    yield
+    with reporter.step("Check local overrides on nodes."):
+        parallel(remove_local_overrides_on_node, cluster.cluster_nodes)
+
+
+@pytest.mark.ape
+@pytest.mark.ape_local
+@pytest.mark.ape_container
+@pytest.mark.ape_namespace
+class TestApeLocalOverrideContainer(ClusterTestBase):
+    @allure.title("LocalOverride: Deny to GetContainer in root tenant")
+    def test_local_override_deny_to_get_container_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        frostfs_cli: FrostfsCli,
+        container: str,
+        remove_local_ape_overrides: None,
+    ):
+        with reporter.step("Create a namespace rule for the first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="namespace",
+                target_name="root",
+                chain_id="denyContainerGet",
+                rule="deny Container.Get *",
+            )
+
+        with reporter.step("Check get the container property on the first node, expected denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_CONTAINER.format(operation=Operations.GET_CONTAINER)):
+                frostfs_cli.container.get(self.cluster.storage_nodes[0].get_rpc_endpoint(), container)
+
+        with reporter.step("Check get the container property on the second node, expected allow"):
+            with expect_not_raises():
+                frostfs_cli.container.get(self.cluster.storage_nodes[1].get_rpc_endpoint(), container)
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="namespace",
+                target_name="root",
+                chain_id="denyContainerGet",
+            )
+
+        with reporter.step("Check get the container property on the first node, expected allow"):
+            with expect_not_raises():
+                frostfs_cli.container.get(self.cluster.storage_nodes[0].get_rpc_endpoint(), container)
+
+    @allure.title("LocalOverride: Deny to PutContainer in root tenant")
+    def test_local_override_deny_to_put_container_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        frostfs_cli: FrostfsCli,
+        remove_local_ape_overrides: None,
+    ):
+        with reporter.step("Create a namespace rule for the first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="namespace",
+                target_name="root",
+                chain_id="denyContainerPut",
+                rule="deny Container.Put *",
+            )
+
+        with reporter.step("Check create container on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_CONTAINER.format(operation=Operations.PUT_CONTAINER)):
+                frostfs_cli.container.create(
+                    rpc_endpoint=self.cluster.storage_nodes[0].get_rpc_endpoint(),
+                    policy="REP 1",
+                )
+
+        with reporter.step("Check create a container on the second node, expected allow"):
+            with expect_not_raises():
+                frostfs_cli.container.create(
+                    rpc_endpoint=self.cluster.storage_nodes[1].get_rpc_endpoint(),
+                    policy="REP 1",
+                )
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="namespace",
+                target_name="root",
+                chain_id="denyContainerPut",
+            )
+
+        with reporter.step("Check create a container on the first node, expected allow"):
+            with expect_not_raises():
+                frostfs_cli.container.create(
+                    rpc_endpoint=self.cluster.storage_nodes[0].get_rpc_endpoint(),
+                    policy="REP 1",
+                )
+
+    @allure.title("LocalOverride: Deny to ListContainer in root tenant")
+    def test_local_override_deny_to_list_container_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        frostfs_cli: FrostfsCli,
+        remove_local_ape_overrides: None,
+    ):
+        with reporter.step("Create a namespace rule for the first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="namespace",
+                target_name="root",
+                chain_id="denyContainerList",
+                rule="deny Container.List *",
+            )
+
+        with reporter.step("Check list the container properties on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_CONTAINER.format(operation=Operations.LIST_CONTAINER)):
+                frostfs_cli.container.list(rpc_endpoint=self.cluster.storage_nodes[0].get_rpc_endpoint(), ttl=1)
+
+        with reporter.step("Check list the container properties on the second node, expected allow"):
+            with expect_not_raises():
+                frostfs_cli.container.list(rpc_endpoint=self.cluster.storage_nodes[1].get_rpc_endpoint(), ttl=1)
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="namespace",
+                target_name="root",
+                chain_id="denyContainerList",
+            )
+
+        with reporter.step("Check display a list of containers on the first node, expected allow"):
+            with expect_not_raises():
+                frostfs_cli.container.list(rpc_endpoint=self.cluster.storage_nodes[0].get_rpc_endpoint(), ttl=1)
+
+    @allure.title("LocalOverride: Deny to DeleteContainer in root tenant")
+    @pytest.mark.parametrize("multiple_containers_request", [MultipleContainersRequest([REP2, REP2])], indirect=True)
+    def test_local_override_deny_to_delete_container_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        frostfs_cli: FrostfsCli,
+        remove_local_ape_overrides: None,
+        containers: list[str],
+    ):
+        with reporter.step("Create a namespace rule for the first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="namespace",
+                target_name="root",
+                chain_id="denyContainerDelete",
+                rule="deny Container.Delete *",
+            )
+
+        with reporter.step("Check delete first container from the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_CONTAINER.format(operation=Operations.DELETE_CONTAINER)):
+                frostfs_cli.container.delete(self.cluster.storage_nodes[0].get_rpc_endpoint(), containers[0], ttl=1)
+
+        with reporter.step("Check delete a second container from the second node, expected allow"):
+            with expect_not_raises():
+                frostfs_cli.container.delete(self.cluster.storage_nodes[1].get_rpc_endpoint(), containers[1], ttl=1)
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="namespace",
+                target_name="root",
+                chain_id="denyContainerDelete",
+            )
+
+        with reporter.step("Check delete first container from the first node, expected allow"):
+            with expect_not_raises():
+                frostfs_cli.container.delete(self.cluster.storage_nodes[0].get_rpc_endpoint(), containers[0], ttl=1)

pytest_tests/testsuites/ape/test_ape_local_object_allow.py

@@ -0,0 +1,304 @@
+import allure
+import pytest
+from frostfs_testlib import reporter
+from frostfs_testlib.cli import FrostfsCli
+from frostfs_testlib.resources.error_patterns import NO_RULE_FOUND_OBJECT
+from frostfs_testlib.storage.grpc_operations.interfaces import GrpcClientWrapper
+from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
+from frostfs_testlib.testing.test_control import expect_not_raises
+from frostfs_testlib.utils.file_utils import TestFile
+
+from ...helpers.container_request import ContainerRequest
+
+REP1_MSK = ContainerRequest("REP 1 IN MOW CBF 1 SELECT 1 FROM MSK AS MOW FILTER SubDivCode EQ MOW AS MSK", short_name="REP1_MSK_no_ape")
+
+
+@pytest.mark.ape
+@pytest.mark.ape_local
+@pytest.mark.ape_object
+@pytest.mark.ape_allow
+@pytest.mark.parametrize("container_request", [REP1_MSK], indirect=True)
+@pytest.mark.parametrize("user_tag", ["ApeLocalOverrideAllow"], indirect=True)  # provide dedicated user with no APE side-policies
+class TestApeLocalOverrideAllow(ClusterTestBase):
+    @allure.title("LocalOverride: Allow to GetObject in root tenant")
+    def test_local_override_allow_to_get_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        object_id: str,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowGetObject",
+                rule=f"allow Object.Get *",
+            )
+
+        with reporter.step("Check get object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.get(container, object_id, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check get object in container on the second node, epxected access denied error"):
+            with pytest.raises(RuntimeError, match=NO_RULE_FOUND_OBJECT):
+                grpc_client.object.get(container, object_id, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowGetObject",
+            )
+
+    @allure.title("LocalOverride: Allow to PutObject in root tenant")
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    def test_local_override_allow_to_put_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        test_file: TestFile,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowPutObject",
+                rule=f"allow Object.Put *",
+            )
+
+        with reporter.step("Check put object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.put(test_file, container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check put object in container on the second node, epxected access denied error"):
+            with pytest.raises(RuntimeError, match=NO_RULE_FOUND_OBJECT):
+                grpc_client.object.put(test_file, container, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowPutObject",
+            )
+
+    @allure.title("LocalOverride: Allow to HeadObject in root tenant")
+    def test_local_override_allow_to_head_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        object_id: str,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowHeadObject",
+                rule=f"allow Object.Head *",
+            )
+
+        with reporter.step("Check head object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.head(container, object_id, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check head object in container on the second node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=NO_RULE_FOUND_OBJECT):
+                grpc_client.object.head(container, object_id, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowHeadObject",
+            )
+
+    @allure.title("LocalOverride: Allow to SearchObject in root tenant")
+    def test_local_override_allow_to_search_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowSearchObject",
+                rule=f"allow Object.Search *",
+            )
+
+        with reporter.step("Check search object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.search(container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check search object from container on the second node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=NO_RULE_FOUND_OBJECT):
+                grpc_client.object.search(container, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowSearchObject",
+            )
+
+    @allure.title("LocalOverride: Allow to RangeObject in root tenant")
+    def test_local_override_allow_to_range_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        object_id: str,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowRangeObject",
+                rule=f"allow Object.Range *",
+            )
+
+        with reporter.step("Check get range object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.range(container, object_id, "0:10", self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check get range object in container on the second node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=NO_RULE_FOUND_OBJECT):
+                grpc_client.object.range(container, object_id, "0:10", self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowRangeObject",
+            )
+
+    @allure.title("LocalOverride: Allow to HashObject in root tenant")
+    def test_local_override_allow_to_hash_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        object_id: str,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowHashObject",
+                rule=f"allow Object.Hash *",
+            )
+
+        with reporter.step("Check get range hash object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.hash(self.cluster.storage_nodes[0].get_rpc_endpoint(), container, object_id, range="0:10")
+
+        with reporter.step("Check get range hash object in container on the second node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=NO_RULE_FOUND_OBJECT):
+                grpc_client.object.hash(self.cluster.storage_nodes[1].get_rpc_endpoint(), container, object_id, range="0:10")
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowHashObject",
+            )
+
+    @allure.title("LocalOverride: Allow to DeleteObject in root tenant")
+    def test_local_override_allow_to_delete_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        object_id: str,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowDeleteObject",
+                rule=f"allow Object.Head Object.Delete *",
+            )
+
+        with reporter.step("Check delete object from container on the second node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=NO_RULE_FOUND_OBJECT):
+                grpc_client.object.delete(container, object_id, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Check delete object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.delete(container, object_id, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowDeleteObject",
+            )
+
+    @allure.title("LocalOverride: Allow to PatchObject in root tenant")
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    def test_local_override_allow_to_patch_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        object_id: str,
+        test_file: TestFile,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowPatchObject",
+                rule=f"allow Object.Patch *",
+            )
+
+        with reporter.step("Check patch object in container on the second node, epxected access denied error"):
+            with pytest.raises(RuntimeError, match=NO_RULE_FOUND_OBJECT):
+                grpc_client.object.patch(
+                    container,
+                    object_id,
+                    self.cluster.storage_nodes[1].get_rpc_endpoint(),
+                    ranges=["500:300"],
+                    payloads=[test_file],
+                    new_attrs="patched=false",
+                    timeout="200s",
+                )
+
+        with reporter.step("Check patch object in container on the first node, expected allow"):
+            with expect_not_raises():
+                patched_oid = grpc_client.object.patch(
+                    container,
+                    object_id,
+                    self.cluster.storage_nodes[0].get_rpc_endpoint(),
+                    ranges=["100:200"],
+                    payloads=[test_file],
+                    new_attrs="patched=true",
+                    timeout="200s",
+                )
+                assert patched_oid != object_id, "OID of patched object must be different from original one"
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="allowPatchObject",
+            )

pytest_tests/testsuites/ape/test_ape_local_object_deny.py

@@ -0,0 +1,382 @@
+import allure
+import pytest
+from frostfs_testlib import reporter
+from frostfs_testlib.cli import FrostfsCli
+from frostfs_testlib.resources.error_patterns import RULE_ACCESS_DENIED_OBJECT
+from frostfs_testlib.storage.grpc_operations.interfaces import GrpcClientWrapper
+from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
+from frostfs_testlib.testing.test_control import expect_not_raises
+from frostfs_testlib.utils.file_utils import TestFile
+
+from ...helpers.container_request import APE_EVERYONE_ALLOW_ALL, ContainerRequest
+
+REP2 = ContainerRequest("REP 2", ape_rules=APE_EVERYONE_ALLOW_ALL, short_name="REP2_allow_all_ape")
+
+
+@pytest.mark.ape
+@pytest.mark.ape_local
+@pytest.mark.ape_object
+@pytest.mark.ape_deny
+class TestApeLocalOverrideDeny(ClusterTestBase):
+    @allure.title("LocalOverride: Deny to GetObject in root tenant")
+    @pytest.mark.parametrize("container_request", [REP2], indirect=True)
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    def test_local_override_deny_to_get_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        test_file: TestFile,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyGetObject",
+                rule=f"deny Object.Get /{container}/*",
+            )
+
+        with reporter.step("Put object in container on the first node"):
+            oid = grpc_client.object.put(test_file, container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check get object from container on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_OBJECT):
+                grpc_client.object.get(container, oid, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check get object from container on the second node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.get(container, oid, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyGetObject",
+            )
+
+        with reporter.step("Check get object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.get(container, oid, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+    @allure.title("LocalOverride: Deny to PutObject in root tenant")
+    @pytest.mark.parametrize("container_request", [REP2], indirect=True)
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    def test_local_override_deny_to_put_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        test_file: TestFile,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyPutObject",
+                rule=f"deny Object.Put /{container}/*",
+            )
+
+        with reporter.step("Check put object from container on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_OBJECT):
+                grpc_client.object.put(test_file, container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check put object from container on the second node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.put(test_file, container, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyPutObject",
+            )
+
+        with reporter.step("Check get object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.put(test_file, container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+    @allure.title("LocalOverride: Deny to HeadObject in root tenant")
+    @pytest.mark.parametrize("container_request", [REP2], indirect=True)
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    def test_local_override_deny_to_head_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        test_file: TestFile,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyHeadObject",
+                rule=f"deny Object.Head /{container}/*",
+            )
+
+        with reporter.step("Put object in container on the first node"):
+            oid = grpc_client.object.put(test_file, container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check head object from container on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_OBJECT):
+                grpc_client.object.head(container, oid, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check head object from container on the second node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.head(container, oid, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyHeadObject",
+            )
+
+        with reporter.step("Check head object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.head(container, oid, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+    @allure.title("LocalOverride: Deny to SearchObject in root tenant")
+    @pytest.mark.parametrize("container_request", [REP2], indirect=True)
+    def test_local_override_deny_to_search_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denySearchObject",
+                rule=f"deny Object.Search /{container}/*",
+            )
+
+        with reporter.step("Check search object from container on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_OBJECT):
+                grpc_client.object.search(container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check search object from container on the second node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.search(container, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denySearchObject",
+            )
+
+        with reporter.step("Check search object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.search(container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+    @allure.title("LocalOverride: Deny to RangeObject in root tenant")
+    @pytest.mark.parametrize("container_request", [REP2], indirect=True)
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    def test_local_override_deny_to_range_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        test_file: TestFile,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyRangeObject",
+                rule=f"deny Object.Range /{container}/*",
+            )
+
+        with reporter.step("Put object in container on the first node"):
+            oid = grpc_client.object.put(test_file, container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check range object from container on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_OBJECT):
+                grpc_client.object.range(container, oid, "0:10", self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check get range object from container on the second node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.range(container, oid, "0:10", self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyRangeObject",
+            )
+
+        with reporter.step("Check get range object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.range(container, oid, "0:10", self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+    @allure.title("LocalOverride: Deny to HashObject in root tenant")
+    @pytest.mark.parametrize("container_request", [REP2], indirect=True)
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    def test_local_override_deny_to_hash_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        test_file: TestFile,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyHashObject",
+                rule=f"deny Object.Hash /{container}/*",
+            )
+
+        with reporter.step("Put object in container on the first node"):
+            oid = grpc_client.object.put(test_file, container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check get range hash object from container on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_OBJECT):
+                grpc_client.object.hash(self.cluster.storage_nodes[0].get_rpc_endpoint(), container, oid, range="0:10")
+
+        with reporter.step("Check get range hash object from container on the second node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.hash(self.cluster.storage_nodes[1].get_rpc_endpoint(), container, oid, range="0:10")
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyHashObject",
+            )
+
+        with reporter.step("Check get range hash object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.hash(self.cluster.storage_nodes[0].get_rpc_endpoint(), container, oid, range="0:10")
+
+    @allure.title("LocalOverride: Deny to DeleteObject in root tenant")
+    @pytest.mark.parametrize("container_request", [REP2], indirect=True)
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    def test_local_override_deny_to_delete_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        container: str,
+        test_file: TestFile,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyDeleteObject",
+                rule=f"deny Object.Delete /{container}/*",
+            )
+
+        with reporter.step("Put objects in container on the first node"):
+            oid_1 = grpc_client.object.put(test_file, container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+            oid_2 = grpc_client.object.put(test_file, container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Search object in container on the first node"):
+            search_object_in_container_1 = grpc_client.object.search(container, self.cluster.storage_nodes[0].get_rpc_endpoint())
+            assert oid_1 in search_object_in_container_1, f"Object {oid_1} was not found"
+            assert oid_2 in search_object_in_container_1, f"Object {oid_2} was not found"
+
+        with reporter.step("Search object from container on the second node"):
+            search_object_in_container_2 = grpc_client.object.search(container, self.cluster.storage_nodes[1].get_rpc_endpoint())
+            assert oid_1 in search_object_in_container_2, f"Object {oid_1} was not found"
+            assert oid_2 in search_object_in_container_2, f"Object {oid_2} was not found"
+
+        with reporter.step("Check delete object from container on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_OBJECT):
+                grpc_client.object.delete(container, oid_1, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+        with reporter.step("Check delete object from container on the second node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.delete(container, oid_2, self.cluster.storage_nodes[1].get_rpc_endpoint())
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyDeleteObject",
+            )
+
+        with reporter.step("Check delete object in container on the first node, expected allow"):
+            with expect_not_raises():
+                grpc_client.object.delete(container, oid_1, self.cluster.storage_nodes[0].get_rpc_endpoint())
+
+    @allure.title("LocalOverride: Deny to PatchObject in root tenant")
+    @pytest.mark.parametrize("container_request", [REP2], indirect=True)
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    def test_local_override_deny_to_patch_object_root(
+        self,
+        frostfs_cli_on_first_node: FrostfsCli,
+        grpc_client: GrpcClientWrapper,
+        test_file: TestFile,
+        container: str,
+        object_id: str,
+    ):
+        with reporter.step("Create local override on first node"):
+            frostfs_cli_on_first_node.control.add_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyPatchObject",
+                rule=f"deny Object.Patch /{container}/*",
+            )
+
+        with reporter.step("Check patch object from container on the first node, expected access denied error"):
+            with pytest.raises(RuntimeError, match=RULE_ACCESS_DENIED_OBJECT):
+                grpc_client.object.patch(
+                    container,
+                    object_id,
+                    self.cluster.storage_nodes[0].get_rpc_endpoint(),
+                    ranges=["0:350"],
+                    payloads=[test_file],
+                    new_attrs="patched_by_first_node=false",
+                    timeout="200s",
+                )
+
+        with reporter.step("Check patch object from container on the second node, expected allow"):
+            with expect_not_raises():
+                patched_oid_1 = grpc_client.object.patch(
+                    container,
+                    object_id,
+                    self.cluster.storage_nodes[1].get_rpc_endpoint(),
+                    ranges=["200:400"],
+                    payloads=[test_file],
+                    new_attrs="patched_by_second_node=true",
+                    timeout="200s",
+                )
+                assert patched_oid_1 != object_id, "OID of patched object must be different from original one"
+
+        with reporter.step("Delete a rule"):
+            frostfs_cli_on_first_node.control.remove_rule(
+                endpoint=self.cluster.storage_nodes[0].get_control_endpoint(),
+                target_type="container",
+                target_name=container,
+                chain_id="denyPatchObject",
+            )
+
+        with reporter.step("Check patch object in container on the first node, expected allow"):
+            with expect_not_raises():
+                patched_oid_2 = grpc_client.object.patch(
+                    container,
+                    patched_oid_1,
+                    self.cluster.storage_nodes[0].get_rpc_endpoint(),
+                    ranges=["600:0"],
+                    payloads=[test_file],
+                    new_attrs="patched_by_first_node=true",
+                    timeout="200s",
+                )
+                assert patched_oid_1 != patched_oid_2, "OID of patched object must be different from original one"

pytest_tests/testsuites/conftest.py

@@ -1,29 +1,26 @@
 import logging
-import os
 import random
-import shutil
-from datetime import datetime, timedelta, timezone
+from datetime import datetime
 from typing import Optional
 
 import allure
 import pytest
-from dateutil import parser
 from frostfs_testlib import plugins, reporter
 from frostfs_testlib.cli import FrostfsCli
+from frostfs_testlib.clients import AwsCliClient, Boto3ClientWrapper, S3ClientWrapper, S3HttpClient
+from frostfs_testlib.clients.s3 import BucketContainerResolver, VersioningStatus
 from frostfs_testlib.credentials.interfaces import CredentialsProvider, User
 from frostfs_testlib.healthcheck.interfaces import Healthcheck
 from frostfs_testlib.hosting import Hosting
 from frostfs_testlib.resources import optionals
 from frostfs_testlib.resources.common import COMPLEX_OBJECT_CHUNKS_COUNT, COMPLEX_OBJECT_TAIL_SIZE, SIMPLE_OBJECT_SIZE
-from frostfs_testlib.s3 import AwsCliClient, Boto3ClientWrapper, S3ClientWrapper, VersioningStatus
-from frostfs_testlib.s3.interfaces import BucketContainerResolver
 from frostfs_testlib.shell import LocalShell, Shell
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.steps.cli.container import DEFAULT_EC_PLACEMENT_RULE, DEFAULT_PLACEMENT_RULE, FROSTFS_CLI_EXEC
 from frostfs_testlib.steps.cli.object import get_netmap_netinfo
-from frostfs_testlib.steps.s3 import s3_helper
+from frostfs_testlib.steps.epoch import ensure_fresh_epoch
 from frostfs_testlib.storage.cluster import Cluster, ClusterNode
 from frostfs_testlib.storage.controllers.cluster_state_controller import ClusterStateController
-from frostfs_testlib.storage.dataclasses.frostfs_services import StorageNode
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.policy import PlacementPolicy
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
@@ -31,15 +28,16 @@ from frostfs_testlib.storage.grpc_operations.client_wrappers import CliClientWra
 from frostfs_testlib.storage.grpc_operations.interfaces import GrpcClientWrapper
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.parallel import parallel
-from frostfs_testlib.testing.test_control import run_optionally, wait_for_success
+from frostfs_testlib.testing.test_control import cached_fixture, run_optionally
 from frostfs_testlib.utils import env_utils, string_utils, version_utils
 from frostfs_testlib.utils.file_utils import TestFile, generate_file
 
-from pytest_tests.resources.common import TEST_CYCLES_COUNT
+from ..helpers.container_creation import create_container_with_ape, create_containers_with_ape
+from ..helpers.container_request import EVERYONE_ALLOW_ALL, ContainerRequest, MultipleContainersRequest
+from ..resources.common import TEST_CYCLES_COUNT
 
 logger = logging.getLogger("NeoLogger")
 
-SERVICE_ACTIVE_TIME = 20
 WALLTETS_IN_POOL = 2
 
 
@@ -55,20 +53,6 @@ start_time = pytest.StashKey[int]()
 test_outcome = pytest.StashKey[str]()
 
 
-# pytest hook. Do not rename
-def pytest_collection_modifyitems(items: list[pytest.Item]):
-    # Change order of tests based on @pytest.mark.order(<int>) marker
-    def order(item: pytest.Item) -> int:
-        order_marker = item.get_closest_marker("order")
-        if order_marker and (len(order_marker.args) != 1 or not isinstance(order_marker.args[0], int)):
-            raise RuntimeError("Incorrect usage of pytest.mark.order")
-
-        order_value = order_marker.args[0] if order_marker else 0
-        return order_value
-
-    items.sort(key=lambda item: order(item))
-
-
 # pytest hook. Do not rename
 def pytest_collection_finish(session: pytest.Session):
     items_total = len(session.items)
@@ -141,15 +125,16 @@ def require_multiple_interfaces(cluster: Cluster):
     interfaces = cluster.cluster_nodes[0].host.config.interfaces
     if "internal1" not in interfaces or "data1" not in interfaces:
         pytest.skip("This test requires multiple internal and data interfaces")
-    yield
+    return
 
 
 @pytest.fixture(scope="session")
+@cached_fixture(optionals.OPTIONAL_CACHE_FIXTURES)
 def max_object_size(cluster: Cluster, client_shell: Shell) -> int:
     storage_node = cluster.storage_nodes[0]
     wallet = WalletInfo.from_node(storage_node)
     net_info = get_netmap_netinfo(wallet=wallet, endpoint=storage_node.get_rpc_endpoint(), shell=client_shell)
-    yield net_info["maximum_object_size"]
+    return net_info["maximum_object_size"]
 
 
 @pytest.fixture(scope="session")
@@ -158,11 +143,6 @@ def simple_object_size(max_object_size: int) -> ObjectSize:
     return ObjectSize("simple", size)
 
 
-@pytest.fixture()
-def file_path(object_size: ObjectSize) -> TestFile:
-    return generate_file(object_size.value)
-
-
 @pytest.fixture(scope="session")
 def complex_object_size(max_object_size: int) -> ObjectSize:
     size = max_object_size * int(COMPLEX_OBJECT_CHUNKS_COUNT) + int(COMPLEX_OBJECT_TAIL_SIZE)
@@ -172,7 +152,11 @@ def complex_object_size(max_object_size: int) -> ObjectSize:
 # By default we want all tests to be executed with both object sizes
 # This can be overriden in choosen tests if needed
 @pytest.fixture(
-    scope="session", params=[pytest.param("simple", marks=pytest.mark.simple), pytest.param("complex", marks=pytest.mark.complex)]
+    scope="session",
+    params=[
+        pytest.param("simple", marks=[pytest.mark.simple, pytest.mark.exclude_sanity]),
+        pytest.param("complex", marks=pytest.mark.complex),
+    ],
 )
 def object_size(simple_object_size: ObjectSize, complex_object_size: ObjectSize, request: pytest.FixtureRequest) -> ObjectSize:
     if request.param == "simple":
@@ -181,6 +165,22 @@ def object_size(simple_object_size: ObjectSize, complex_object_size: ObjectSize,
     return complex_object_size
 
 
+@pytest.fixture()
+def test_file(object_size: ObjectSize) -> TestFile:
+    return generate_file(object_size.value)
+
+
+@pytest.fixture(scope="module")
+def test_file_module(object_size: ObjectSize) -> TestFile:
+    return generate_file(object_size.value)
+
+
+# Deprecated. Please migrate all to test_file
+@pytest.fixture()
+def file_path(test_file: TestFile) -> TestFile:
+    return test_file
+
+
 @pytest.fixture(scope="session")
 def rep_placement_policy() -> PlacementPolicy:
     return PlacementPolicy("rep", DEFAULT_PLACEMENT_RULE)
@@ -193,8 +193,25 @@ def ec_placement_policy() -> PlacementPolicy:
 
 @pytest.fixture(scope="session")
 @allure.title("Init Frostfs CLI")
-def frostfs_cli(client_shell: Shell, default_wallet: WalletInfo) -> FrostfsCli:
-    return FrostfsCli(client_shell, FROSTFS_CLI_EXEC, default_wallet.config_path)
+def frostfs_cli(client_shell: Shell, wallet: WalletInfo) -> FrostfsCli:
+    return FrostfsCli(client_shell, FROSTFS_CLI_EXEC, wallet.config_path)
+
+
+@pytest.fixture(scope="session")
+@allure.title("Init Frostfs CLI remote")
+def remote_frostfs_cli(cluster: Cluster) -> FrostfsCli:
+    node = cluster.cluster_nodes[0]
+    host = node.host
+    service_config = host.get_service_config(node.storage_node.name)
+    wallet_path = service_config.attributes["wallet_path"]
+    wallet_password = service_config.attributes["wallet_password"]
+
+    shell = host.get_shell()
+    wallet_config_path = f"/tmp/{node.storage_node.name}-config.yaml"
+    wallet_config = f'wallet: {wallet_path}\npassword: "{wallet_password}"'
+    shell.exec(f"echo '{wallet_config}' > {wallet_config_path}")
+    cli = FrostfsCli(shell=shell, frostfs_cli_exec_path=FROSTFS_CLI_EXEC, config_file=wallet_config_path)
+    return cli
 
 
 @pytest.fixture(scope="session")
@@ -203,6 +220,12 @@ def grpc_client(frostfs_cli: FrostfsCli) -> GrpcClientWrapper:
     return CliClientWrapper(frostfs_cli)
 
 
+@pytest.fixture(scope="session")
+@allure.title("Init GrpcClientWrapper with remote Frostfs CLI")
+def remote_grpc_client(remote_frostfs_cli: FrostfsCli) -> GrpcClientWrapper:
+    return CliClientWrapper(remote_frostfs_cli)
+
+
 # By default we want all tests to be executed with both storage policies.
 # This can be overriden in choosen tests if needed.
 @pytest.fixture(scope="session", params=[pytest.param("rep", marks=pytest.mark.rep), pytest.param("ec", marks=pytest.mark.ec)])
@@ -211,8 +234,10 @@ def placement_policy(
 ) -> PlacementPolicy:
     if request.param == "rep":
         return rep_placement_policy
+    elif request.param == "ec":
+        return ec_placement_policy
 
-    return ec_placement_policy
+    return request.param
 
 
 @pytest.fixture(scope="session")
@@ -267,25 +292,39 @@ def credentials_provider(cluster: Cluster) -> CredentialsProvider:
 @pytest.fixture(
     scope="session",
     params=[
-        pytest.param(AwsCliClient, marks=[pytest.mark.aws, pytest.mark.weekly]),
+        pytest.param(AwsCliClient, marks=[pytest.mark.aws, pytest.mark.weekly, pytest.mark.exclude_sanity]),
         pytest.param(Boto3ClientWrapper, marks=[pytest.mark.boto3, pytest.mark.nightly]),
     ],
 )
 def s3_client(
-    default_user: User,
+    user: User,
     s3_policy: Optional[str],
     cluster: Cluster,
     request: pytest.FixtureRequest,
     credentials_provider: CredentialsProvider,
 ) -> S3ClientWrapper:
     node = cluster.cluster_nodes[0]
-    credentials_provider.S3.provide(default_user, node, s3_policy)
+    credentials_provider.S3.provide(user, node, s3_policy)
 
     s3_client_cls = request.param
-    client = s3_client_cls(default_user.s3_credentials.access_key, default_user.s3_credentials.secret_key, cluster.default_s3_gate_endpoint)
+    client = s3_client_cls(user.s3_credentials.access_key, user.s3_credentials.secret_key, cluster.default_s3_gate_endpoint)
     return client
 
 
+@allure.title("[Session] Create S3 http client")
+@pytest.fixture(scope="session")
+def s3_http_client(
+    default_user: User, s3_policy: Optional[str], cluster: Cluster, credentials_provider: CredentialsProvider
+) -> S3HttpClient:
+    node = cluster.cluster_nodes[0]
+    credentials_provider.S3.provide(default_user, node, s3_policy)
+    return S3HttpClient(
+        cluster.default_s3_gate_endpoint,
+        default_user.s3_credentials.access_key,
+        default_user.s3_credentials.secret_key,
+    )
+
+
 @pytest.fixture
 def versioning_status(request: pytest.FixtureRequest) -> VersioningStatus:
     if "param" in request.__dict__:
@@ -378,46 +417,14 @@ def session_start_time(configure_testlib):
     return start_time
 
 
-@allure.title("[Autouse/Session] After deploy healthcheck")
-@pytest.fixture(scope="session", autouse=True)
-@run_optionally(optionals.OPTIONAL_AUTOUSE_FIXTURES_ENABLED)
-def after_deploy_healthcheck(cluster: Cluster):
-    with reporter.step("Wait for cluster readiness after deploy"):
-        parallel(readiness_on_node, cluster.cluster_nodes)
-
-
 @pytest.fixture(scope="session")
 def rpc_endpoint(cluster: Cluster):
     return cluster.default_rpc_endpoint
 
 
-@wait_for_success(60 * SERVICE_ACTIVE_TIME * 3, 60, title="Wait for {cluster_node} readiness")
-def readiness_on_node(cluster_node: ClusterNode):
-    if "skip_readiness_check" in cluster_node.host.config.attributes and cluster_node.host.config.attributes["skip_readiness_check"]:
-        return
-
-    # TODO: Move to healtcheck classes
-    svc_name = cluster_node.service(StorageNode).get_service_systemctl_name()
-    with reporter.step(f"Check service {svc_name} is active"):
-        result = cluster_node.host.get_shell().exec(f"systemctl is-active {svc_name}")
-        assert "active" == result.stdout.strip(), f"Service {svc_name} should be in active state"
-
-    with reporter.step(f"Check service {svc_name} is active more than {SERVICE_ACTIVE_TIME} minutes"):
-        result = cluster_node.host.get_shell().exec(f"systemctl show {svc_name} --property ActiveEnterTimestamp | cut -d '=' -f 2")
-        start_time = parser.parse(result.stdout.strip())
-        current_time = datetime.now(tz=timezone.utc)
-        active_time = current_time - start_time
-
-        active_minutes = active_time.seconds // 60
-        active_seconds = active_time.seconds - active_minutes * 60
-
-        assert active_time > timedelta(
-            minutes=SERVICE_ACTIVE_TIME
-        ), f"Service should be in active state more than {SERVICE_ACTIVE_TIME} minutes, current {active_minutes}m:{active_seconds}s"
-
-
 @reporter.step("Prepare default user with wallet")
 @pytest.fixture(scope="session")
+@cached_fixture(optionals.OPTIONAL_CACHE_FIXTURES)
 def default_user(credentials_provider: CredentialsProvider, cluster: Cluster) -> User:
     user = User(string_utils.unique_name("user-"))
     node = cluster.cluster_nodes[0]
@@ -427,18 +434,51 @@ def default_user(credentials_provider: CredentialsProvider, cluster: Cluster) ->
     return user
 
 
-@reporter.step("Get wallet for default user")
 @pytest.fixture(scope="session")
-def default_wallet(default_user: User) -> WalletInfo:
-    return default_user.wallet
-
-
-@pytest.fixture(scope="session")
-def wallets_pool(credentials_provider: CredentialsProvider, cluster: Cluster) -> list[WalletInfo]:
+@cached_fixture(optionals.OPTIONAL_CACHE_FIXTURES)
+def users_pool(credentials_provider: CredentialsProvider, cluster: Cluster) -> list[User]:
     users = [User(string_utils.unique_name("user-")) for _ in range(WALLTETS_IN_POOL)]
     parallel(credentials_provider.GRPC.provide, users, cluster_node=cluster.cluster_nodes[0])
+    return users
 
-    return [user.wallet for user in users]
+
+@pytest.fixture(scope="session")
+def user_tag(request: pytest.FixtureRequest) -> str:
+    tag = "default"
+    if "param" in request.__dict__:
+        tag = request.param
+
+    return tag
+
+
+@pytest.fixture(scope="session")
+@cached_fixture(optionals.OPTIONAL_CACHE_FIXTURES)
+@reporter.step("Create {user_tag} user")
+def user(user_tag: str) -> User:
+    user = User(string_utils.unique_name("user-"))
+    user.attributes["tag"] = user_tag
+
+    return user
+
+
+@pytest.fixture(scope="session")
+@cached_fixture(optionals.OPTIONAL_CACHE_FIXTURES)
+def wallet(user: User, credentials_provider: CredentialsProvider, cluster: Cluster) -> WalletInfo:
+    credentials_provider.GRPC.provide(user, cluster.cluster_nodes[0])
+    return user.wallet
+
+
+# TODO: Migrate tests to fixture wallet above
+@reporter.step("Get wallet for default user")
+@pytest.fixture(scope="session")
+def default_wallet(wallet: WalletInfo) -> WalletInfo:
+    return wallet
+
+
+@pytest.fixture(scope="session")
+@cached_fixture(optionals.OPTIONAL_CACHE_FIXTURES)
+def wallets_pool(users_pool: list[User]) -> list[WalletInfo]:
+    return [user.wallet for user in users_pool]
 
 
 @pytest.fixture(scope="session")
@@ -469,3 +509,71 @@ def bucket_container_resolver(node_under_test: ClusterNode) -> BucketContainerRe
     resolver_cls = plugins.load_plugin("frostfs.testlib.bucket_cid_resolver", node_under_test.host.config.product)
     resolver: BucketContainerResolver = resolver_cls()
     return resolver
+
+
+@pytest.fixture(scope="session", params=[pytest.param(EVERYONE_ALLOW_ALL)])
+def container_request(request: pytest.FixtureRequest) -> ContainerRequest:
+    if "param" in request.__dict__:
+        return request.param
+
+    container_marker = request.node.get_closest_marker("container")
+    # let default container to be public at the moment
+    container_request = EVERYONE_ALLOW_ALL
+
+    if container_marker:
+        if len(container_marker.args) != 1:
+            raise RuntimeError(f"Something wrong with container marker: {container_marker}")
+        container_request = container_marker.args[0]
+
+    if not container_request:
+        raise RuntimeError(
+            f"""Container specification is empty. 
+                Add @pytest.mark.parametrize("container_request", [ContainerRequest(...)], indirect=True) decorator."""
+        )
+
+    return container_request
+
+
+@pytest.fixture(scope="session")
+def multiple_containers_request(request: pytest.FixtureRequest) -> ContainerRequest:
+    if "param" in request.__dict__:
+        return request.param
+
+    raise RuntimeError(
+        f"""Container specification is empty. 
+            Add @pytest.mark.parametrize("container_requests", [[ContainerRequest(...), ..., ContainerRequest(...)]], indirect=True) decorator."""
+    )
+
+
+@pytest.fixture
+def container(
+    wallet: WalletInfo,
+    frostfs_cli: FrostfsCli,
+    client_shell: Shell,
+    cluster: Cluster,
+    rpc_endpoint: str,
+    container_request: ContainerRequest,
+) -> str:
+    return create_container_with_ape(container_request, frostfs_cli, wallet, client_shell, cluster, rpc_endpoint)
+
+
+@pytest.fixture
+def containers(
+    wallet: WalletInfo,
+    frostfs_cli: FrostfsCli,
+    client_shell: Shell,
+    cluster: Cluster,
+    rpc_endpoint: str,
+    multiple_containers_request: MultipleContainersRequest,
+) -> list[str]:
+    return create_containers_with_ape(frostfs_cli, wallet, client_shell, cluster, rpc_endpoint, multiple_containers_request)
+
+
+@pytest.fixture()
+def new_epoch(client_shell: Shell, cluster: Cluster) -> int:
+    return ensure_fresh_epoch(client_shell, cluster)
+
+
+@pytest.fixture(scope="module")
+def new_epoch_module_scope(client_shell: Shell, cluster: Cluster) -> int:
+    return ensure_fresh_epoch(client_shell, cluster)

pytest_tests/testsuites/container/test_container.py

@@ -13,41 +13,30 @@ from frostfs_testlib.steps.cli.container import (
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 
-from pytest_tests.helpers.utility import placement_policy_from_container
+from ...helpers.utility import placement_policy_from_container
 
 
-@pytest.mark.container
+@pytest.mark.nightly
 @pytest.mark.sanity
+@pytest.mark.container
 class TestContainer(ClusterTestBase):
+    PLACEMENT_RULE = "REP 2 IN X CBF 1 SELECT 2 FROM * AS X"
+
     @allure.title("Create container (name={name})")
     @pytest.mark.parametrize("name", ["", "test-container"], ids=["No name", "Set particular name"])
     @pytest.mark.smoke
-    def test_container_creation(self, default_wallet: WalletInfo, name: str):
+    def test_container_creation(self, default_wallet: WalletInfo, name: str, rpc_endpoint: str):
         wallet = default_wallet
 
-        placement_rule = "REP 2 IN X CBF 1 SELECT 2 FROM * AS X"
-        cid = create_container(
-            wallet,
-            rule=placement_rule,
-            name=name,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-        )
+        cid = create_container(wallet, self.shell, rpc_endpoint, self.PLACEMENT_RULE, name=name)
 
-        containers = list_containers(wallet, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint)
+        containers = list_containers(wallet, self.shell, rpc_endpoint)
         assert cid in containers, f"Expected container {cid} in containers: {containers}"
 
-        container_info: str = get_container(
-            wallet,
-            cid,
-            json_mode=False,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-        )
+        container_info: str = get_container(wallet, cid, self.shell, rpc_endpoint, False)
         container_info = container_info.casefold()  # To ignore case when comparing with expected values
 
         info_to_check = {
-            f"basic ACL: {PRIVATE_ACL_F} (private)",
             f"owner ID: {wallet.get_address_from_json(0)}",
             f"CID: {cid}",
         }
@@ -55,7 +44,7 @@ class TestContainer(ClusterTestBase):
             info_to_check.add(f"Name={name}")
 
         with reporter.step("Check container has correct information"):
-            expected_policy = placement_rule.casefold()
+            expected_policy = self.PLACEMENT_RULE.casefold()
             actual_policy = placement_policy_from_container(container_info)
             assert actual_policy == expected_policy, f"Expected policy\n{expected_policy} but got policy\n{actual_policy}"
 
@@ -64,50 +53,43 @@ class TestContainer(ClusterTestBase):
                 assert expected_info in container_info, f"Expected {expected_info} in container info:\n{container_info}"
 
         with reporter.step("Delete container and check it was deleted"):
-            delete_container(
-                wallet,
-                cid,
-                shell=self.shell,
-                endpoint=self.cluster.default_rpc_endpoint,
-                await_mode=True,
-            )
+            # Force to skip frostfs-cli verifictions before delete.
+            # Because no APE rules assigned to container, those verifications will fail due to APE requests denial.
+            delete_container(wallet, cid, self.shell, rpc_endpoint, force=True, await_mode=True)
             self.tick_epoch()
-            wait_for_container_deletion(wallet, cid, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint)
+            wait_for_container_deletion(wallet, cid, self.shell, rpc_endpoint)
+
+    @allure.title("Delete container without force")
+    @pytest.mark.smoke
+    def test_container_deletion_no_force(self, container: str, default_wallet: WalletInfo, rpc_endpoint: str):
+        with reporter.step("Delete container and check it was deleted"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=True)
+            self.tick_epoch()
+            wait_for_container_deletion(default_wallet, container, self.shell, rpc_endpoint)
 
     @allure.title("Parallel container creation and deletion")
-    def test_container_creation_deletion_parallel(self, default_wallet: WalletInfo):
+    @pytest.mark.exclude_sanity
+    def test_container_creation_deletion_parallel(self, default_wallet: WalletInfo, rpc_endpoint: str):
         containers_count = 3
         wallet = default_wallet
-        placement_rule = "REP 2 IN X CBF 1 SELECT 2 FROM * AS X"
         iteration_count = 10
 
-        for iteration in range(iteration_count):
+        for _ in range(iteration_count):
             cids: list[str] = []
             with reporter.step(f"Create {containers_count} containers"):
                 for _ in range(containers_count):
                     cids.append(
-                        create_container(
-                            wallet,
-                            rule=placement_rule,
-                            await_mode=False,
-                            shell=self.shell,
-                            endpoint=self.cluster.default_rpc_endpoint,
-                            wait_for_creation=False,
-                        )
+                        create_container(wallet, self.shell, rpc_endpoint, self.PLACEMENT_RULE, await_mode=False, wait_for_creation=False)
                     )
 
             with reporter.step("Wait for containers occur in container list"):
                 for cid in cids:
-                    wait_for_container_creation(
-                        wallet,
-                        cid,
-                        sleep_interval=containers_count,
-                        shell=self.shell,
-                        endpoint=self.cluster.default_rpc_endpoint,
-                    )
+                    wait_for_container_creation(wallet, cid, self.shell, rpc_endpoint, sleep_interval=containers_count)
 
             with reporter.step("Delete containers and check they were deleted"):
                 for cid in cids:
-                    delete_container(wallet, cid, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint, await_mode=True)
-                    containers_list = list_containers(wallet, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint)
+                    # Force to skip frostfs-cli verifictions before delete.
+                    # Because no APE rules assigned to container, those verifications will fail due to APE requests denial.
+                    delete_container(wallet, cid, self.shell, rpc_endpoint, force=True, await_mode=True)
+                    containers_list = list_containers(wallet, self.shell, rpc_endpoint)
                     assert cid not in containers_list, "Container not deleted"

pytest_tests/testsuites/container/test_policy_with_price.py

@@ -0,0 +1,654 @@
+import itertools
+
+import allure
+import pytest
+from frostfs_testlib import reporter
+from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
+from frostfs_testlib.shell.interfaces import Shell
+from frostfs_testlib.steps.cli.container import delete_container
+from frostfs_testlib.steps.cli.object import delete_object, put_object_to_random_node
+from frostfs_testlib.steps.node_management import get_netmap_snapshot
+from frostfs_testlib.steps.storage_policy import get_nodes_with_object
+from frostfs_testlib.storage.cluster import Cluster, ClusterNode
+from frostfs_testlib.storage.controllers.cluster_state_controller import ClusterStateController
+from frostfs_testlib.storage.controllers.state_managers.config_state_manager import ConfigStateManager
+from frostfs_testlib.storage.dataclasses.frostfs_services import StorageNode
+from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
+from frostfs_testlib.storage.dataclasses.storage_object_info import Interfaces, NodeNetmapInfo
+from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
+from frostfs_testlib.testing import parallel
+from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
+from frostfs_testlib.testing.test_control import wait_for_success
+from frostfs_testlib.utils.cli_utils import parse_netmap_output
+from frostfs_testlib.utils.file_utils import generate_file
+
+from ...helpers.container_creation import create_container_with_ape
+from ...helpers.container_request import PUBLIC_WITH_POLICY, ContainerRequest
+from ...helpers.policy_validation import get_netmap_param, validate_object_policy
+
+
+@pytest.mark.weekly
+@pytest.mark.policy
+@pytest.mark.policy_price
+class TestPolicyWithPrice(ClusterTestBase):
+    @wait_for_success(1200, 60, title="Wait for full field price on node", expected_result=True)
+    def await_for_price_attribute_on_nodes(self):
+        netmap = parse_netmap_output(get_netmap_snapshot(node=self.cluster.storage_nodes[0], shell=self.shell))
+        netmap = get_netmap_param(netmap)
+        for node in self.cluster.cluster_nodes:
+            node_address = node.get_interface(Interfaces.MGMT)
+            if netmap[node_address]["Price"] is None:
+                return False
+        return True
+
+    @reporter.step("Set Pirce field on {cluster_node}")
+    def set_price_on_node(
+        self, cluster_node: ClusterNode, locode_price_map: dict[str, str], netmap: list[NodeNetmapInfo], config_manager: ConfigStateManager
+    ):
+        node_address = cluster_node.get_interface(Interfaces.MGMT)
+        node_netmap = [netmap_entry for netmap_entry in netmap if netmap_entry.node == node_address]
+
+        assert node_netmap, f"No node found with address {node_address}: \n{netmap}"
+
+        price = locode_price_map[node_netmap[0].un_locode]
+        config_manager.set_on_node(cluster_node, StorageNode, {"node:attribute_5": f"Price:{price}"})
+
+    @pytest.fixture(scope="module")
+    def fill_field_price(self, cluster: Cluster, cluster_state_controller_session: ClusterStateController):
+        locode_price_map = {
+            "RU MOW": "15",
+            "RU LED": "10",
+            "SE STO": "65",
+            "FI HEL": "55",
+        }
+
+        netmap = parse_netmap_output(get_netmap_snapshot(node=self.cluster.storage_nodes[0], shell=self.shell))
+        config_manager = cluster_state_controller_session.manager(ConfigStateManager)
+        parallel(self.set_price_on_node, cluster.cluster_nodes, locode_price_map, netmap, config_manager)
+        cluster_state_controller_session.wait_after_storage_startup()
+
+        self.tick_epoch()
+        self.await_for_price_attribute_on_nodes()
+
+        yield
+
+        cluster_state_controller_session.manager(ConfigStateManager).revert_all()
+
+    @pytest.fixture
+    def container(
+        self,
+        default_wallet: WalletInfo,
+        frostfs_cli: FrostfsCli,
+        client_shell: Shell,
+        cluster: Cluster,
+        rpc_endpoint: str,
+        container_request: ContainerRequest,
+        # In these set of tests containers should be created after the fill_field_price fixture
+        fill_field_price,
+    ) -> str:
+        return create_container_with_ape(container_request, frostfs_cli, default_wallet, client_shell, cluster, rpc_endpoint)
+
+    @allure.title("Policy with SELECT and FILTER results with 25% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [PUBLIC_WITH_POLICY("REP 1 IN Nodes25 SELECT 1 FROM LE10 AS Nodes25 FILTER Price LE 10 AS LE10")],
+        indirect=True,
+    )
+    def test_policy_with_select_and_filter_results_with_25_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with SELECT and FILTER results with 25% of available nodes.
+        """
+        placement_params = {"Price": 10}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 1
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            node_address = self.cluster.node(resulting_copies[0]).get_interface(Interfaces.MGMT)
+            with reporter.step(f"Check the node is selected with price <= {placement_params['Price']}"):
+                assert (
+                    int(netmap[node_address]["Price"]) <= placement_params["Price"]
+                ), f"The node is selected with the wrong price. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with select and complex filter results with 25% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [
+            PUBLIC_WITH_POLICY(
+                "REP 1 IN Nodes25 SELECT 1 FROM BET0AND10 AS Nodes25 FILTER Price LE 10 AS LE10 FILTER Price GT 0 AS GT0 FILTER @LE10 AND @GT0 AS BET0AND10"
+            )
+        ],
+        indirect=True,
+    )
+    def test_policy_with_select_and_complex_filter_results_with_25_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with SELECT and Complex FILTER results with 25% of available nodes.
+        """
+        placement_params = {"Price": [10, 0]}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 1
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            with reporter.step(f"Check the node is selected with price between 1 and 10"):
+                for node in resulting_copies:
+                    node_address = self.cluster.node(node).get_interface(Interfaces.MGMT)
+                    assert (
+                        int(netmap[node_address]["Price"]) > placement_params["Price"][1]
+                        and int(netmap[node_address]["Price"]) <= placement_params["Price"][0]
+                    ), f"The node is selected with the wrong price. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with Multi SELECTs and FILTERs results with 25% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [
+            PUBLIC_WITH_POLICY(
+                "UNIQUE REP 1 IN One REP 1 IN One CBF 1 SELECT 1 FROM MINMAX AS One FILTER Price LT 15 AS LT15 FILTER Price GT 55 AS GT55 FILTER @LT15 OR @GT55 AS MINMAX"
+            )
+        ],
+        indirect=True,
+    )
+    def test_policy_with_multi_selects_and_filters_results_with_25_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with Multi SELECTs and FILTERs results with 25% of available nodes.
+        """
+        placement_params = {"Price": [15, 55]}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 2
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            with reporter.step(f"Check two nodes are selected with max and min prices"):
+                for node in resulting_copies:
+                    node_address = self.cluster.node(node).get_interface(Interfaces.MGMT)
+                    assert (
+                        int(netmap[node_address]["Price"]) > placement_params["Price"][1]
+                        or int(netmap[node_address]["Price"]) < placement_params["Price"][0]
+                    ), f"The node is selected with the wrong price. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with SELECT and FILTER results with 50% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [PUBLIC_WITH_POLICY("REP 2 IN HALF CBF 1 SELECT 2 FROM GT15 AS HALF FILTER Price GT 15 AS GT15")],
+        indirect=True,
+    )
+    def test_policy_with_select_and_filter_results_with_50_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with SELECT and FILTER results with 50% of available nodes.
+        """
+        placement_params = {"Price": 15}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 2
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            with reporter.step(f"Check two nodes are selected with price > {placement_params['Price']}"):
+                for node in resulting_copies:
+                    node_address = self.cluster.node(node).get_interface(Interfaces.MGMT)
+                    assert (
+                        int(netmap[node_address]["Price"]) > placement_params["Price"]
+                    ), f"The node is selected with the wrong price. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with SELECT and Complex FILTER results with 50% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [
+            PUBLIC_WITH_POLICY(
+                "REP 2 IN HALF CBF 2 SELECT 2 FROM GE15 AS HALF FILTER CountryCode NE RU AS NOTRU FILTER @NOTRU AND Price GE 15 AS GE15"
+            )
+        ],
+        indirect=True,
+    )
+    def test_policy_with_select_and_complex_filter_results_with_50_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with SELECT and Complex FILTER results with 50% of available nodes.
+        """
+        placement_params = {"Price": 15, "country_code": "RU"}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 2
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            with reporter.step(f"Check two nodes are selected not with country code '{placement_params['country_code']}'"):
+                for node in resulting_copies:
+                    node_address = self.cluster.node(node).get_interface(Interfaces.MGMT)
+                    assert (
+                        not netmap[node_address]["country_code"] == placement_params["country_code"]
+                        or not netmap[node_address]["country_code"] == placement_params["country_code"]
+                        and int(netmap[node_address]["Price"]) >= placement_params["Price"]
+                    ), f"The node is selected with the wrong price or country code. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with Multi SELECTs and FILTERs results with 50% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [
+            PUBLIC_WITH_POLICY(
+                "REP 2 IN FH REP 1 IN SH CBF 2 SELECT 2 FROM LE55 AS FH SELECT 2 FROM GE15 AS SH FILTER 'UN-LOCODE' EQ 'RU LED' OR 'UN-LOCODE' EQ 'RU MOW' AS RU FILTER NOT (@RU) AS NOTRU FILTER @NOTRU AND Price GE 15 AS GE15 FILTER @RU AND Price LE 55 AS LE55"
+            )
+        ],
+        indirect=True,
+    )
+    def test_policy_with_multi_selects_and_filters_results_with_50_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with Multi SELECTs and FILTERs results with 50% of available nodes.
+        """
+        placement_params = {"un_locode": ["RU LED", "RU MOW"], "Price": [15, 55]}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 3
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            with reporter.step(f"Check all nodes are selected"):
+                for node in resulting_copies:
+                    node_address = self.cluster.node(node).get_interface(Interfaces.MGMT)
+                    assert (
+                        netmap[node_address]["un_locode"] in placement_params["un_locode"]
+                        or not netmap[node_address]["un_locode"] == placement_params["un_locode"][1]
+                        or (
+                            not netmap[node_address]["un_locode"] == placement_params["un_locode"][1]
+                            and int(netmap[node_address]["Price"]) >= placement_params["Price"][0]
+                        )
+                        or (
+                            netmap[node_address]["un_locode"] == placement_params["un_locode"][1]
+                            and int(netmap[node_address]["Price"]) <= placement_params["Price"][1]
+                        )
+                    ), f"The node is selected with the wrong price or un_locode. Expected {placement_params} and got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with SELECT and FILTER results with 75% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [PUBLIC_WITH_POLICY("REP 2 IN NODES75 SELECT 2 FROM LT65 AS NODES75 FILTER Price LT 65 AS LT65")],
+        indirect=True,
+    )
+    def test_policy_with_select_and_filter_results_with_75_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with SELECT and FILTER results with 75% of available nodes.
+        """
+        placement_params = {"Price": 65}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 2
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            with reporter.step(f"Check two nodes are selected with price < {placement_params['Price']}"):
+                for node in resulting_copies:
+                    node_address = self.cluster.node(node).get_interface(Interfaces.MGMT)
+                    assert (
+                        int(netmap[node_address]["Price"]) < placement_params["Price"]
+                    ), f"The node is selected with the wrong price. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with SELECT and Complex FILTER results with 75% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [
+            PUBLIC_WITH_POLICY(
+                "REP 2 IN NODES75 SELECT 2 FROM LT65 AS NODES75 FILTER Continent NE America AS NOAM FILTER @NOAM AND Price LT 65 AS LT65"
+            )
+        ],
+        indirect=True,
+    )
+    def test_policy_with_select_and_complex_filter_results_with_75_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with SELECT and Complex FILTER results with 75% of available nodes.
+        """
+        placement_params = {"Price": 65, "continent": "America"}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 2
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            with reporter.step(f"Check three nodes are selected not from {placement_params['continent']}"):
+                for node in resulting_copies:
+                    node_address = self.cluster.node(node).get_interface(Interfaces.MGMT)
+                    assert (
+                        int(netmap[node_address]["Price"]) < placement_params["Price"]
+                        and not netmap[node_address]["continent"] == placement_params["continent"]
+                    ) or (
+                        not netmap[node_address]["continent"] == placement_params["continent"]
+                    ), f"The node is selected with the wrong price or continent. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with Multi SELECTs and FILTERs results with 75% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [
+            PUBLIC_WITH_POLICY(
+                "REP 3 IN EXPNSV REP 3 IN CHEAP SELECT 3 FROM GT10 AS EXPNSV SELECT 3 FROM LT65 AS CHEAP FILTER NOT (Continent EQ America) AS NOAM FILTER @NOAM AND Price LT 65 AS LT65 FILTER @NOAM AND Price GT 10 AS GT10"
+            )
+        ],
+        indirect=True,
+    )
+    def test_policy_with_multi_selects_and_filters_results_with_75_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with Multi SELECTs and FILTERs results with 75% of available nodes.
+        """
+        placement_params = {"Price": [65, 10], "continent": "America"}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 4
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            with reporter.step(f"Check all nodes are selected"):
+                for node in resulting_copies:
+                    node_address = self.cluster.node(node).get_interface(Interfaces.MGMT)
+                    assert (
+                        (
+                            int(netmap[node_address]["Price"]) > placement_params["Price"][1]
+                            and not netmap[node_address]["continent"] == placement_params["continent"]
+                        )
+                        or (
+                            int(netmap[node_address]["Price"]) < placement_params["Price"][0]
+                            and not netmap[node_address]["continent"] == placement_params["continent"]
+                        )
+                        or not (netmap[node_address]["continent"] == placement_params["continent"])
+                    ), f"The node is selected with the wrong price or continent. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with SELECT and FILTER results with 100% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request", [PUBLIC_WITH_POLICY("REP 1 IN All SELECT 4 FROM AllNodes AS All FILTER Price GE 0 AS AllNodes")], indirect=True
+    )
+    def test_policy_with_select_and_filter_results_with_100_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with SELECT and FILTER results with 100% of available nodes.
+        """
+        placement_params = {"Price": 0}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 1
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            node_address = self.cluster.node(resulting_copies[0]).get_interface(Interfaces.MGMT)
+            with reporter.step(f"Check the node is selected with price >= {placement_params['Price']}"):
+                assert (
+                    int(netmap[node_address]["Price"]) >= placement_params["Price"]
+                ), f"The node is selected with the wrong price. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)
+
+    @allure.title("Policy with Multi SELECTs and FILTERs results with 100% of available nodes")
+    @pytest.mark.parametrize(
+        "container_request",
+        [
+            PUBLIC_WITH_POLICY(
+                "REP 4 IN AllOne REP 4 IN AllTwo CBF 4 SELECT 2 FROM GEZero AS AllOne SELECT 2 FROM AllCountries AS AllTwo FILTER Country EQ Russia OR Country EQ Sweden OR Country EQ Finland AS AllCountries FILTER Price GE 0 AS GEZero"
+            )
+        ],
+        indirect=True,
+    )
+    def test_policy_with_multi_selects_and_filters_results_with_100_of_available_nodes(
+        self,
+        default_wallet: WalletInfo,
+        rpc_endpoint: str,
+        simple_object_size: ObjectSize,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        """
+        This test checks object's copies based on container's placement policy with Multi SELECTs and FILTERs results with 100% of available nodes.
+        """
+        placement_params = {"country": ["Russia", "Sweden", "Finland"], "Price": 0}
+        file_path = generate_file(simple_object_size.value)
+        expected_copies = 4
+
+        with reporter.step(f"Check container policy"):
+            validate_object_policy(default_wallet, self.shell, container_request.policy, container, rpc_endpoint)
+
+        with reporter.step(f"Put object in container"):
+            oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
+
+        with reporter.step(f"Check object expected copies"):
+            resulting_copies = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+            assert len(resulting_copies) == expected_copies, f"Expected {expected_copies} copies, got {len(resulting_copies)}"
+
+        with reporter.step(f"Check the object appearance"):
+            netmap = parse_netmap_output(get_netmap_snapshot(node=resulting_copies[0], shell=self.shell))
+            netmap = get_netmap_param(netmap)
+            with reporter.step(f"Check all node are selected"):
+                for node in resulting_copies:
+                    node_address = self.cluster.node(node).get_interface(Interfaces.MGMT)
+                    assert (netmap[node_address]["country"] in placement_params["country"]) or (
+                        int(netmap[node_address]["Price"]) >= placement_params["Price"]
+                    ), f"The node is selected from the wrong country or with wrong price. Got {netmap[node_address]}"
+
+        with reporter.step(f"Delete the object from the container"):
+            delete_object(default_wallet, container, oid, self.shell, rpc_endpoint)
+
+        with reporter.step(f"Delete the container"):
+            delete_container(default_wallet, container, self.shell, rpc_endpoint, await_mode=False)

pytest_tests/testsuites/failovers/test_failover_server.py

@@ -6,11 +6,11 @@ import random
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
+from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
 from frostfs_testlib.steps.cli.container import StorageContainer, StorageContainerInfo, create_container
 from frostfs_testlib.steps.cli.object import get_object, get_object_nodes, put_object
 from frostfs_testlib.steps.node_management import check_node_in_map, check_node_not_in_map
-from frostfs_testlib.storage.cluster import ClusterNode, StorageNode
+from frostfs_testlib.storage.cluster import Cluster, ClusterNode, StorageNode
 from frostfs_testlib.storage.controllers import ClusterStateController
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.storage_object_info import StorageObjectInfo
@@ -21,6 +21,9 @@ from frostfs_testlib.testing.test_control import wait_for_success
 from frostfs_testlib.utils.file_utils import get_file_hash
 from pytest import FixtureRequest
 
+from ...helpers.container_creation import create_container_with_ape
+from ...helpers.container_request import APE_EVERYONE_ALLOW_ALL, ContainerRequest
+
 logger = logging.getLogger("NeoLogger")
 
 
@@ -41,18 +44,21 @@ class TestFailoverServer(ClusterTestBase):
         self,
         request: FixtureRequest,
         default_wallet: WalletInfo,
+        frostfs_cli: FrostfsCli,
+        cluster: Cluster,
     ) -> list[StorageContainer]:
 
         placement_rule = "REP 2 CBF 2 SELECT 2 FROM *"
-
+        container_request = ContainerRequest(placement_rule, APE_EVERYONE_ALLOW_ALL)
         containers_count = request.param
         results = parallel(
-            [create_container for _ in range(containers_count)],
+            [create_container_with_ape for _ in range(containers_count)],
+            container_request=container_request,
+            frostfs_cli=frostfs_cli,
             wallet=default_wallet,
             shell=self.shell,
+            cluster=cluster,
             endpoint=self.cluster.default_rpc_endpoint,
-            rule=placement_rule,
-            basic_acl=PUBLIC_ACL,
         )
 
         containers = [
@@ -63,17 +69,18 @@ class TestFailoverServer(ClusterTestBase):
 
     @allure.title("[Test] Create container")
     @pytest.fixture()
-    def container(self, default_wallet: WalletInfo) -> StorageContainer:
+    def container(self, default_wallet: WalletInfo, frostfs_cli: FrostfsCli) -> StorageContainer:
         select = len(self.cluster.cluster_nodes)
         placement_rule = f"REP {select - 1} CBF 1 SELECT {select} FROM *"
-        cont_id = create_container(
+        cid = create_container_with_ape(
+            ContainerRequest(placement_rule, APE_EVERYONE_ALLOW_ALL),
+            frostfs_cli,
             default_wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=placement_rule,
-            basic_acl=PUBLIC_ACL,
+            self.shell,
+            self.cluster,
+            self.cluster.default_rpc_endpoint,
         )
-        storage_cont_info = StorageContainerInfo(cont_id, default_wallet)
+        storage_cont_info = StorageContainerInfo(cid, default_wallet)
         return StorageContainer(storage_cont_info, self.shell, self.cluster)
 
     @allure.title("[Class] Create objects")
@@ -92,14 +99,25 @@ class TestFailoverServer(ClusterTestBase):
 
         sizes_weights = [2, 1]
         sizes = sizes_samples + random.choices(sizes_samples, weights=sizes_weights, k=object_count - samples_count)
+        total_objects = len(containers) * object_count
 
-        results = parallel(
-            [container.generate_object for _ in sizes for container in containers],
-            size=itertools.cycle([size.value for size in sizes]),
-        )
+        with reporter.step(f"Upload {total_objects} in total to containers"):
+            results = parallel(
+                [self._generate_files_and_remove_physical_copy for _ in range(total_objects)],
+                container=itertools.cycle(containers),
+                size=itertools.cycle(sizes),
+            )
 
         return [result.result() for result in results]
 
+    def _generate_files_and_remove_physical_copy(self, container: StorageContainer, size: ObjectSize) -> StorageObjectInfo:
+        storage_object = container.generate_object(size.value)
+
+        # Deliberately remove physical copy of the file for this test since it can generate multibytes of test objects
+        os.remove(storage_object.file_path)
+
+        return storage_object
+
     @allure.title("[Test] Create objects and get nodes with object")
     @pytest.fixture()
     def object_and_nodes(self, simple_object_size: ObjectSize, container: StorageContainer) -> tuple[StorageObjectInfo, list[ClusterNode]]:
@@ -127,7 +145,7 @@ class TestFailoverServer(ClusterTestBase):
             parallel(self._verify_object, storage_objects * len(nodes), node=itertools.cycle(nodes))
 
     @allure.title("Full shutdown node")
-    @pytest.mark.parametrize("containers, storage_objects", [(5, 10)], indirect=True)
+    @pytest.mark.parametrize("containers, storage_objects", [(4, 5)], indirect=True)
     def test_complete_node_shutdown(
         self,
         storage_objects: list[StorageObjectInfo],
@@ -221,17 +239,19 @@ class TestFailoverServer(ClusterTestBase):
         self,
         default_wallet: WalletInfo,
         cluster_state_controller: ClusterStateController,
+        frostfs_cli: FrostfsCli,
         simple_file: str,
     ):
         with reporter.step("Create container with full network map"):
             node_count = len(self.cluster.cluster_nodes)
             placement_rule = f"REP {node_count - 2} IN X CBF 2 SELECT {node_count} FROM * AS X"
-            cid = create_container(
+            cid = create_container_with_ape(
+                ContainerRequest(placement_rule, APE_EVERYONE_ALLOW_ALL),
+                frostfs_cli,
                 default_wallet,
                 self.shell,
+                self.cluster,
                 self.cluster.default_rpc_endpoint,
-                rule=placement_rule,
-                basic_acl=PUBLIC_ACL,
             )
 
         with reporter.step("Put object"):
@@ -255,10 +275,4 @@ class TestFailoverServer(ClusterTestBase):
             get_object(default_wallet, cid, oid_2, self.shell, alive_endpoint_with_object)
 
         with reporter.step("Create container on alive node"):
-            create_container(
-                default_wallet,
-                self.shell,
-                alive_endpoint_with_object,
-                rule=placement_rule,
-                basic_acl=PUBLIC_ACL,
-            )
+            create_container(default_wallet, self.shell, alive_endpoint_with_object, placement_rule)

pytest_tests/testsuites/failovers/test_failover_storage.py

@@ -6,10 +6,9 @@ from time import sleep
 import allure
 import pytest
 from frostfs_testlib import reporter
+from frostfs_testlib.clients.s3 import BucketContainerResolver, S3ClientWrapper, VersioningStatus
 from frostfs_testlib.resources.common import MORPH_BLOCK_TIME
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
-from frostfs_testlib.s3 import S3ClientWrapper, VersioningStatus
-from frostfs_testlib.s3.interfaces import BucketContainerResolver
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.steps.cli.container import StorageContainer, StorageContainerInfo, create_container
 from frostfs_testlib.steps.cli.object import get_object, put_object_to_random_node
 from frostfs_testlib.steps.node_management import (
@@ -20,8 +19,6 @@ from frostfs_testlib.steps.node_management import (
     remove_nodes_from_map_morph,
     wait_for_node_to_be_ready,
 )
-from frostfs_testlib.steps.s3 import s3_helper
-from frostfs_testlib.steps.s3.s3_helper import search_nodes_with_bucket
 from frostfs_testlib.storage.cluster import Cluster, ClusterNode, S3Gate, StorageNode
 from frostfs_testlib.storage.controllers import ClusterStateController, ShardsWatcher
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
@@ -34,6 +31,9 @@ from frostfs_testlib.utils.failover_utils import wait_object_replication
 from frostfs_testlib.utils.file_keeper import FileKeeper
 from frostfs_testlib.utils.file_utils import generate_file, get_file_hash
 
+from ...helpers.container_request import REP_2_2_2_PUBLIC, requires_container
+from ...resources.common import S3_POLICY_FILE_LOCATION
+
 logger = logging.getLogger("NeoLogger")
 stopped_nodes: list[StorageNode] = []
 
@@ -52,32 +52,26 @@ class TestFailoverStorage(ClusterTestBase):
     @allure.title("Shutdown and start node (stop_mode={stop_mode})")
     @pytest.mark.parametrize("stop_mode", ["hard", "soft"])
     @pytest.mark.failover_reboot
+    @requires_container(REP_2_2_2_PUBLIC)
     def test_lose_storage_node_host(
         self,
         default_wallet,
         stop_mode: str,
+        container: str,
         require_multiple_hosts,
         simple_object_size: ObjectSize,
         cluster: Cluster,
         cluster_state_controller: ClusterStateController,
     ):
         wallet = default_wallet
-        placement_rule = "REP 2 IN X CBF 2 SELECT 2 FROM * AS X"
         source_file_path = generate_file(simple_object_size.value)
         stopped_hosts_nodes = []
 
-        with reporter.step(f"Create container and put object"):
-            cid = create_container(
-                wallet,
-                shell=self.shell,
-                endpoint=self.cluster.default_rpc_endpoint,
-                rule=placement_rule,
-                basic_acl=PUBLIC_ACL,
-            )
-            oid = put_object_to_random_node(wallet, source_file_path, cid, shell=self.shell, cluster=self.cluster)
+        with reporter.step(f"Put object"):
+            oid = put_object_to_random_node(wallet, source_file_path, container, shell=self.shell, cluster=self.cluster)
 
         with reporter.step(f"Wait for replication and get nodes with object"):
-            nodes_with_object = wait_object_replication(cid, oid, 2, shell=self.shell, nodes=self.cluster.storage_nodes)
+            nodes_with_object = wait_object_replication(container, oid, 2, shell=self.shell, nodes=self.cluster.storage_nodes)
 
         with reporter.step(f"Stop 2 nodes with object and wait replication one by one"):
             for storage_node in random.sample(nodes_with_object, 2):
@@ -87,7 +81,7 @@ class TestFailoverStorage(ClusterTestBase):
                 cluster_state_controller.stop_node_host(cluster_node, stop_mode)
 
                 replicated_nodes = wait_object_replication(
-                    cid,
+                    container,
                     oid,
                     2,
                     shell=self.shell,
@@ -95,22 +89,18 @@ class TestFailoverStorage(ClusterTestBase):
                 )
 
         with reporter.step("Check object data is not corrupted"):
-            got_file_path = get_object(
-                wallet, cid, oid, endpoint=replicated_nodes[0].get_rpc_endpoint(), shell=self.shell
-            )
+            got_file_path = get_object(wallet, container, oid, endpoint=replicated_nodes[0].get_rpc_endpoint(), shell=self.shell)
             assert get_file_hash(source_file_path) == get_file_hash(got_file_path)
 
         with reporter.step("Return all hosts"):
             cluster_state_controller.start_stopped_hosts()
 
         with reporter.step("Check object data is not corrupted"):
-            replicated_nodes = wait_object_replication(cid, oid, 2, shell=self.shell, nodes=self.cluster.storage_nodes)
-            got_file_path = get_object(
-                wallet, cid, oid, shell=self.shell, endpoint=replicated_nodes[0].get_rpc_endpoint()
-            )
+            replicated_nodes = wait_object_replication(container, oid, 2, shell=self.shell, nodes=self.cluster.storage_nodes)
+            got_file_path = get_object(wallet, container, oid, shell=self.shell, endpoint=replicated_nodes[0].get_rpc_endpoint())
             assert get_file_hash(source_file_path) == get_file_hash(got_file_path)
 
-    @pytest.mark.parametrize("s3_policy", ["pytest_tests/resources/files/policy.json"], indirect=True)
+    @pytest.mark.parametrize("s3_policy", [S3_POLICY_FILE_LOCATION], indirect=True)
     @allure.title("Do not ignore unhealthy tree endpoints (s3_client={s3_client})")
     def test_unhealthy_tree(
         self,
@@ -145,13 +135,13 @@ class TestFailoverStorage(ClusterTestBase):
             put_object = s3_client.put_object(bucket, file_path)
             s3_helper.check_objects_in_bucket(s3_client, bucket, expected_objects=[file_name])
 
-        node_bucket = search_nodes_with_bucket(
+        node_bucket = s3_helper.search_nodes_with_bucket(
             cluster=self.cluster,
             bucket_name=bucket,
             wallet=default_wallet,
             shell=self.shell,
             endpoint=self.cluster.storage_nodes[0].get_rpc_endpoint(),
-            bucket_container_resolver=bucket_container_resolver
+            bucket_container_resolver=bucket_container_resolver,
         )[0]
 
         with reporter.step("Turn off all storage nodes except bucket node"):
@@ -282,9 +272,7 @@ class TestEmptyMap(ClusterTestBase):
             cluster_state_controller.stop_services_of_type(StorageNode)
 
         with reporter.step("Remove all nodes from network map"):
-            remove_nodes_from_map_morph(
-                shell=self.shell, cluster=self.cluster, remove_nodes=self.cluster.services(StorageNode)
-            )
+            remove_nodes_from_map_morph(shell=self.shell, cluster=self.cluster, remove_nodes=self.cluster.services(StorageNode))
 
         with reporter.step("Return all storage nodes to network map"):
             self.return_nodes_after_stop_with_check_empty_map(cluster_state_controller)
@@ -465,9 +453,7 @@ class TestStorageDataLoss(ClusterTestBase):
             s3_client.put_object(bucket, complex_object_path)
 
         with reporter.step("Check objects are in bucket"):
-            s3_helper.check_objects_in_bucket(
-                s3_client, bucket, expected_objects=[simple_object_key, complex_object_key]
-            )
+            s3_helper.check_objects_in_bucket(s3_client, bucket, expected_objects=[simple_object_key, complex_object_key])
 
         with reporter.step("Stop storage services on all nodes"):
             cluster_state_controller.stop_services_of_type(StorageNode)
@@ -581,17 +567,13 @@ class TestStorageDataLoss(ClusterTestBase):
                     exception_messages.append(f"Shard {shard} changed status to {status}")
 
         with reporter.step("No related errors should be in log"):
-            if node_under_test.host.is_message_in_logs(
-                message_regex=r"\Wno such file or directory\W", since=test_start_time
-            ):
+            if node_under_test.host.is_message_in_logs(message_regex=r"\Wno such file or directory\W", since=test_start_time):
                 exception_messages.append(f"Node {node_under_test} have shard errors in logs")
 
         with reporter.step("Pass test if no errors found"):
             assert not exception_messages, "\n".join(exception_messages)
 
-    @allure.title(
-        "Loss of one node should trigger use of tree and storage service in another node (s3_client={s3_client})"
-    )
+    @allure.title("Loss of one node should trigger use of tree and storage service in another node (s3_client={s3_client})")
     def test_s3_one_endpoint_loss(
         self,
         bucket,
@@ -613,7 +595,7 @@ class TestStorageDataLoss(ClusterTestBase):
             put_object = s3_client.put_object(bucket, file_path)
             s3_helper.check_objects_in_bucket(s3_client, bucket, expected_objects=[file_name])
 
-    @pytest.mark.parametrize("s3_policy", ["pytest_tests/resources/files/policy.json"], indirect=True)
+    @pytest.mark.parametrize("s3_policy", [S3_POLICY_FILE_LOCATION], indirect=True)
     @allure.title("After Pilorama.db loss on one node object is retrievable (s3_client={s3_client})")
     def test_s3_one_pilorama_loss(
         self,

pytest_tests/testsuites/failovers/test_frostfs_failover_network.py

@@ -6,10 +6,8 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.healthcheck.interfaces import Healthcheck
-from frostfs_testlib.resources.wellknown_acl import EACL_PUBLIC_READ_WRITE, PUBLIC_ACL
 from frostfs_testlib.steps.cli.container import create_container
 from frostfs_testlib.steps.cli.object import get_object, get_object_nodes, neo_go_query_height, put_object, put_object_to_random_node
-from frostfs_testlib.steps.storage_object import delete_objects
 from frostfs_testlib.storage.cluster import ClusterNode
 from frostfs_testlib.storage.controllers import ClusterStateController
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
@@ -20,6 +18,8 @@ from frostfs_testlib.testing.parallel import parallel
 from frostfs_testlib.utils.failover_utils import wait_object_replication
 from frostfs_testlib.utils.file_utils import generate_file, get_file_hash
 
+from ...helpers.container_request import PUBLIC_WITH_POLICY, REP_2_2_2_PUBLIC, requires_container
+
 logger = logging.getLogger("NeoLogger")
 STORAGE_NODE_COMMUNICATION_PORT = "8080"
 STORAGE_NODE_COMMUNICATION_PORT_TLS = "8082"
@@ -59,23 +59,13 @@ class TestFailoverNetwork(ClusterTestBase):
     def storage_objects(
         self,
         simple_object_size: ObjectSize,
+        container: str,
         default_wallet: WalletInfo,
     ) -> list[StorageObjectInfo]:
 
         file_path = generate_file(simple_object_size.value)
         file_hash = get_file_hash(file_path)
 
-        with reporter.step("Create container"):
-            placement_rule = "REP 1 CBF 1"
-            cid = create_container(
-                wallet=default_wallet,
-                shell=self.shell,
-                endpoint=self.cluster.default_rpc_endpoint,
-                rule=placement_rule,
-                await_mode=True,
-                basic_acl=EACL_PUBLIC_READ_WRITE,
-            )
-
         storage_objects = []
 
         with reporter.step("Put object"):
@@ -83,12 +73,12 @@ class TestFailoverNetwork(ClusterTestBase):
                 oid = put_object_to_random_node(
                     wallet=default_wallet,
                     path=file_path,
-                    cid=cid,
+                    cid=container,
                     shell=self.shell,
                     cluster=self.cluster,
                 )
 
-            storage_object = StorageObjectInfo(cid=cid, oid=oid)
+            storage_object = StorageObjectInfo(cid=container, oid=oid)
             storage_object.size = simple_object_size.value
             storage_object.wallet = default_wallet
             storage_object.file_path = file_path
@@ -100,9 +90,11 @@ class TestFailoverNetwork(ClusterTestBase):
         return storage_objects
 
     @allure.title("Block Storage node traffic")
+    @requires_container(REP_2_2_2_PUBLIC)
     def test_block_storage_node_traffic(
         self,
         default_wallet: WalletInfo,
+        container: str,
         require_multiple_hosts,
         simple_object_size: ObjectSize,
         cluster_state_controller: ClusterStateController,
@@ -111,21 +103,13 @@ class TestFailoverNetwork(ClusterTestBase):
         Block storage nodes traffic using iptables and wait for replication for objects.
         """
         wallet = default_wallet
-        placement_rule = "REP 2 IN X CBF 2 SELECT 2 FROM * AS X"
         wakeup_node_timeout = 10  # timeout to let nodes detect that traffic has blocked
         nodes_to_block_count = 2
 
         source_file_path = generate_file(simple_object_size.value)
-        cid = create_container(
-            wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=placement_rule,
-            basic_acl=PUBLIC_ACL,
-        )
-        oid = put_object_to_random_node(wallet, source_file_path, cid, shell=self.shell, cluster=self.cluster)
+        oid = put_object_to_random_node(wallet, source_file_path, container, self.shell, self.cluster)
 
-        nodes = wait_object_replication(cid, oid, 2, shell=self.shell, nodes=self.cluster.storage_nodes)
+        nodes = wait_object_replication(container, oid, 2, self.shell, self.cluster.storage_nodes)
 
         logger.info(f"Nodes are {nodes}")
         nodes_to_block = nodes
@@ -147,7 +131,7 @@ class TestFailoverNetwork(ClusterTestBase):
 
                 with reporter.step(f"Check object is not stored on node {node}"):
                     new_nodes = wait_object_replication(
-                        cid,
+                        container,
                         oid,
                         2,
                         shell=self.shell,
@@ -156,7 +140,7 @@ class TestFailoverNetwork(ClusterTestBase):
                     assert node.storage_node not in new_nodes
 
                 with reporter.step("Check object data is not corrupted"):
-                    got_file_path = get_object(wallet, cid, oid, endpoint=new_nodes[0].get_rpc_endpoint(), shell=self.shell)
+                    got_file_path = get_object(wallet, container, oid, endpoint=new_nodes[0].get_rpc_endpoint(), shell=self.shell)
                     assert get_file_hash(source_file_path) == get_file_hash(got_file_path)
 
         with reporter.step(f"Unblock incoming traffic"):
@@ -170,13 +154,14 @@ class TestFailoverNetwork(ClusterTestBase):
                     sleep(wakeup_node_timeout)
 
         with reporter.step("Check object data is not corrupted"):
-            new_nodes = wait_object_replication(cid, oid, 2, shell=self.shell, nodes=self.cluster.storage_nodes)
+            new_nodes = wait_object_replication(container, oid, 2, shell=self.shell, nodes=self.cluster.storage_nodes)
 
-            got_file_path = get_object(wallet, cid, oid, shell=self.shell, endpoint=new_nodes[0].get_rpc_endpoint())
+            got_file_path = get_object(wallet, container, oid, shell=self.shell, endpoint=new_nodes[0].get_rpc_endpoint())
             assert get_file_hash(source_file_path) == get_file_hash(got_file_path)
 
     @pytest.mark.interfaces
     @allure.title("Block DATA interface node")
+    @requires_container(PUBLIC_WITH_POLICY("REP 1 CBF 1", short_name="REP 1 CBF 1"))
     def test_block_data_interface(
         self,
         cluster_state_controller: ClusterStateController,
@@ -208,7 +193,7 @@ class TestFailoverNetwork(ClusterTestBase):
             self.tick_epochs(1, alive_node=nodes_without_an_object[0].storage_node, wait_block=2)
 
         with reporter.step("Get object for target nodes to data interfaces, expect false"):
-            with pytest.raises(RuntimeError, match="can't create API client: can't init SDK client: gRPC dial: context deadline exceeded"):
+            with pytest.raises(RuntimeError, match="can't create API client: can't init SDK client: context (deadline exceeded|canceled)"):
                 get_object(
                     wallet=default_wallet,
                     cid=storage_object.cid,
@@ -232,6 +217,7 @@ class TestFailoverNetwork(ClusterTestBase):
 
     @pytest.mark.interfaces
     @allure.title("Block INTERNAL interface node")
+    @requires_container(PUBLIC_WITH_POLICY("REP 1 CBF 1", short_name="REP 1 CBF 1"))
     def test_block_internal_interface(
         self,
         cluster_state_controller: ClusterStateController,
@@ -284,7 +270,7 @@ class TestFailoverNetwork(ClusterTestBase):
                 )
 
         with reporter.step(f"Get object nodes with object, expect true"):
-            input_file = get_object(
+            _ = get_object(
                 wallet=default_wallet,
                 cid=storage_object.cid,
                 oid=storage_object.oid,
@@ -323,6 +309,11 @@ class TestFailoverNetwork(ClusterTestBase):
         block_interface: Interfaces,
         other_interface: Interfaces,
     ):
+        endpoint_id_map = {
+            Interfaces.DATA_O: 0,
+            Interfaces.DATA_1: 1,
+        }
+        endpoint_id = endpoint_id_map[other_interface]
         cluster_nodes = self.cluster.cluster_nodes
         with reporter.step(f"Block {block_interface.value} interfaces"):
             cluster_state_controller.down_interface(cluster_nodes, block_interface.value)
@@ -334,28 +325,27 @@ class TestFailoverNetwork(ClusterTestBase):
             cid = create_container(
                 wallet=default_wallet,
                 shell=self.shell,
-                endpoint=f"{cluster_nodes[0].get_data_interface(other_interface.value)[0]}:8080",
+                endpoint=cluster_nodes[0].storage_node.get_all_rpc_endpoint()[endpoint_id],
                 rule="REP 4 CBF 1",
             )
 
         with reporter.step("Put object"):
             file_path = generate_file(simple_object_size.value)
-
             oid = put_object(
                 wallet=default_wallet,
                 path=file_path,
                 cid=cid,
                 shell=self.shell,
-                endpoint=f"{cluster_nodes[0].get_data_interface(other_interface.value)[0]}:8080",
+                endpoint=cluster_nodes[0].storage_node.get_all_rpc_endpoint()[endpoint_id],
             )
 
         with reporter.step("Get object"):
-            file_get_path = get_object(
+            get_object(
                 wallet=default_wallet,
                 cid=cid,
                 oid=oid,
                 shell=self.shell,
-                endpoint=f"{cluster_nodes[0].get_data_interface(other_interface.value)[0]}:8080",
+                endpoint=cluster_nodes[0].storage_node.get_all_rpc_endpoint()[endpoint_id],
             )
 
         with reporter.step("Restore interfaces all nodes"):

pytest_tests/testsuites/management/test_node_management.py

@@ -1,7 +1,7 @@
 import logging
 import random
 from time import sleep
-from typing import Callable, Optional, Tuple
+from typing import Callable, Optional
 
 import allure
 import pytest
@@ -10,7 +10,6 @@ from frostfs_testlib.cli import FrostfsCli
 from frostfs_testlib.cli.netmap_parser import NetmapParser
 from frostfs_testlib.resources.cli import FROSTFS_CLI_EXEC
 from frostfs_testlib.resources.error_patterns import OBJECT_NOT_FOUND
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
 from frostfs_testlib.steps.cli.container import create_container, search_nodes_with_container
 from frostfs_testlib.steps.cli.object import (
     delete_object,
@@ -37,14 +36,16 @@ from frostfs_testlib.steps.storage_policy import get_nodes_with_object
 from frostfs_testlib.storage.cluster import ClusterNode, StorageNode
 from frostfs_testlib.storage.controllers import ClusterStateController
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
-from frostfs_testlib.storage.dataclasses.storage_object_info import NodeStatus
+from frostfs_testlib.storage.dataclasses.storage_object_info import Interfaces, NodeStatus
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils import string_utils
 from frostfs_testlib.utils.failover_utils import wait_object_replication
 from frostfs_testlib.utils.file_utils import generate_file
 
-from pytest_tests.helpers.utility import wait_for_gc_pass_on_storage_nodes
+from ...helpers.container_creation import create_container_with_ape
+from ...helpers.container_request import APE_EVERYONE_ALLOW_ALL, REP_1_1_1_PUBLIC, ContainerRequest, requires_container
+from ...helpers.utility import wait_for_gc_pass_on_storage_nodes
 
 logger = logging.getLogger("NeoLogger")
 check_nodes: list[StorageNode] = []
@@ -55,26 +56,16 @@ check_nodes: list[StorageNode] = []
 @pytest.mark.order(10)
 class TestNodeManagement(ClusterTestBase):
     @pytest.fixture
-    @allure.title("Create container and pick the node with data")
-    def create_container_and_pick_node(self, default_wallet: WalletInfo, simple_object_size: ObjectSize) -> Tuple[str, StorageNode]:
+    @allure.title("Pick the node with data")
+    def node_with_data(self, container: str, default_wallet: WalletInfo, simple_object_size: ObjectSize) -> StorageNode:
         file_path = generate_file(simple_object_size.value)
-        placement_rule = "REP 1 IN X CBF 1 SELECT 1 FROM * AS X"
-        endpoint = self.cluster.default_rpc_endpoint
+        oid = put_object_to_random_node(default_wallet, file_path, container, self.shell, self.cluster)
 
-        cid = create_container(
-            default_wallet,
-            shell=self.shell,
-            endpoint=endpoint,
-            rule=placement_rule,
-            basic_acl=PUBLIC_ACL,
-        )
-        oid = put_object_to_random_node(default_wallet, file_path, cid, self.shell, self.cluster)
-
-        nodes = get_nodes_with_object(cid, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
+        nodes = get_nodes_with_object(container, oid, shell=self.shell, nodes=self.cluster.storage_nodes)
         assert len(nodes) == 1
         node = nodes[0]
 
-        yield cid, node
+        yield node
 
         shards = node_shard_list(node)
         assert shards
@@ -126,6 +117,7 @@ class TestNodeManagement(ClusterTestBase):
         self,
         default_wallet: WalletInfo,
         simple_object_size: ObjectSize,
+        frostfs_cli: FrostfsCli,
         return_nodes_after_test_run,
     ):
         """
@@ -147,20 +139,16 @@ class TestNodeManagement(ClusterTestBase):
         exclude_node_from_network_map(random_node, alive_node, shell=self.shell, cluster=self.cluster)
         delete_node_data(random_node)
 
-        cid = create_container(
-            wallet,
-            rule=placement_rule_3,
-            basic_acl=PUBLIC_ACL,
-            shell=self.shell,
-            endpoint=alive_node.get_rpc_endpoint(),
-        )
-        oid = put_object(
-            wallet,
-            source_file_path,
-            cid,
-            shell=self.shell,
-            endpoint=alive_node.get_rpc_endpoint(),
+        cid = create_container_with_ape(
+            ContainerRequest(placement_rule_3, APE_EVERYONE_ALLOW_ALL),
+            frostfs_cli,
+            default_wallet,
+            self.shell,
+            self.cluster,
+            alive_node.get_rpc_endpoint(),
         )
+
+        oid = put_object(wallet, source_file_path, cid, self.shell, alive_node.get_rpc_endpoint())
         wait_object_replication(cid, oid, 3, shell=self.shell, nodes=storage_nodes)
 
         self.return_nodes(alive_node)
@@ -182,12 +170,13 @@ class TestNodeManagement(ClusterTestBase):
             wait_object_replication(cid, oid, 3, shell=self.shell, nodes=storage_nodes)
 
         with reporter.step("Check container could be created with new node"):
-            cid = create_container(
-                wallet,
-                rule=placement_rule_4,
-                basic_acl=PUBLIC_ACL,
-                shell=self.shell,
-                endpoint=alive_node.get_rpc_endpoint(),
+            cid = create_container_with_ape(
+                ContainerRequest(placement_rule_4, APE_EVERYONE_ALLOW_ALL),
+                frostfs_cli,
+                default_wallet,
+                self.shell,
+                self.cluster,
+                alive_node.get_rpc_endpoint(),
             )
             oid = put_object(
                 wallet,
@@ -231,48 +220,53 @@ class TestNodeManagement(ClusterTestBase):
 
     @pytest.mark.skip(reason="Need to clarify scenario")
     @allure.title("Control Operations with storage nodes")
+    @requires_container(REP_1_1_1_PUBLIC)
     def test_shards(
         self,
-        default_wallet,
-        create_container_and_pick_node,
+        default_wallet: WalletInfo,
+        container: str,
+        node_with_data: StorageNode,
         simple_object_size: ObjectSize,
     ):
         wallet = default_wallet
         file_path = generate_file(simple_object_size.value)
 
-        cid, node = create_container_and_pick_node
-        original_oid = put_object_to_random_node(wallet, file_path, cid, self.shell, self.cluster)
+        original_oid = put_object_to_random_node(wallet, file_path, container, self.shell, self.cluster)
 
         # for mode in ('read-only', 'degraded'):
         for mode in ("degraded",):
-            shards = node_shard_list(node)
+            shards = node_shard_list(node_with_data)
             assert shards
 
             for shard in shards:
-                node_shard_set_mode(node, shard, mode)
+                node_shard_set_mode(node_with_data, shard, mode)
 
-            shards = node_shard_list(node)
+            shards = node_shard_list(node_with_data)
             assert shards
 
+            # TODO: Add match for error
             with pytest.raises(RuntimeError):
-                put_object_to_random_node(wallet, file_path, cid, self.shell, self.cluster)
+                put_object_to_random_node(wallet, file_path, container, self.shell, self.cluster)
 
+            # TODO: Add match for error
             with pytest.raises(RuntimeError):
-                delete_object(wallet, cid, original_oid, self.shell, self.cluster.default_rpc_endpoint)
+                delete_object(wallet, container, original_oid, self.shell, self.cluster.default_rpc_endpoint)
 
-            get_object_from_random_node(wallet, cid, original_oid, self.shell, self.cluster)
+            get_object_from_random_node(wallet, container, original_oid, self.shell, self.cluster)
 
             for shard in shards:
-                node_shard_set_mode(node, shard, "read-write")
+                node_shard_set_mode(node_with_data, shard, "read-write")
 
-            shards = node_shard_list(node)
+            shards = node_shard_list(node_with_data)
             assert shards
 
-            oid = put_object_to_random_node(wallet, file_path, cid, self.shell, self.cluster)
-            delete_object(wallet, cid, oid, self.shell, self.cluster.default_rpc_endpoint)
+            oid = put_object_to_random_node(wallet, file_path, container, self.shell, self.cluster)
+            delete_object(wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint)
 
     @allure.title("Put object with stopped node")
-    def test_stop_node(self, default_wallet, return_nodes_after_test_run, simple_object_size: ObjectSize):
+    def test_stop_node(
+        self, default_wallet: WalletInfo, frostfs_cli: FrostfsCli, return_nodes_after_test_run, simple_object_size: ObjectSize
+    ):
         wallet = default_wallet
         placement_rule = "REP 3 IN X SELECT 4 FROM * AS X"
         source_file_path = generate_file(simple_object_size.value)
@@ -280,16 +274,20 @@ class TestNodeManagement(ClusterTestBase):
         random_node = random.choice(storage_nodes[1:])
         alive_node = random.choice([storage_node for storage_node in storage_nodes if storage_node.id != random_node.id])
 
-        cid = create_container(
-            wallet,
-            rule=placement_rule,
-            basic_acl=PUBLIC_ACL,
-            shell=self.shell,
-            endpoint=random_node.get_rpc_endpoint(),
-        )
+        with reporter.step("Create container from random node endpoint"):
+            cid = create_container_with_ape(
+                ContainerRequest(placement_rule, APE_EVERYONE_ALLOW_ALL),
+                frostfs_cli,
+                default_wallet,
+                self.shell,
+                self.cluster,
+                random_node.get_rpc_endpoint(),
+            )
+
         with reporter.step("Stop the random node"):
             check_nodes.append(random_node)
             random_node.stop_service()
+
         with reporter.step("Try to put an object and expect success"):
             put_object(
                 wallet,
@@ -345,9 +343,11 @@ class TestMaintenanceMode(ClusterTestBase):
     def check_node_status(self, expected_status: NodeStatus, node_under_test: ClusterNode, frostfs_cli: FrostfsCli, rpc_endpoint: str):
         netmap = frostfs_cli.netmap.snapshot(rpc_endpoint).stdout
         all_snapshots = NetmapParser.snapshot_all_nodes(netmap)
-        node_snapshot = [snapshot for snapshot in all_snapshots if node_under_test.host_ip == snapshot.node]
+        node_snapshot = [snapshot for snapshot in all_snapshots if node_under_test.get_interface(Interfaces.MGMT) == snapshot.node]
         if expected_status == NodeStatus.OFFLINE and not node_snapshot:
-            assert node_under_test.host_ip not in netmap, f"{node_under_test} status should be {expected_status}. See netmap:\n{netmap}"
+            assert (
+                node_under_test.get_interface(Interfaces.MGMT) not in netmap
+            ), f"{node_under_test} status should be {expected_status}. See netmap:\n{netmap}"
             return
 
         assert node_snapshot, f"{node_under_test} status should be {expected_status}, but was not in netmap. See netmap:\n{netmap}"
@@ -364,7 +364,7 @@ class TestMaintenanceMode(ClusterTestBase):
         cluster_state_controller: ClusterStateController,
         restore_node_status: list[ClusterNode],
     ):
-        with reporter.step("Create container and create\put object"):
+        with reporter.step("Create container and put object"):
             cid = create_container(
                 wallet=default_wallet,
                 shell=self.shell,
@@ -424,7 +424,6 @@ class TestMaintenanceMode(ClusterTestBase):
             with pytest.raises(RuntimeError, match=node_under_maintenance_error):
                 put_object(default_wallet, file_path, cid, self.shell, endpoint)
 
-    @pytest.mark.sanity
     @allure.title("MAINTENANCE and OFFLINE mode transitions")
     def test_mode_transitions(
         self,

pytest_tests/testsuites/metrics/test_container_metrics.py

@@ -1,122 +1,236 @@
 import math
-import time
 
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.steps.cli.container import create_container, search_nodes_with_container
+from frostfs_testlib.steps.cli.container import delete_container, search_nodes_with_container, wait_for_container_deletion
 from frostfs_testlib.steps.cli.object import delete_object, head_object, put_object_to_random_node
-from frostfs_testlib.steps.metrics import check_metrics_counter, get_metrics_value
+from frostfs_testlib.steps.metrics import calc_metrics_count_from_stdout, check_metrics_counter, get_metrics_value
 from frostfs_testlib.steps.storage_policy import get_nodes_with_object
-from frostfs_testlib.storage.cluster import Cluster
+from frostfs_testlib.storage.cluster import Cluster, ClusterNode
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
-from frostfs_testlib.utils.file_utils import generate_file
+from frostfs_testlib.testing.parallel import parallel
+from frostfs_testlib.utils.file_utils import TestFile, generate_file
+
+from ...helpers.container_request import PUBLIC_WITH_POLICY, REP_2_1_4_PUBLIC, ContainerRequest, requires_container
+from ...helpers.utility import are_numbers_similar
 
 
-@pytest.mark.container
+@pytest.mark.order(-5)
+@pytest.mark.nightly
+@pytest.mark.metrics
 class TestContainerMetrics(ClusterTestBase):
-    @allure.title("Container metrics (obj_size={object_size},policy={policy})")
-    @pytest.mark.parametrize("placement_policy, policy", [("REP 2 IN X CBF 2 SELECT 2 FROM * AS X", "REP"), ("EC 1.1 CBF 1", "EC")])
+    @reporter.step("Put object to container: {cid}")
+    def put_object_parallel(self, file_path: str, wallet: WalletInfo, cid: str):
+        oid = put_object_to_random_node(wallet, file_path, cid, self.shell, self.cluster)
+        return oid
+
+    @reporter.step("Get metrics value from node")
+    def get_metrics_search_by_greps_parallel(self, node: ClusterNode, **greps):
+        try:
+            content_stdout = node.metrics.storage.get_metrics_search_by_greps(greps)
+            return calc_metrics_count_from_stdout(content_stdout)
+        except Exception as e:
+            return None
+
+    @allure.title("Container metrics (obj_size={object_size}, policy={container_request})")
+    @pytest.mark.parametrize(
+        "container_request, copies",
+        [
+            (PUBLIC_WITH_POLICY("REP 2 IN X CBF 2 SELECT 2 FROM * AS X", short_name="REP"), 2),
+            (PUBLIC_WITH_POLICY("EC 1.1 CBF 1", short_name="EC"), 1),
+        ],
+        indirect=["container_request"],
+    )
     def test_container_metrics(
         self,
         object_size: ObjectSize,
         max_object_size: int,
         default_wallet: WalletInfo,
         cluster: Cluster,
-        placement_policy: str,
-        policy: str,
+        copies: int,
+        container: str,
+        test_file: TestFile,
+        container_request: ContainerRequest,
     ):
-        file_path = generate_file(object_size.value)
-        copies = 2 if policy == "REP" else 1
         object_chunks = 1
         link_object = 0
 
-        with reporter.step(f"Create container with policy {placement_policy}"):
-            cid = create_container(default_wallet, self.shell, cluster.default_rpc_endpoint, placement_policy)
-
         if object_size.value > max_object_size:
             object_chunks = math.ceil(object_size.value / max_object_size)
-            link_object = len(search_nodes_with_container(default_wallet, cid, self.shell, cluster.default_rpc_endpoint, cluster))
+            link_object = len(search_nodes_with_container(default_wallet, container, self.shell, cluster.default_rpc_endpoint, cluster))
 
         with reporter.step("Put object to random node"):
-            oid = put_object_to_random_node(
-                wallet=default_wallet,
-                path=file_path,
-                cid=cid,
-                shell=self.shell,
-                cluster=cluster,
-            )
+            oid = put_object_to_random_node(default_wallet, test_file.path, container, self.shell, cluster)
 
         with reporter.step("Get object nodes"):
-            object_storage_nodes = get_nodes_with_object(cid, oid, self.shell, cluster.storage_nodes)
+            object_storage_nodes = get_nodes_with_object(container, oid, self.shell, cluster.storage_nodes)
             object_nodes = [cluster_node for cluster_node in cluster.cluster_nodes if cluster_node.storage_node in object_storage_nodes]
 
         with reporter.step("Check metric appears in node where the object is located"):
             count_metrics = (object_chunks * copies) + link_object
-            if policy == "EC":
+            if container_request.short_name == "EC":
                 count_metrics = (object_chunks * 2) + link_object
-            check_metrics_counter(object_nodes, counter_exp=count_metrics, command="container_objects_total", cid=cid, type="phy")
-            check_metrics_counter(object_nodes, counter_exp=count_metrics, command="container_objects_total", cid=cid, type="logic")
-            check_metrics_counter(object_nodes, counter_exp=copies, command="container_objects_total", cid=cid, type="user")
+            check_metrics_counter(object_nodes, counter_exp=count_metrics, command="container_objects_total", cid=container, type="phy")
+            check_metrics_counter(object_nodes, counter_exp=count_metrics, command="container_objects_total", cid=container, type="logic")
+            check_metrics_counter(object_nodes, counter_exp=copies, command="container_objects_total", cid=container, type="user")
 
         with reporter.step("Delete file, wait until gc remove object"):
-            delete_object(default_wallet, cid, oid, self.shell, cluster.default_rpc_endpoint)
+            delete_object(default_wallet, container, oid, self.shell, cluster.default_rpc_endpoint)
 
         with reporter.step(f"Check container metrics 'the counter should equal {len(object_nodes)}' in object nodes"):
-            check_metrics_counter(object_nodes, counter_exp=len(object_nodes), command="container_objects_total", cid=cid, type="phy")
-            check_metrics_counter(object_nodes, counter_exp=len(object_nodes), command="container_objects_total", cid=cid, type="logic")
-            check_metrics_counter(object_nodes, counter_exp=0, command="container_objects_total", cid=cid, type="user")
+            check_metrics_counter(object_nodes, counter_exp=len(object_nodes), command="container_objects_total", cid=container, type="phy")
+            check_metrics_counter(
+                object_nodes, counter_exp=len(object_nodes), command="container_objects_total", cid=container, type="logic"
+            )
+            check_metrics_counter(object_nodes, counter_exp=0, command="container_objects_total", cid=container, type="user")
 
         with reporter.step("Check metrics(Phy, Logic, User) in each nodes"):
-            # Phy and Logic metrics are 4, because in rule 'CBF 2 SELECT 2 FROM', cbf2*sel2=4
-            expect_metrics = 4 if policy == "REP" else 2
-            check_metrics_counter(cluster.cluster_nodes, counter_exp=expect_metrics, command="container_objects_total", cid=cid, type="phy")
+            # Phy and Logic metrics are x2, because in rule 'CBF 2 SELECT 2 FROM', cbf2*sel2=4
+            expect_metrics = copies * 2
             check_metrics_counter(
-                cluster.cluster_nodes, counter_exp=expect_metrics, command="container_objects_total", cid=cid, type="logic"
+                cluster.cluster_nodes, counter_exp=expect_metrics, command="container_objects_total", cid=container, type="phy"
             )
-            check_metrics_counter(cluster.cluster_nodes, counter_exp=0, command="container_objects_total", cid=cid, type="user")
+            check_metrics_counter(
+                cluster.cluster_nodes, counter_exp=expect_metrics, command="container_objects_total", cid=container, type="logic"
+            )
+            check_metrics_counter(cluster.cluster_nodes, counter_exp=0, command="container_objects_total", cid=container, type="user")
 
-    @allure.title("Container size metrics (obj_size={object_size},policy={policy})")
-    @pytest.mark.parametrize("placement_policy, policy", [("REP 2 IN X CBF 2 SELECT 2 FROM * AS X", "REP"), ("EC 1.1 CBF 1", "EC")])
+    @allure.title("Container size metrics (obj_size={object_size}, policy={container_request})")
+    @requires_container(
+        [PUBLIC_WITH_POLICY("REP 2 IN X CBF 2 SELECT 2 FROM * AS X", short_name="REP"), PUBLIC_WITH_POLICY("EC 1.1 CBF 1", short_name="EC")]
+    )
     def test_container_size_metrics(
         self,
         object_size: ObjectSize,
         default_wallet: WalletInfo,
-        placement_policy: str,
-        policy: str,
+        test_file: TestFile,
+        container: str,
     ):
-        file_path = generate_file(object_size.value)
-
-        with reporter.step(f"Create container with policy {policy}"):
-            cid = create_container(default_wallet, self.shell, self.cluster.default_rpc_endpoint, placement_policy)
-
         with reporter.step("Put object to random node"):
-            oid = put_object_to_random_node(
-                wallet=default_wallet,
-                path=file_path,
-                cid=cid,
-                shell=self.shell,
-                cluster=self.cluster,
-            )
+            oid = put_object_to_random_node(default_wallet, test_file.path, container, self.shell, self.cluster)
 
         with reporter.step("Get object nodes"):
-            object_storage_nodes = get_nodes_with_object(cid, oid, self.shell, self.cluster.storage_nodes)
+            object_storage_nodes = get_nodes_with_object(container, oid, self.shell, self.cluster.storage_nodes)
             object_nodes = [
                 cluster_node for cluster_node in self.cluster.cluster_nodes if cluster_node.storage_node in object_storage_nodes
             ]
 
         with reporter.step("Check metric appears in all node where the object is located"):
             act_metric = sum(
-                [get_metrics_value(node, command="frostfs_node_engine_container_size_bytes", cid=cid) for node in object_nodes]
+                [get_metrics_value(node, command="frostfs_node_engine_container_size_bytes", cid=container) for node in object_nodes]
             )
             assert (act_metric // 2) == object_size.value
 
         with reporter.step("Delete file, wait until gc remove object"):
-            id_tombstone = delete_object(default_wallet, cid, oid, self.shell, self.cluster.default_rpc_endpoint)
-            tombstone = head_object(default_wallet, cid, id_tombstone, self.shell, self.cluster.default_rpc_endpoint)
+            id_tombstone = delete_object(default_wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint)
+            tombstone = head_object(default_wallet, container, id_tombstone, self.shell, self.cluster.default_rpc_endpoint)
 
         with reporter.step(f"Check container size metrics"):
-            act_metric = get_metrics_value(object_nodes[0], command="frostfs_node_engine_container_size_bytes", cid=cid)
+            act_metric = get_metrics_value(object_nodes[0], command="frostfs_node_engine_container_size_bytes", cid=container)
             assert act_metric == int(tombstone["header"]["payloadLength"])
+
+    @allure.title("Container size metrics put {objects_count} objects (obj_size={object_size})")
+    @pytest.mark.parametrize("objects_count", [5, 10, 20])
+    @requires_container(REP_2_1_4_PUBLIC)
+    def test_container_size_metrics_more_objects(
+        self, object_size: ObjectSize, default_wallet: WalletInfo, objects_count: int, container: str
+    ):
+        with reporter.step(f"Put {objects_count} objects"):
+            files_path = [generate_file(object_size.value) for _ in range(objects_count)]
+            futures = parallel(self.put_object_parallel, files_path, wallet=default_wallet, cid=container)
+            oids = [future.result() for future in futures]
+
+        with reporter.step("Check metric appears in all nodes"):
+            metric_values = [
+                get_metrics_value(node, command="frostfs_node_engine_container_size_bytes", cid=container)
+                for node in self.cluster.cluster_nodes
+            ]
+            actual_value = sum(metric_values) // 2  # for policy REP 2, value divide by 2
+            expected_value = object_size.value * objects_count
+            assert are_numbers_similar(
+                actual_value, expected_value, tolerance_percentage=2
+            ), "metric container size bytes value not correct"
+
+        with reporter.step("Delete file, wait until gc remove object"):
+            tombstones_size = 0
+            for oid in oids:
+                tombstone_id = delete_object(default_wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint)
+                tombstone = head_object(default_wallet, container, tombstone_id, self.shell, self.cluster.default_rpc_endpoint)
+                tombstones_size += int(tombstone["header"]["payloadLength"])
+
+        with reporter.step(f"Check container size metrics, 'should be positive in all nodes'"):
+            with reporter.step("Search container nodes"):
+                container_nodes = search_nodes_with_container(
+                    wallet=default_wallet,
+                    cid=container,
+                    shell=self.shell,
+                    endpoint=self.cluster.default_rpc_endpoint,
+                    cluster=self.cluster,
+                )
+            with reporter.step(f"Get metrics value from container nodes"):
+                futures = parallel(get_metrics_value, container_nodes, command="frostfs_node_engine_container_size_bytes", cid=container)
+            metrics_value_nodes = [future.result() for future in futures]
+            for act_metric in metrics_value_nodes:
+                assert act_metric >= 0, "Metrics value is negative"
+
+        with reporter.step(f"Check container size metrics for tombstone"):
+            assert sum(metrics_value_nodes) // len(container_nodes) == tombstones_size, "tomstone size of objects not correct"
+
+    @allure.title("Container metrics (policy={container_request})")
+    @pytest.mark.parametrize(
+        "container_request, copies",
+        [
+            (PUBLIC_WITH_POLICY("REP 2 IN X CBF 2 SELECT 2 FROM * AS X", short_name="REP"), 2),
+            (PUBLIC_WITH_POLICY("EC 1.1 CBF 1", short_name="EC"), 1),
+        ],
+        indirect=["container_request"],
+    )
+    def test_container_metrics_delete_complex_objects(
+        self,
+        complex_object_size: ObjectSize,
+        default_wallet: WalletInfo,
+        cluster: Cluster,
+        copies: int,
+        container: str,
+        container_request: ContainerRequest,
+    ):
+        objects_count = 2
+        metric_name = "frostfs_node_engine_container_objects_total"
+
+        with reporter.step(f"Put {objects_count} objects"):
+            files_path = [generate_file(complex_object_size.value) for _ in range(objects_count)]
+            futures = parallel(self.put_object_parallel, files_path, wallet=default_wallet, cid=container)
+            oids = [future.result() for future in futures]
+
+        with reporter.step(f"Check metrics value in each nodes, should be {objects_count} for 'user'"):
+            check_metrics_counter(
+                cluster.cluster_nodes, counter_exp=objects_count * copies, command=metric_name, cid=container, type="user"
+            )
+
+        with reporter.step("Delete objects and container"):
+            for oid in oids:
+                delete_object(default_wallet, container, oid, self.shell, cluster.default_rpc_endpoint)
+
+            delete_container(default_wallet, container, self.shell, cluster.default_rpc_endpoint)
+
+        with reporter.step("Tick epoch and check container was deleted"):
+            self.tick_epoch()
+            wait_for_container_deletion(default_wallet, container, shell=self.shell, endpoint=cluster.default_rpc_endpoint)
+
+        with reporter.step(f"Check metric {metric_name} in each nodes, should not be show any result"):
+            futures = parallel(self.get_metrics_search_by_greps_parallel, cluster.cluster_nodes, command=metric_name, cid=container)
+            metrics_results = [future.result() for future in futures if future.result() is not None]
+            assert len(metrics_results) == 0, f"Metrics value is not empty in Prometheus, actual value in nodes: {metrics_results}"
+
+        with reporter.step("Check metric 'frostfs_node_engine_container_size_bytes' in each nodes, should not be show any result"):
+            futures = parallel(
+                self.get_metrics_search_by_greps_parallel,
+                cluster.cluster_nodes,
+                command="frostfs_node_engine_container_size_bytes",
+                cid=container,
+            )
+            metrics_results = [future.result() for future in futures if future.result() is not None]
+            assert len(metrics_results) == 0, f"Metrics value is not empty, actual value in nodes: {metrics_results}"

pytest_tests/testsuites/metrics/test_epoch_metrics.py

@@ -0,0 +1,40 @@
+import allure
+from frostfs_testlib.testing import parallel
+import pytest
+from frostfs_testlib import reporter
+from frostfs_testlib.steps.metrics import get_metrics_value
+from frostfs_testlib.storage.cluster import ClusterNode
+from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
+
+
+@pytest.mark.order(-11)
+@pytest.mark.nightly
+@pytest.mark.metrics
+class TestEpochMetrics(ClusterTestBase):
+    @reporter.step("Get metrics value from node: {node}")
+    def get_metrics_search_by_greps_parallel(self, node: ClusterNode, **greps):
+        try:
+            return get_metrics_value(node, parse_from_command=True, **greps)
+        except Exception as e:
+            return None
+
+    @allure.title("Check changes in metric frostfs_node_ir_epoch value")
+    def test_check_increase_epoch_metric(self):
+        metric_name = "frostfs_node_ir_epoch"
+        with reporter.step("Get current value of metric: {metric_name} from each nodes"):
+            futures = parallel(self.get_metrics_search_by_greps_parallel, self.cluster.cluster_nodes, command=metric_name)
+            metrics_results = [future.result() for future in futures if future.result() is not None]
+
+        with reporter.step("Check that the metric values are the same in all nodes"):
+            assert len(set(metrics_results)) == 1, f"Metric {metric_name} values aren't same in all nodes"
+            assert len(metrics_results) == len(self.cluster.cluster_nodes), "Metrics are not available in some nodes"
+        
+        with reporter.step("Tick epoch"):
+            self.tick_epoch(wait_block=2)
+  
+        with reporter.step('Check that metric value increase'):
+            futures = parallel(self.get_metrics_search_by_greps_parallel, self.cluster.cluster_nodes, command=metric_name)
+            new_metrics_results = [future.result() for future in futures if future.result() is not None]
+
+            assert len(set(new_metrics_results)) == 1, f"Metric {metric_name} values aren't same in all nodes"
+            assert new_metrics_results[0] > metrics_results[0], "Metric value doesn't increased"

pytest_tests/testsuites/metrics/test_garbage_collector_metrics.py

@@ -1,11 +1,9 @@
-import random
 import re
 
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.steps.cli.container import create_container
-from frostfs_testlib.steps.cli.object import delete_object, put_object, put_object_to_random_node
+from frostfs_testlib.steps.cli.object import delete_object, put_object_to_random_node
 from frostfs_testlib.steps.metrics import check_metrics_counter, get_metrics_value
 from frostfs_testlib.steps.storage_policy import get_nodes_with_object
 from frostfs_testlib.storage.cluster import Cluster, ClusterNode
@@ -15,7 +13,12 @@ from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.test_control import wait_for_success
 from frostfs_testlib.utils.file_utils import generate_file
 
+from ...helpers.container_request import PUBLIC_WITH_POLICY, requires_container
 
+
+@pytest.mark.order(-9)
+@pytest.mark.nightly
+@pytest.mark.metrics
 class TestGarbageCollectorMetrics(ClusterTestBase):
     @wait_for_success(interval=10)
     def check_metrics_in_node(self, cluster_node: ClusterNode, counter_exp: int, **metrics_greps: str):
@@ -33,9 +36,11 @@ class TestGarbageCollectorMetrics(ClusterTestBase):
         return sum(map(int, result))
 
     @allure.title("Garbage collector expire_at object")
-    def test_garbage_collector_metrics_expire_at_object(self, simple_object_size: ObjectSize, default_wallet: WalletInfo, cluster: Cluster):
+    @requires_container(PUBLIC_WITH_POLICY("REP 2 IN X CBF 2 SELECT 2 FROM * AS X", short_name="REP 2"))
+    def test_garbage_collector_metrics_expire_at_object(
+        self, simple_object_size: ObjectSize, default_wallet: WalletInfo, cluster: Cluster, container: str
+    ):
         file_path = generate_file(simple_object_size.value)
-        placement_policy = "REP 2 IN X CBF 2 SELECT 2 FROM * AS X"
         metrics_step = 1
 
         with reporter.step("Get current garbage collector metrics for each nodes"):
@@ -43,22 +48,19 @@ class TestGarbageCollectorMetrics(ClusterTestBase):
             for node in cluster.cluster_nodes:
                 metrics_counter[node] = get_metrics_value(node, command="frostfs_node_garbage_collector_marked_for_removal_objects_total")
 
-        with reporter.step(f"Create container with policy {placement_policy}"):
-            cid = create_container(default_wallet, self.shell, cluster.default_rpc_endpoint, placement_policy)
-
         with reporter.step("Put object to random node with expire_at"):
             current_epoch = self.get_epoch()
             oid = put_object_to_random_node(
                 default_wallet,
                 file_path,
-                cid,
+                container,
                 self.shell,
                 cluster,
                 expire_at=current_epoch + 1,
             )
 
         with reporter.step("Get object nodes"):
-            object_storage_nodes = get_nodes_with_object(cid, oid, self.shell, cluster.storage_nodes)
+            object_storage_nodes = get_nodes_with_object(container, oid, self.shell, cluster.storage_nodes)
             object_nodes = [cluster_node for cluster_node in cluster.cluster_nodes if cluster_node.storage_node in object_storage_nodes]
 
         with reporter.step("Tick Epoch"):
@@ -76,9 +78,11 @@ class TestGarbageCollectorMetrics(ClusterTestBase):
                 )
 
     @allure.title("Garbage collector delete object")
-    def test_garbage_collector_metrics_deleted_objects(self, simple_object_size: ObjectSize, default_wallet: WalletInfo, cluster: Cluster):
+    @requires_container(PUBLIC_WITH_POLICY("REP 2 IN X CBF 2 SELECT 2 FROM * AS X", short_name="REP 2"))
+    def test_garbage_collector_metrics_deleted_objects(
+        self, simple_object_size: ObjectSize, default_wallet: WalletInfo, cluster: Cluster, container: str
+    ):
         file_path = generate_file(simple_object_size.value)
-        placement_policy = "REP 2 IN X CBF 2 SELECT 2 FROM * AS X"
         metrics_step = 1
 
         with reporter.step("Get current garbage collector metrics for each nodes"):
@@ -86,24 +90,21 @@ class TestGarbageCollectorMetrics(ClusterTestBase):
             for node in cluster.cluster_nodes:
                 metrics_counter[node] = get_metrics_value(node, command="frostfs_node_garbage_collector_deleted_objects_total")
 
-        with reporter.step(f"Create container with policy {placement_policy}"):
-            cid = create_container(default_wallet, self.shell, node.storage_node.get_rpc_endpoint(), placement_policy)
-
         with reporter.step("Put object to random node"):
             oid = put_object_to_random_node(
                 default_wallet,
                 file_path,
-                cid,
+                container,
                 self.shell,
                 cluster,
             )
 
         with reporter.step("Get object nodes"):
-            object_storage_nodes = get_nodes_with_object(cid, oid, self.shell, cluster.storage_nodes)
+            object_storage_nodes = get_nodes_with_object(container, oid, self.shell, cluster.storage_nodes)
             object_nodes = [cluster_node for cluster_node in cluster.cluster_nodes if cluster_node.storage_node in object_storage_nodes]
 
         with reporter.step("Delete file, wait until gc remove object"):
-            delete_object(default_wallet, cid, oid, self.shell, node.storage_node.get_rpc_endpoint())
+            delete_object(default_wallet, container, oid, self.shell, node.storage_node.get_rpc_endpoint())
 
         with reporter.step(f"Check garbage collector metrics 'the counter should increase by {metrics_step}'"):
             for node in object_nodes:

pytest_tests/testsuites/metrics/test_grpc_metrics.py

@@ -18,6 +18,9 @@ from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils.file_utils import generate_file
 
 
+@pytest.mark.order(-6)
+@pytest.mark.nightly
+@pytest.mark.metrics
 class TestGRPCMetrics(ClusterTestBase):
     @pytest.fixture
     def disable_policer(self, cluster_state_controller: ClusterStateController):
@@ -28,15 +31,14 @@ class TestGRPCMetrics(ClusterTestBase):
 
     @allure.title("GRPC metrics container operations")
     def test_grpc_metrics_container_operations(self, default_wallet: WalletInfo, cluster: Cluster):
+        operations_count = 10
         placement_policy = "REP 2 IN X CBF 1 SELECT 4 FROM * AS X"
 
         with reporter.step("Select random node"):
             node = random.choice(cluster.cluster_nodes)
 
         with reporter.step("Get current gRPC metrics for method 'Put'"):
-            metrics_counter_put = get_metrics_value(
-                node, command="grpc_server_handled_total", service="ContainerService", method="Put"
-            )
+            metrics_counter_put = get_metrics_value(node, command="grpc_server_handled_total", service="ContainerService", method="Put")
 
         with reporter.step(f"Create container with policy {placement_policy}"):
             cid = create_container(default_wallet, self.shell, node.storage_node.get_rpc_endpoint(), placement_policy)
@@ -52,17 +54,17 @@ class TestGRPCMetrics(ClusterTestBase):
             )
 
         with reporter.step("Get current gRPC metrics for method 'Get'"):
-            metrics_counter_get = get_metrics_value(
-                node, command="grpc_server_handled_total", service="ContainerService", method="Get"
-            )
+            metrics_counter_get = get_metrics_value(node, command="grpc_server_handled_total", service="ContainerService", method="Get")
 
         with reporter.step(f"Get container"):
-            get_container(default_wallet, cid, self.shell, node.storage_node.get_rpc_endpoint())
+            for _ in range(operations_count):
+                get_container(default_wallet, cid, self.shell, node.storage_node.get_rpc_endpoint())
 
         with reporter.step(f"Check gRPC metrics method=Get, 'the counter should increase by 1'"):
-            metrics_counter_get += 1
+            metrics_counter_get += operations_count
             check_metrics_counter(
                 [node],
+                operator=">=",
                 counter_exp=metrics_counter_get,
                 command="grpc_server_handled_total",
                 service="ContainerService",
@@ -70,17 +72,17 @@ class TestGRPCMetrics(ClusterTestBase):
             )
 
         with reporter.step("Get current gRPC metrics for method 'List'"):
-            metrics_counter_list = get_metrics_value(
-                node, command="grpc_server_handled_total", service="ContainerService", method="List"
-            )
+            metrics_counter_list = get_metrics_value(node, command="grpc_server_handled_total", service="ContainerService", method="List")
 
         with reporter.step(f"Get container list"):
-            list_containers(default_wallet, self.shell, node.storage_node.get_rpc_endpoint())
+            for _ in range(operations_count):
+                list_containers(default_wallet, self.shell, node.storage_node.get_rpc_endpoint())
 
         with reporter.step(f"Check gRPC metrics method=List, 'the counter should increase by 1'"):
-            metrics_counter_list += 1
+            metrics_counter_list += operations_count
             check_metrics_counter(
                 [node],
+                operator=">=",
                 counter_exp=metrics_counter_list,
                 command="grpc_server_handled_total",
                 service="ContainerService",
@@ -89,29 +91,26 @@ class TestGRPCMetrics(ClusterTestBase):
 
     @allure.title("GRPC metrics object operations")
     def test_grpc_metrics_object_operations(
-        self, simple_object_size: ObjectSize, default_wallet: WalletInfo, cluster: Cluster, disable_policer
+        self, simple_object_size: ObjectSize, default_wallet: WalletInfo, cluster: Cluster, container: str, disable_policer
     ):
+        operations_count = 10
         file_path = generate_file(simple_object_size.value)
-        placement_policy = "REP 2 IN X CBF 1 SELECT 4 FROM * AS X"
 
         with reporter.step("Select random node"):
             node = random.choice(cluster.cluster_nodes)
 
-        with reporter.step(f"Create container with policy {placement_policy}"):
-            cid = create_container(default_wallet, self.shell, node.storage_node.get_rpc_endpoint(), placement_policy)
-
         with reporter.step("Get current gRPC metrics for method 'Put'"):
-            metrics_counter_put = get_metrics_value(
-                node, command="grpc_server_handled_total", service="ObjectService", method="Put"
-            )
+            metrics_counter_put = get_metrics_value(node, command="grpc_server_handled_total", service="ObjectService", method="Put")
 
         with reporter.step("Put object to selected node"):
-            oid = put_object(default_wallet, file_path, cid, self.shell, node.storage_node.get_rpc_endpoint())
+            for _ in range(operations_count):
+                oid = put_object(default_wallet, file_path, container, self.shell, node.storage_node.get_rpc_endpoint())
 
-        with reporter.step(f"Check gRPC metrics method 'Put', 'the counter should increase by 1'"):
-            metrics_counter_put += 1
+        with reporter.step(f"Check gRPC metrics method 'Put', 'the counter should increase by {operations_count}'"):
+            metrics_counter_put += operations_count
             check_metrics_counter(
                 [node],
+                operator=">=",
                 counter_exp=metrics_counter_put,
                 command="grpc_server_handled_total",
                 service="ObjectService",
@@ -119,17 +118,17 @@ class TestGRPCMetrics(ClusterTestBase):
             )
 
         with reporter.step("Get current gRPC metrics for method 'Get'"):
-            metrics_counter_get = get_metrics_value(
-                node, command="grpc_server_handled_total", service="ObjectService", method="Get"
-            )
+            metrics_counter_get = get_metrics_value(node, command="grpc_server_handled_total", service="ObjectService", method="Get")
 
         with reporter.step(f"Get object"):
-            get_object(default_wallet, cid, oid, self.shell, node.storage_node.get_rpc_endpoint())
+            for _ in range(operations_count):
+                get_object(default_wallet, container, oid, self.shell, node.storage_node.get_rpc_endpoint())
 
-        with reporter.step(f"Check gRPC metrics method=Get, 'the counter should increase by 1'"):
-            metrics_counter_get += 1
+        with reporter.step(f"Check gRPC metrics method=Get, 'the counter should increase by {operations_count}'"):
+            metrics_counter_get += operations_count
             check_metrics_counter(
                 [node],
+                operator=">=",
                 counter_exp=metrics_counter_get,
                 command="grpc_server_handled_total",
                 service="ObjectService",
@@ -137,17 +136,17 @@ class TestGRPCMetrics(ClusterTestBase):
             )
 
         with reporter.step("Get current gRPC metrics for method 'Search'"):
-            metrics_counter_search = get_metrics_value(
-                node, command="grpc_server_handled_total", service="ObjectService", method="Search"
-            )
+            metrics_counter_search = get_metrics_value(node, command="grpc_server_handled_total", service="ObjectService", method="Search")
 
         with reporter.step(f"Search object"):
-            search_object(default_wallet, cid, self.shell, node.storage_node.get_rpc_endpoint())
+            for _ in range(operations_count):
+                search_object(default_wallet, container, self.shell, node.storage_node.get_rpc_endpoint())
 
-        with reporter.step(f"Check gRPC metrics method=Search, 'the counter should increase by 1'"):
-            metrics_counter_search += 1
+        with reporter.step(f"Check gRPC metrics method=Search, 'the counter should increase by {operations_count}'"):
+            metrics_counter_search += operations_count
             check_metrics_counter(
                 [node],
+                operator=">=",
                 counter_exp=metrics_counter_search,
                 command="grpc_server_handled_total",
                 service="ObjectService",
@@ -155,17 +154,17 @@ class TestGRPCMetrics(ClusterTestBase):
             )
 
         with reporter.step("Get current gRPC metrics for method 'Head'"):
-            metrics_counter_head = get_metrics_value(
-                node, command="grpc_server_handled_total", service="ObjectService", method="Head"
-            )
+            metrics_counter_head = get_metrics_value(node, command="grpc_server_handled_total", service="ObjectService", method="Head")
 
         with reporter.step(f"Head object"):
-            head_object(default_wallet, cid, oid, self.shell, node.storage_node.get_rpc_endpoint())
+            for _ in range(operations_count):
+                head_object(default_wallet, container, oid, self.shell, node.storage_node.get_rpc_endpoint())
 
-        with reporter.step(f"Check gRPC metrics method=Head, 'the counter should increase by 1'"):
-            metrics_counter_head += 1
+        with reporter.step(f"Check gRPC metrics method=Head, 'the counter should increase by {operations_count}'"):
+            metrics_counter_head += operations_count
             check_metrics_counter(
                 [node],
+                operator=">=",
                 counter_exp=metrics_counter_head,
                 command="grpc_server_handled_total",
                 service="ObjectService",
@@ -178,9 +177,7 @@ class TestGRPCMetrics(ClusterTestBase):
             node = random.choice(cluster.cluster_nodes)
 
         with reporter.step("Get current gRPC metrics for Healthcheck"):
-            metrics_counter = get_metrics_value(
-                node, command="grpc_server_handled_total", service="TreeService", method="Healthcheck"
-            )
+            metrics_counter = get_metrics_value(node, command="grpc_server_handled_total", service="TreeService", method="Healthcheck")
 
         with reporter.step("Query Tree healthcheck status"):
             healthcheck.tree_healthcheck(node)
@@ -206,9 +203,7 @@ class TestGRPCMetrics(ClusterTestBase):
             cid = create_container(default_wallet, self.shell, node.storage_node.get_rpc_endpoint(), placement_policy)
 
         with reporter.step("Get current gRPC metrics for Tree List"):
-            metrics_counter = get_metrics_value(
-                node, command="grpc_server_handled_total", service="TreeService", method="TreeList"
-            )
+            metrics_counter = get_metrics_value(node, command="grpc_server_handled_total", service="TreeService", method="TreeList")
 
         with reporter.step("Query Tree List"):
             get_tree_list(default_wallet, cid, self.shell, node.storage_node.get_rpc_endpoint())

pytest_tests/testsuites/metrics/test_logs_metrics.py

@@ -6,7 +6,7 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.steps.metrics import get_metrics_value
-from frostfs_testlib.storage.cluster import Cluster, ClusterNode
+from frostfs_testlib.storage.cluster import ClusterNode
 from frostfs_testlib.storage.controllers.cluster_state_controller import ClusterStateController
 from frostfs_testlib.storage.controllers.state_managers.config_state_manager import ConfigStateManager
 from frostfs_testlib.storage.dataclasses.frostfs_services import StorageNode
@@ -14,6 +14,9 @@ from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.test_control import wait_for_success
 
 
+@pytest.mark.order(-10)
+@pytest.mark.nightly
+@pytest.mark.metrics
 class TestLogsMetrics(ClusterTestBase):
     @pytest.fixture
     def revert_all(self, cluster_state_controller: ClusterStateController):
@@ -32,7 +35,9 @@ class TestLogsMetrics(ClusterTestBase):
         current_time = datetime.now(timezone.utc)
         counter_metrics = get_metrics_value(cluster_node, **metrics_greps)
         counter_logs = self.get_count_logs_by_level(cluster_node, metrics_greps.get("level"), restart_time, current_time, log_priority)
-        assert counter_logs == counter_metrics, f"counter_logs: {counter_logs}, counter_metrics: {counter_metrics} in node: {cluster_node}"
+        assert counter_logs == pytest.approx(
+            counter_metrics, rel=0.02
+        ), f"counter_logs: {counter_logs}, counter_metrics: {counter_metrics} in node: {cluster_node}"
 
     @staticmethod
     def get_count_logs_by_level(cluster_node: ClusterNode, log_level: str, after_time: datetime, until_time: datetime, log_priority: str):
@@ -41,7 +46,7 @@ class TestLogsMetrics(ClusterTestBase):
             logs = cluster_node.host.get_filtered_logs(
                 log_level, unit="frostfs-storage", since=after_time, until=until_time, priority=log_priority
             )
-            result = re.findall(rf"Z\s+{log_level}\s+", logs)
+            result = re.findall(rf":\s+{log_level}\s+", logs)
             count_logs += len(result)
         except RuntimeError as e:
             ...

pytest_tests/testsuites/metrics/test_object_metrics.py

@@ -4,72 +4,74 @@ import re
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.steps.cli.container import create_container, delete_container, search_nodes_with_container
+from frostfs_testlib.steps.cli.container import delete_container, search_nodes_with_container
 from frostfs_testlib.steps.cli.object import delete_object, lock_object, put_object, put_object_to_random_node
 from frostfs_testlib.steps.metrics import check_metrics_counter, get_metrics_value
 from frostfs_testlib.steps.storage_policy import get_nodes_with_object
 from frostfs_testlib.storage.cluster import Cluster, ClusterNode
 from frostfs_testlib.storage.controllers.cluster_state_controller import ClusterStateController
-from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
-from frostfs_testlib.utils.file_utils import generate_file
+from frostfs_testlib.utils.file_utils import TestFile
+
+from ...helpers.container_request import PUBLIC_WITH_POLICY, ContainerRequest, requires_container
 
 
+@pytest.mark.order(-7)
+@pytest.mark.nightly
+@pytest.mark.metrics
 class TestObjectMetrics(ClusterTestBase):
     @allure.title("Object metrics of removed container (obj_size={object_size})")
-    def test_object_metrics_removed_container(self, object_size: ObjectSize, default_wallet: WalletInfo, cluster: Cluster):
-        file_path = generate_file(object_size.value)
-        placement_policy = "REP 2 IN X CBF 2 SELECT 2 FROM * AS X"
-        copies = 2
-
-        with reporter.step(f"Create container with policy {placement_policy}"):
-            cid = create_container(default_wallet, self.shell, cluster.default_rpc_endpoint, placement_policy)
+    @requires_container(PUBLIC_WITH_POLICY("REP 2 IN X CBF 2 SELECT 2 FROM * AS X"))
+    def test_object_metrics_removed_container(self, default_wallet: WalletInfo, cluster: Cluster, container: str, test_file: TestFile):
 
         with reporter.step("Put object to random node"):
-            oid = put_object_to_random_node(default_wallet, file_path, cid, self.shell, cluster)
+            oid = put_object_to_random_node(default_wallet, test_file.path, container, self.shell, cluster)
 
         with reporter.step("Check metric appears in node where the object is located"):
-            object_storage_nodes = get_nodes_with_object(cid, oid, self.shell, cluster.storage_nodes)
+            object_storage_nodes = get_nodes_with_object(container, oid, self.shell, cluster.storage_nodes)
             object_nodes = [cluster_node for cluster_node in cluster.cluster_nodes if cluster_node.storage_node in object_storage_nodes]
 
             check_metrics_counter(
                 object_nodes,
-                counter_exp=copies,
+                counter_exp=2,
                 command="frostfs_node_engine_container_objects_total",
-                cid=cid,
+                cid=container,
                 type="user",
             )
 
         with reporter.step("Delete container"):
-            delete_container(default_wallet, cid, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint)
+            delete_container(default_wallet, container, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint)
 
         with reporter.step("Tick Epoch"):
             self.tick_epochs(epochs_to_tick=2, wait_block=2)
 
         with reporter.step("Check metrics of removed containers doesn't appear in the storage node"):
-            check_metrics_counter(object_nodes, counter_exp=0, command="frostfs_node_engine_container_objects_total", cid=cid, type="user")
-            check_metrics_counter(object_nodes, counter_exp=0, command="frostfs_node_engine_container_size_byte", cid=cid)
+            check_metrics_counter(
+                object_nodes, counter_exp=0, command="frostfs_node_engine_container_objects_total", cid=container, type="user"
+            )
+            check_metrics_counter(object_nodes, counter_exp=0, command="frostfs_node_engine_container_size_byte", cid=container)
 
             for node in object_nodes:
                 all_metrics = node.metrics.storage.get_metrics_search_by_greps(command="frostfs_node_engine_container_size_byte")
-                assert cid not in all_metrics.stdout, "metrics of removed containers shouldn't appear in the storage node"
+                assert container not in all_metrics.stdout, "metrics of removed containers shouldn't appear in the storage node"
 
-    @allure.title("Object metrics, locked object (obj_size={object_size}, policy={placement_policy})")
-    @pytest.mark.parametrize("placement_policy", ["REP 1 IN X CBF 1 SELECT 1 FROM * AS X", "REP 2 IN X CBF 2 SELECT 2 FROM * AS X"])
+    @allure.title("Object metrics, locked object (obj_size={object_size}, policy={container_request})")
+    @requires_container(
+        [
+            PUBLIC_WITH_POLICY("REP 1 IN X CBF 1 SELECT 1 FROM * AS X", short_name="REP 1"),
+            PUBLIC_WITH_POLICY("REP 2 IN X CBF 2 SELECT 2 FROM * AS X", short_name="REP 2"),
+        ]
+    )
     def test_object_metrics_blocked_object(
-        self, object_size: ObjectSize, default_wallet: WalletInfo, cluster: Cluster, placement_policy: str
+        self, default_wallet: WalletInfo, cluster: Cluster, container: str, container_request: ContainerRequest, test_file: TestFile
     ):
-        file_path = generate_file(object_size.value)
-        metric_step = int(re.search(r"REP\s(\d+)", placement_policy).group(1))
-
-        with reporter.step(f"Create container with policy {placement_policy}"):
-            cid = create_container(default_wallet, self.shell, cluster.default_rpc_endpoint, placement_policy)
+        metric_step = int(re.search(r"REP\s(\d+)", container_request.policy).group(1))
 
         with reporter.step("Search container nodes"):
             container_nodes = search_nodes_with_container(
                 wallet=default_wallet,
-                cid=cid,
+                cid=container,
                 shell=self.shell,
                 endpoint=self.cluster.default_rpc_endpoint,
                 cluster=cluster,
@@ -81,7 +83,7 @@ class TestObjectMetrics(ClusterTestBase):
                 objects_metric_counter += get_metrics_value(node, command="frostfs_node_engine_objects_total", type="user")
 
         with reporter.step("Put object to container node"):
-            oid = put_object(default_wallet, file_path, cid, self.shell, container_nodes[0].storage_node.get_rpc_endpoint())
+            oid = put_object(default_wallet, test_file.path, container, self.shell, container_nodes[0].storage_node.get_rpc_endpoint())
 
         with reporter.step(f"Check metric user 'the counter should increase by {metric_step}'"):
             objects_metric_counter += metric_step
@@ -95,12 +97,12 @@ class TestObjectMetrics(ClusterTestBase):
                 container_nodes,
                 counter_exp=metric_step,
                 command="frostfs_node_engine_container_objects_total",
-                cid=cid,
+                cid=container,
                 type="user",
             )
 
         with reporter.step("Delete object"):
-            delete_object(default_wallet, cid, oid, self.shell, self.cluster.default_rpc_endpoint)
+            delete_object(default_wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint)
 
         with reporter.step(f"Check metric user 'the counter should decrease by {metric_step}'"):
             objects_metric_counter -= metric_step
@@ -114,16 +116,16 @@ class TestObjectMetrics(ClusterTestBase):
                 container_nodes,
                 counter_exp=0,
                 command="frostfs_node_engine_container_objects_total",
-                cid=cid,
+                cid=container,
                 type="user",
             )
 
         with reporter.step("Put object and lock it to next epoch"):
-            oid = put_object(default_wallet, file_path, cid, self.shell, container_nodes[0].storage_node.get_rpc_endpoint())
+            oid = put_object(default_wallet, test_file.path, container, self.shell, container_nodes[0].storage_node.get_rpc_endpoint())
             current_epoch = self.get_epoch()
             lock_object(
                 default_wallet,
-                cid,
+                container,
                 oid,
                 self.shell,
                 container_nodes[0].storage_node.get_rpc_endpoint(),
@@ -142,7 +144,7 @@ class TestObjectMetrics(ClusterTestBase):
                 container_nodes,
                 counter_exp=metric_step,
                 command="frostfs_node_engine_container_objects_total",
-                cid=cid,
+                cid=container,
                 type="user",
             )
 
@@ -156,7 +158,7 @@ class TestObjectMetrics(ClusterTestBase):
             )
 
         with reporter.step("Delete object"):
-            delete_object(default_wallet, cid, oid, self.shell, self.cluster.default_rpc_endpoint)
+            delete_object(default_wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint)
 
         with reporter.step(f"Check metric user 'the counter should decrease by {metric_step}'"):
             objects_metric_counter -= metric_step
@@ -170,7 +172,7 @@ class TestObjectMetrics(ClusterTestBase):
                 container_nodes,
                 counter_exp=0,
                 command="frostfs_node_engine_container_objects_total",
-                cid=cid,
+                cid=container,
                 type="user",
             )
 
@@ -178,8 +180,8 @@ class TestObjectMetrics(ClusterTestBase):
             current_epoch = self.get_epoch()
             oid = put_object(
                 default_wallet,
-                file_path,
-                cid,
+                test_file.path,
+                container,
                 self.shell,
                 container_nodes[0].storage_node.get_rpc_endpoint(),
                 expire_at=current_epoch + 1,
@@ -197,7 +199,7 @@ class TestObjectMetrics(ClusterTestBase):
                 container_nodes,
                 counter_exp=metric_step,
                 command="frostfs_node_engine_container_objects_total",
-                cid=cid,
+                cid=container,
                 type="user",
             )
 
@@ -216,31 +218,28 @@ class TestObjectMetrics(ClusterTestBase):
                 container_nodes,
                 counter_exp=0,
                 command="frostfs_node_engine_container_objects_total",
-                cid=cid,
+                cid=container,
                 type="user",
             )
 
     @allure.title("Object metrics, stop the node (obj_size={object_size})")
+    @requires_container(PUBLIC_WITH_POLICY("REP 2 IN X CBF 2 SELECT 2 FROM * AS X", short_name="REP 2"))
     def test_object_metrics_stop_node(
         self,
-        object_size: ObjectSize,
         default_wallet: WalletInfo,
         cluster_state_controller: ClusterStateController,
+        container: str,
+        test_file: TestFile,
     ):
-        placement_policy = "REP 2 IN X CBF 2 SELECT 2 FROM * AS X"
-        file_path = generate_file(object_size.value)
         copies = 2
 
-        with reporter.step(f"Create container with policy {placement_policy}"):
-            cid = create_container(default_wallet, self.shell, self.cluster.default_rpc_endpoint, placement_policy)
-
         with reporter.step(f"Check object metrics in container 'should be zero'"):
             check_metrics_counter(
                 self.cluster.cluster_nodes,
                 counter_exp=0,
                 command="frostfs_node_engine_container_objects_total",
                 type="user",
-                cid=cid,
+                cid=container,
             )
 
         with reporter.step("Get current metrics for each nodes"):
@@ -249,10 +248,10 @@ class TestObjectMetrics(ClusterTestBase):
                 objects_metric_counter[node] = get_metrics_value(node, command="frostfs_node_engine_objects_total", type="user")
 
         with reporter.step("Put object"):
-            oid = put_object(default_wallet, file_path, cid, self.shell, self.cluster.default_rpc_endpoint)
+            oid = put_object(default_wallet, test_file.path, container, self.shell, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Get object nodes"):
-            object_storage_nodes = get_nodes_with_object(cid, oid, self.shell, self.cluster.storage_nodes)
+            object_storage_nodes = get_nodes_with_object(container, oid, self.shell, self.cluster.storage_nodes)
             object_nodes = [
                 cluster_node for cluster_node in self.cluster.cluster_nodes if cluster_node.storage_node in object_storage_nodes
             ]
@@ -265,7 +264,7 @@ class TestObjectMetrics(ClusterTestBase):
                 counter_exp=copies,
                 command="frostfs_node_engine_container_objects_total",
                 type="user",
-                cid=cid,
+                cid=container,
             )
 
         with reporter.step(f"Select node to stop"):
@@ -289,5 +288,5 @@ class TestObjectMetrics(ClusterTestBase):
                 counter_exp=copies,
                 command="frostfs_node_engine_container_objects_total",
                 type="user",
-                cid=cid,
+                cid=container,
             )

pytest_tests/testsuites/metrics/test_shard_metrics.py

@@ -5,8 +5,6 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.resources.error_patterns import OBJECT_NOT_FOUND
-from frostfs_testlib.resources.wellknown_acl import EACL_PUBLIC_READ_WRITE
-from frostfs_testlib.steps.cli.container import create_container
 from frostfs_testlib.steps.cli.object import get_object, put_object
 from frostfs_testlib.steps.metrics import check_metrics_counter
 from frostfs_testlib.steps.node_management import node_shard_list, node_shard_set_mode
@@ -18,7 +16,12 @@ from frostfs_testlib.testing import parallel, wait_for_success
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils.file_utils import generate_file
 
+from ...helpers.container_request import PUBLIC_WITH_POLICY, requires_container
 
+
+@pytest.mark.order(-8)
+@pytest.mark.nightly
+@pytest.mark.metrics
 class TestShardMetrics(ClusterTestBase):
     @pytest.fixture()
     @allure.title("Get two shards for set mode")
@@ -73,9 +76,7 @@ class TestShardMetrics(ClusterTestBase):
             data_path = node.storage_node.get_data_directory()
             all_datas = node_shell.exec(f"ls -la {data_path}/data | awk '{{ print $9 }}'").stdout.strip()
             for data_dir in all_datas.replace(".", "").strip().split("\n"):
-                check_dir = node_shell.exec(
-                    f" [ -d {data_path}/data/{data_dir}/data/{oid_path} ] && echo 1 || echo 0"
-                ).stdout
+                check_dir = node_shell.exec(f" [ -d {data_path}/data/{data_dir}/data/{oid_path} ] && echo 1 || echo 0").stdout
                 if "1" in check_dir:
                     object_path = f"{data_path}/data/{data_dir}/data/{oid_path}"
                     object_name = f"{oid[4:]}.{cid}"
@@ -128,34 +129,22 @@ class TestShardMetrics(ClusterTestBase):
                 )
 
     @allure.title("Metric for error count on shard")
+    @requires_container(PUBLIC_WITH_POLICY("REP 1 CBF 1", short_name="REP 1"))
     def test_shard_metrics_error_count(
-        self, max_object_size: int, default_wallet: WalletInfo, cluster: Cluster, revert_all_shards_mode
+        self, max_object_size: int, default_wallet: WalletInfo, cluster: Cluster, container: str, revert_all_shards_mode
     ):
         file_path = generate_file(round(max_object_size * 0.8))
 
-        with reporter.step(f"Create container"):
-            cid = create_container(
-                wallet=default_wallet,
-                shell=self.shell,
-                endpoint=cluster.default_rpc_endpoint,
-                rule="REP 1 CBF 1",
-                basic_acl=EACL_PUBLIC_READ_WRITE,
-            )
-
         with reporter.step("Put object"):
-            oid = put_object(default_wallet, file_path, cid, self.shell, cluster.default_rpc_endpoint)
+            oid = put_object(default_wallet, file_path, container, self.shell, cluster.default_rpc_endpoint)
 
         with reporter.step("Get object nodes"):
-            object_storage_nodes = get_nodes_with_object(cid, oid, self.shell, cluster.storage_nodes)
-            object_nodes = [
-                cluster_node
-                for cluster_node in cluster.cluster_nodes
-                if cluster_node.storage_node in object_storage_nodes
-            ]
+            object_storage_nodes = get_nodes_with_object(container, oid, self.shell, cluster.storage_nodes)
+            object_nodes = [cluster_node for cluster_node in cluster.cluster_nodes if cluster_node.storage_node in object_storage_nodes]
             node = random.choice(object_nodes)
 
         with reporter.step("Search object in system."):
-            object_path, object_name = self.get_object_path_and_name_file(oid, cid, node)
+            object_path, object_name = self.get_object_path_and_name_file(oid, container, node)
 
         with reporter.step("Block read file"):
             node.host.get_shell().exec(f"chmod a-r {object_path}/{object_name}")
@@ -164,7 +153,7 @@ class TestShardMetrics(ClusterTestBase):
             with pytest.raises(RuntimeError, match=OBJECT_NOT_FOUND):
                 get_object(
                     wallet=default_wallet,
-                    cid=cid,
+                    cid=container,
                     oid=oid,
                     shell=self.shell,
                     endpoint=node.storage_node.get_rpc_endpoint(),

pytest_tests/testsuites/object/test_object_api.py

@@ -5,6 +5,7 @@ import sys
 import allure
 import pytest
 from frostfs_testlib import reporter
+from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
 from frostfs_testlib.resources.error_patterns import (
     INVALID_LENGTH_SPECIFIER,
     INVALID_OFFSET_SPECIFIER,
@@ -14,7 +15,7 @@ from frostfs_testlib.resources.error_patterns import (
     OUT_OF_RANGE,
 )
 from frostfs_testlib.shell import Shell
-from frostfs_testlib.steps.cli.container import create_container, search_nodes_with_container
+from frostfs_testlib.steps.cli.container import DEFAULT_EC_PLACEMENT_RULE, DEFAULT_PLACEMENT_RULE, search_nodes_with_container
 from frostfs_testlib.steps.cli.object import (
     get_object_from_random_node,
     get_range,
@@ -33,12 +34,16 @@ from frostfs_testlib.storage.dataclasses.policy import PlacementPolicy
 from frostfs_testlib.storage.dataclasses.storage_object_info import StorageObjectInfo
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
-from frostfs_testlib.utils.file_utils import generate_file, get_file_content, get_file_hash
+from frostfs_testlib.utils.file_utils import TestFile, get_file_content, get_file_hash
+
+from ...helpers.container_creation import create_container_with_ape
+from ...helpers.container_request import APE_EVERYONE_ALLOW_ALL, ContainerRequest
 
 logger = logging.getLogger("NeoLogger")
 
 CLEANUP_TIMEOUT = 10
 COMMON_ATTRIBUTE = {"common_key": "common_value"}
+COMMON_CONTAINER_RULE = "REP 1 IN X CBF 1 SELECT 1 FROM * AS X"
 # Will upload object for each attribute set
 OBJECT_ATTRIBUTES = [
     None,
@@ -54,9 +59,7 @@ RANGE_MAX_LEN = 500
 STATIC_RANGES = {}
 
 
-def generate_ranges(
-    storage_object: StorageObjectInfo, max_object_size: int, shell: Shell, cluster: Cluster
-) -> list[(int, int)]:
+def generate_ranges(storage_object: StorageObjectInfo, max_object_size: int, shell: Shell, cluster: Cluster) -> list[(int, int)]:
     file_range_step = storage_object.size / RANGES_COUNT
 
     file_ranges = []
@@ -82,7 +85,7 @@ def generate_ranges(
 
     for offset, length in file_ranges:
         range_length = random.randint(RANGE_MIN_LEN, RANGE_MAX_LEN)
-        range_start = random.randint(offset, offset + length)
+        range_start = random.randint(offset, offset + length - 1)
 
         file_ranges_to_test.append((range_start, min(range_length, storage_object.size - range_start)))
 
@@ -92,21 +95,20 @@ def generate_ranges(
 
 
 @pytest.fixture(scope="module")
-def common_container(default_wallet: WalletInfo, client_shell: Shell, cluster: Cluster) -> str:
-    rule = "REP 1 IN X CBF 1 SELECT 1 FROM * AS X"
-    with reporter.step(f"Create container with {rule} and put object"):
-        cid = create_container(default_wallet, client_shell, cluster.default_rpc_endpoint, rule)
-
-    return cid
+def common_container(
+    frostfs_cli: FrostfsCli,
+    default_wallet: WalletInfo,
+    client_shell: Shell,
+    cluster: Cluster,
+    rpc_endpoint: str,
+) -> str:
+    container_request = ContainerRequest(COMMON_CONTAINER_RULE, APE_EVERYONE_ALLOW_ALL)
+    return create_container_with_ape(container_request, frostfs_cli, default_wallet, client_shell, cluster, rpc_endpoint)
 
 
 @pytest.fixture(scope="module")
-def container_nodes(
-    default_wallet: WalletInfo, client_shell: Shell, cluster: Cluster, common_container: str
-) -> list[ClusterNode]:
-    return search_nodes_with_container(
-        default_wallet, common_container, client_shell, cluster.default_rpc_endpoint, cluster
-    )
+def container_nodes(default_wallet: WalletInfo, client_shell: Shell, cluster: Cluster, common_container: str) -> list[ClusterNode]:
+    return search_nodes_with_container(default_wallet, common_container, client_shell, cluster.default_rpc_endpoint, cluster)
 
 
 @pytest.fixture(scope="module")
@@ -123,35 +125,35 @@ def storage_objects(
     client_shell: Shell,
     cluster: Cluster,
     object_size: ObjectSize,
+    test_file_module: TestFile,
+    frostfs_cli: FrostfsCli,
     placement_policy: PlacementPolicy,
+    rpc_endpoint: str,
 ) -> list[StorageObjectInfo]:
-    wallet = default_wallet
-    # Separate containers for complex/simple objects to avoid side-effects
-    cid = create_container(
-        wallet, shell=client_shell, rule=placement_policy.value, endpoint=cluster.default_rpc_endpoint
+    cid = create_container_with_ape(
+        ContainerRequest(placement_policy.value, APE_EVERYONE_ALLOW_ALL), frostfs_cli, default_wallet, client_shell, cluster, rpc_endpoint
     )
 
-    file_path = generate_file(object_size.value)
-    file_hash = get_file_hash(file_path)
-
+    with reporter.step("Generate file"):
+        file_hash = get_file_hash(test_file_module.path)
     storage_objects = []
 
     with reporter.step("Put objects"):
         # We need to upload objects multiple times with different attributes
         for attributes in OBJECT_ATTRIBUTES:
             storage_object_id = put_object_to_random_node(
-                wallet=wallet,
-                path=file_path,
-                cid=cid,
-                shell=client_shell,
-                cluster=cluster,
+                default_wallet,
+                test_file_module.path,
+                cid,
+                client_shell,
+                cluster,
                 attributes=attributes,
             )
 
             storage_object = StorageObjectInfo(cid, storage_object_id)
             storage_object.size = object_size.value
-            storage_object.wallet = wallet
-            storage_object.file_path = file_path
+            storage_object.wallet = default_wallet
+            storage_object.file_path = test_file_module.path
             storage_object.file_hash = file_hash
             storage_object.attributes = attributes
 
@@ -170,6 +172,7 @@ def expected_object_copies(placement_policy: PlacementPolicy) -> int:
     return 4
 
 
+@pytest.mark.nightly
 @pytest.mark.sanity
 @pytest.mark.grpc_api
 class TestObjectApi(ClusterTestBase):
@@ -248,23 +251,26 @@ class TestObjectApi(ClusterTestBase):
             )
             self.check_header_is_presented(head_info, storage_object_2.attributes)
 
-    @allure.title("Head deleted object with --raw arg (obj_size={object_size}, policy={placement_policy})")
-    def test_object_head_raw(self, default_wallet: str, object_size: ObjectSize, placement_policy: PlacementPolicy):
-        with reporter.step("Create container"):
-            cid = create_container(
-                default_wallet, self.shell, self.cluster.default_rpc_endpoint, placement_policy.value
-            )
-
+    @allure.title("Head deleted object with --raw arg (obj_size={object_size}, policy={container_request})")
+    @pytest.mark.parametrize(
+        "container_request",
+        [
+            ContainerRequest(DEFAULT_PLACEMENT_RULE, APE_EVERYONE_ALLOW_ALL, "rep"),
+            ContainerRequest(DEFAULT_EC_PLACEMENT_RULE, APE_EVERYONE_ALLOW_ALL, "ec"),
+        ],
+        indirect=True,
+        ids=["rep", "ec"],
+    )
+    def test_object_head_raw(self, default_wallet: str, container: str, test_file: TestFile):
         with reporter.step("Upload object"):
-            file_path = generate_file(object_size.value)
-            oid = put_object_to_random_node(default_wallet, file_path, cid, self.shell, self.cluster)
+            oid = put_object_to_random_node(default_wallet, test_file.path, container, self.shell, self.cluster)
 
         with reporter.step("Delete object"):
-            delete_object(default_wallet, cid, oid, self.shell, self.cluster.default_rpc_endpoint)
+            delete_object(default_wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Call object head --raw and expect error"):
             with pytest.raises(Exception, match=OBJECT_ALREADY_REMOVED):
-                head_object(default_wallet, cid, oid, self.shell, self.cluster.default_rpc_endpoint, is_raw=True)
+                head_object(default_wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint, is_raw=True)
 
     @allure.title("Search objects by native API (obj_size={object_size}, policy={placement_policy})")
     def test_search_object_api(self, storage_objects: list[StorageObjectInfo]):
@@ -308,57 +314,52 @@ class TestObjectApi(ClusterTestBase):
                 assert sorted(expected_oids) == sorted(result)
 
     @allure.title("Search objects with removed items (obj_size={object_size})")
-    def test_object_search_should_return_tombstone_items(self, default_wallet: WalletInfo, object_size: ObjectSize):
+    @pytest.mark.exclude_sanity
+    def test_object_search_should_return_tombstone_items(
+        self,
+        default_wallet: WalletInfo,
+        container: str,
+        object_size: ObjectSize,
+        rpc_endpoint: str,
+        test_file: TestFile,
+    ):
         """
         Validate object search with removed items
         """
 
-        wallet = default_wallet
-        cid = create_container(wallet, self.shell, self.cluster.default_rpc_endpoint)
-
-        with reporter.step("Upload file"):
-            file_path = generate_file(object_size.value)
-            file_hash = get_file_hash(file_path)
-
+        with reporter.step("Put object to container"):
             storage_object = StorageObjectInfo(
-                cid=cid,
-                oid=put_object_to_random_node(wallet, file_path, cid, self.shell, self.cluster),
+                cid=container,
+                oid=put_object_to_random_node(default_wallet, test_file.path, container, self.shell, self.cluster),
                 size=object_size.value,
-                wallet=wallet,
-                file_path=file_path,
-                file_hash=file_hash,
+                wallet=default_wallet,
+                file_path=test_file.path,
+                file_hash=get_file_hash(test_file.path),
             )
 
         with reporter.step("Search object"):
             # Root Search object should return root object oid
-            result = search_object(wallet, cid, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint, root=True)
-            assert result == [storage_object.oid]
+            result = search_object(default_wallet, container, self.shell, rpc_endpoint, root=True)
+            objects_before_deletion = len(result)
+            assert storage_object.oid in result
 
-        with reporter.step("Delete file"):
+        with reporter.step("Delete object"):
             delete_objects([storage_object], self.shell, self.cluster)
 
         with reporter.step("Search deleted object with --root"):
             # Root Search object should return nothing
-            result = search_object(wallet, cid, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint, root=True)
+            result = search_object(default_wallet, container, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint, root=True)
             assert len(result) == 0
 
         with reporter.step("Search deleted object with --phy should return only tombstones"):
             # Physical Search object should return only tombstones
-            result = search_object(wallet, cid, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint, phy=True)
+            result = search_object(default_wallet, container, self.shell, rpc_endpoint, phy=True)
             assert storage_object.tombstone in result, "Search result should contain tombstone of removed object"
             assert storage_object.oid not in result, "Search result should not contain ObjectId of removed object"
             for tombstone_oid in result:
-                header = head_object(
-                    wallet,
-                    cid,
-                    tombstone_oid,
-                    shell=self.shell,
-                    endpoint=self.cluster.default_rpc_endpoint,
-                )["header"]
-                object_type = header["objectType"]
-                assert (
-                    object_type == "TOMBSTONE"
-                ), f"Object wasn't deleted properly. Found object {tombstone_oid} with type {object_type}"
+                head_info = head_object(default_wallet, container, tombstone_oid, self.shell, rpc_endpoint)
+                object_type = head_info["header"]["objectType"]
+                assert object_type == "TOMBSTONE", f"Object wasn't deleted properly. Found object {tombstone_oid} with type {object_type}"
 
     @allure.title("Get range hash by native API (obj_size={object_size}, policy={placement_policy})")
     @pytest.mark.grpc_api
@@ -419,8 +420,7 @@ class TestObjectApi(ClusterTestBase):
                         range_cut=range_cut,
                     )
                     assert (
-                        get_file_content(file_path, content_len=range_len, mode="rb", offset=range_start)
-                        == range_content
+                        get_file_content(file_path, content_len=range_len, mode="rb", offset=range_start) == range_content
                     ), f"Expected range content to match {range_cut} slice of file payload"
 
     @allure.title("[NEGATIVE] Get invalid range by native API (obj_size={object_size}, policy={placement_policy})")
@@ -438,9 +438,7 @@ class TestObjectApi(ClusterTestBase):
         oids = [storage_object.oid for storage_object in storage_objects[:2]]
         file_size = storage_objects[0].size
 
-        assert (
-            RANGE_MIN_LEN < file_size
-        ), f"Incorrect test setup. File size ({file_size}) is less than RANGE_MIN_LEN ({RANGE_MIN_LEN})"
+        assert RANGE_MIN_LEN < file_size, f"Incorrect test setup. File size ({file_size}) is less than RANGE_MIN_LEN ({RANGE_MIN_LEN})"
 
         file_ranges_to_test: list[tuple(int, int, str)] = [
             # Offset is bigger than the file size, the length is small.
@@ -485,9 +483,7 @@ class TestObjectApi(ClusterTestBase):
         oids = [storage_object.oid for storage_object in storage_objects[:2]]
         file_size = storage_objects[0].size
 
-        assert (
-            RANGE_MIN_LEN < file_size
-        ), f"Incorrect test setup. File size ({file_size}) is less than RANGE_MIN_LEN ({RANGE_MIN_LEN})"
+        assert RANGE_MIN_LEN < file_size, f"Incorrect test setup. File size ({file_size}) is less than RANGE_MIN_LEN ({RANGE_MIN_LEN})"
 
         file_ranges_to_test: list[tuple(int, int, str)] = [
             # Offset is bigger than the file size, the length is small.
@@ -530,9 +526,7 @@ class TestObjectApi(ClusterTestBase):
 
         with reporter.step("Put object to container"):
             container_node = random.choice(container_nodes)
-            oid = put_object(
-                default_wallet, file_path, common_container, self.shell, container_node.storage_node.get_rpc_endpoint()
-            )
+            oid = put_object(default_wallet, file_path, common_container, self.shell, container_node.storage_node.get_rpc_endpoint())
 
         with reporter.step("Get range from container node endpoint"):
             get_range(
@@ -567,9 +561,7 @@ class TestObjectApi(ClusterTestBase):
 
         with reporter.step("Put object to container"):
             container_node = random.choice(container_nodes)
-            oid = put_object(
-                default_wallet, file_path, common_container, self.shell, container_node.storage_node.get_rpc_endpoint()
-            )
+            oid = put_object(default_wallet, file_path, common_container, self.shell, container_node.storage_node.get_rpc_endpoint())
 
         with reporter.step("Get range hash from container node endpoint"):
             get_range_hash(
@@ -595,6 +587,4 @@ class TestObjectApi(ClusterTestBase):
     def check_header_is_presented(self, head_info: dict, object_header: dict) -> None:
         for key_to_check, val_to_check in object_header.items():
             assert key_to_check in head_info["header"]["attributes"], f"Key {key_to_check} is found in {head_object}"
-            assert head_info["header"]["attributes"].get(key_to_check) == str(
-                val_to_check
-            ), f"Value {val_to_check} is equal"
+            assert head_info["header"]["attributes"].get(key_to_check) == str(val_to_check), f"Value {val_to_check} is equal"

pytest_tests/testsuites/object/test_object_api_bearer.py

@@ -2,14 +2,13 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.cli import FrostfsCli
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
+from frostfs_testlib.resources.cli import FROSTFS_CLI_EXEC
 from frostfs_testlib.shell import Shell
 from frostfs_testlib.steps.cli.container import (
     REP_2_FOR_3_NODES_PLACEMENT_RULE,
     SINGLE_PLACEMENT_RULE,
     StorageContainer,
     StorageContainerInfo,
-    create_container,
 )
 from frostfs_testlib.steps.cli.object import delete_object, get_object
 from frostfs_testlib.steps.storage_object import StorageObjectInfo
@@ -17,19 +16,26 @@ from frostfs_testlib.storage.cluster import Cluster
 from frostfs_testlib.storage.dataclasses import ape
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
+from frostfs_testlib.storage.grpc_operations.client_wrappers import CliClientWrapper
+from frostfs_testlib.storage.grpc_operations.interfaces import GrpcClientWrapper
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.test_control import expect_not_raises
 from pytest import FixtureRequest
 
-from pytest_tests.helpers.bearer_token import create_bearer_token
-from pytest_tests.helpers.container_access import assert_full_access_to_container
+from ...helpers.bearer_token import create_bearer_token
+from ...helpers.container_access import assert_full_access_to_container
+from ...helpers.container_creation import create_container_with_ape
+from ...helpers.container_request import ContainerRequest
 
 
 @pytest.fixture(scope="session")
 @allure.title("Create user container for bearer token usage")
-def user_container(default_wallet: WalletInfo, client_shell: Shell, cluster: Cluster, request: FixtureRequest) -> StorageContainer:
-    rule = request.param if "param" in request.__dict__ else SINGLE_PLACEMENT_RULE
-    container_id = create_container(default_wallet, client_shell, cluster.default_rpc_endpoint, rule, PUBLIC_ACL)
+def user_container(
+    frostfs_cli: FrostfsCli, default_wallet: WalletInfo, client_shell: Shell, cluster: Cluster, rpc_endpoint: str, request: FixtureRequest
+) -> StorageContainer:
+    policy = request.param if "param" in request.__dict__ else SINGLE_PLACEMENT_RULE
+    container_request = ContainerRequest(policy)
+    container_id = create_container_with_ape(container_request, frostfs_cli, default_wallet, client_shell, cluster, rpc_endpoint)
 
     # Deliberately using s3gate wallet here to test bearer token
     s3_gate_wallet = WalletInfo.from_node(cluster.s3_gates[0])
@@ -43,6 +49,11 @@ def bearer_token(frostfs_cli: FrostfsCli, temp_directory: str, user_container: S
     return create_bearer_token(frostfs_cli, temp_directory, user_container.get_id(), rule, cluster.default_rpc_endpoint)
 
 
+@pytest.fixture(scope="session")
+def grpc_client_with_other_wallet(client_shell: Shell, other_wallet: WalletInfo) -> GrpcClientWrapper:
+    return CliClientWrapper(FrostfsCli(client_shell, FROSTFS_CLI_EXEC, other_wallet.config_path))
+
+
 @pytest.fixture()
 def storage_objects(
     user_container: StorageContainer,
@@ -62,9 +73,10 @@ def storage_objects(
     return storage_objects
 
 
-@pytest.mark.smoke
+@pytest.mark.nightly
 @pytest.mark.bearer
 @pytest.mark.ape
+@pytest.mark.grpc_api
 class TestObjectApiWithBearerToken(ClusterTestBase):
     @allure.title("Object can be deleted from any node using s3gate wallet with bearer token (obj_size={object_size})")
     @pytest.mark.parametrize(
@@ -122,6 +134,8 @@ class TestObjectApiWithBearerToken(ClusterTestBase):
                         bearer_token,
                     )
 
+    # TODO: Without PATCH operation,
+    # since it requires specific permissions that do not apply when testing all operations at once
     @allure.title("Wildcard APE rule contains all permissions (obj_size={object_size})")
     def test_ape_wildcard_contains_all_rules(
         self,
@@ -130,5 +144,27 @@ class TestObjectApiWithBearerToken(ClusterTestBase):
         bearer_token: str,
     ):
         obj = storage_objects.pop()
-        with reporter.step(f"Assert all operations available with object"):
+        with reporter.step("Assert all operations available with object"):
             assert_full_access_to_container(other_wallet, obj.cid, obj.oid, obj.file_path, self.shell, self.cluster, bearer_token)
+
+    # ^
+    @allure.title("Wildcard APE rule contains PATCH permission (obj_size={object_size})")
+    def test_ape_wildcard_contains_patch_rule(
+        self,
+        grpc_client_with_other_wallet: GrpcClientWrapper,
+        storage_objects: list[StorageObjectInfo],
+        bearer_token: str,
+    ):
+        obj = storage_objects.pop()
+        with reporter.step("Verify patch is available"):
+            patched_oid = grpc_client_with_other_wallet.object.patch(
+                obj.cid,
+                obj.oid,
+                self.cluster.default_rpc_endpoint,
+                ranges=["99:88"],
+                payloads=[obj.file_path],
+                new_attrs="test-attribute=100",
+                bearer=bearer_token,
+                timeout="200s",
+            )
+            assert patched_oid != obj.oid, "OID of patched object must be different from original one"

pytest_tests/testsuites/object/test_object_lifetime.py

@@ -4,52 +4,47 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.resources.error_patterns import OBJECT_NOT_FOUND
-from frostfs_testlib.steps.cli.container import create_container
 from frostfs_testlib.steps.cli.object import get_object_from_random_node, head_object, put_object_to_random_node
 from frostfs_testlib.steps.epoch import get_epoch
-from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
-from frostfs_testlib.utils.file_utils import generate_file, get_file_hash
+from frostfs_testlib.testing.test_control import expect_not_raises
+from frostfs_testlib.utils.file_utils import TestFile
 
-from pytest_tests.helpers.utility import wait_for_gc_pass_on_storage_nodes
+from ...helpers.utility import wait_for_gc_pass_on_storage_nodes
 
 logger = logging.getLogger("NeoLogger")
 
 
+@pytest.mark.nightly
 @pytest.mark.sanity
 @pytest.mark.grpc_api
 class TestObjectApiLifetime(ClusterTestBase):
     @allure.title("Object is removed when lifetime expired (obj_size={object_size})")
-    def test_object_api_lifetime(self, default_wallet: WalletInfo, object_size: ObjectSize):
+    def test_object_api_lifetime(self, container: str, test_file: TestFile, default_wallet: WalletInfo):
         """
         Test object deleted after expiration epoch.
         """
 
         wallet = default_wallet
-        endpoint = self.cluster.default_rpc_endpoint
-        cid = create_container(wallet, self.shell, endpoint)
 
-        file_path = generate_file(object_size.value)
-        file_hash = get_file_hash(file_path)
         epoch = get_epoch(self.shell, self.cluster)
 
-        oid = put_object_to_random_node(wallet, file_path, cid, self.shell, self.cluster, expire_at=epoch + 1)
-        got_file = get_object_from_random_node(wallet, cid, oid, self.shell, self.cluster)
-        assert get_file_hash(got_file) == file_hash
+        oid = put_object_to_random_node(wallet, test_file.path, container, self.shell, self.cluster, expire_at=epoch + 1)
+        with expect_not_raises():
+            head_object(wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Tick two epochs"):
-            for _ in range(2):
-                self.tick_epoch()
+            self.tick_epochs(2)
 
         # Wait for GC, because object with expiration is counted as alive until GC removes it
         wait_for_gc_pass_on_storage_nodes()
 
         with reporter.step("Check object deleted because it expires on epoch"):
             with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
-                head_object(wallet, cid, oid, self.shell, self.cluster.default_rpc_endpoint)
+                head_object(wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint)
             with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
-                get_object_from_random_node(wallet, cid, oid, self.shell, self.cluster)
+                get_object_from_random_node(wallet, container, oid, self.shell, self.cluster)
 
         with reporter.step("Tick additional epoch"):
             self.tick_epoch()
@@ -58,6 +53,6 @@ class TestObjectApiLifetime(ClusterTestBase):
 
         with reporter.step("Check object deleted because it expires on previous epoch"):
             with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
-                head_object(wallet, cid, oid, self.shell, self.cluster.default_rpc_endpoint)
+                head_object(wallet, container, oid, self.shell, self.cluster.default_rpc_endpoint)
             with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
-                get_object_from_random_node(wallet, cid, oid, self.shell, self.cluster)
+                get_object_from_random_node(wallet, container, oid, self.shell, self.cluster)

pytest_tests/testsuites/object/test_object_lock.py

@@ -1,26 +1,23 @@
 import logging
-import re
-from datetime import datetime
 
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.credentials.interfaces import CredentialsProvider, User
+from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
 from frostfs_testlib.resources.common import STORAGE_GC_TIME
 from frostfs_testlib.resources.error_patterns import (
     LIFETIME_REQUIRED,
     LOCK_NON_REGULAR_OBJECT,
     LOCK_OBJECT_EXPIRATION,
     LOCK_OBJECT_REMOVAL,
-    OBJECT_ALREADY_REMOVED,
     OBJECT_IS_LOCKED,
     OBJECT_NOT_FOUND,
 )
 from frostfs_testlib.shell import Shell
-from frostfs_testlib.steps.cli.container import StorageContainer, StorageContainerInfo, create_container
+from frostfs_testlib.steps.cli.container import StorageContainer, StorageContainerInfo
 from frostfs_testlib.steps.cli.object import delete_object, head_object, lock_object
 from frostfs_testlib.steps.complex_object_actions import get_link_object, get_storage_object_chunks
-from frostfs_testlib.steps.epoch import ensure_fresh_epoch, get_epoch, tick_epoch
+from frostfs_testlib.steps.epoch import ensure_fresh_epoch
 from frostfs_testlib.steps.node_management import drop_object
 from frostfs_testlib.steps.storage_object import delete_objects
 from frostfs_testlib.steps.storage_policy import get_nodes_with_object
@@ -32,7 +29,9 @@ from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.test_control import expect_not_raises, wait_for_success
 from frostfs_testlib.utils import datetime_utils
 
-from pytest_tests.helpers.utility import wait_for_gc_pass_on_storage_nodes
+from ...helpers.container_creation import create_container_with_ape
+from ...helpers.container_request import EVERYONE_ALLOW_ALL
+from ...helpers.utility import wait_for_gc_pass_on_storage_nodes
 
 logger = logging.getLogger("NeoLogger")
 
@@ -41,25 +40,15 @@ FIXTURE_OBJECT_LIFETIME = 10
 
 
 @pytest.fixture(scope="module")
-def user_wallet(credentials_provider: CredentialsProvider, cluster: Cluster) -> WalletInfo:
-    with reporter.step("Create user wallet with container"):
-        user = User(f"user_{hex(int(datetime.now().timestamp() * 1000000))}")
-        return credentials_provider.GRPC.provide(user, cluster.cluster_nodes[0])
+def user_container(
+    frostfs_cli: FrostfsCli, default_wallet: WalletInfo, client_shell: Shell, cluster: Cluster, rpc_endpoint: str
+) -> StorageContainer:
+    cid = create_container_with_ape(EVERYONE_ALLOW_ALL, frostfs_cli, default_wallet, client_shell, cluster, rpc_endpoint)
+    return StorageContainer(StorageContainerInfo(cid, default_wallet), client_shell, cluster)
 
 
 @pytest.fixture(scope="module")
-def user_container(user_wallet: WalletInfo, client_shell: Shell, cluster: Cluster):
-    container_id = create_container(user_wallet, shell=client_shell, endpoint=cluster.default_rpc_endpoint)
-    return StorageContainer(StorageContainerInfo(container_id, user_wallet), client_shell, cluster)
-
-
-@pytest.fixture(scope="module")
-def locked_storage_object(
-    user_container: StorageContainer,
-    client_shell: Shell,
-    cluster: Cluster,
-    object_size: ObjectSize,
-):
+def locked_storage_object(user_container: StorageContainer, client_shell: Shell, cluster: Cluster, object_size: ObjectSize):
     """
     Intention of this fixture is to provide storage object which is NOT expected to be deleted during test act phase
     """
@@ -67,9 +56,7 @@ def locked_storage_object(
         current_epoch = ensure_fresh_epoch(client_shell, cluster)
         expiration_epoch = current_epoch + FIXTURE_LOCK_LIFETIME
 
-        storage_object = user_container.generate_object(
-            object_size.value, expire_at=current_epoch + FIXTURE_OBJECT_LIFETIME
-        )
+        storage_object = user_container.generate_object(object_size.value, expire_at=current_epoch + FIXTURE_OBJECT_LIFETIME)
         lock_object_id = lock_object(
             storage_object.wallet,
             storage_object.cid,
@@ -78,59 +65,24 @@ def locked_storage_object(
             cluster.default_rpc_endpoint,
             lifetime=FIXTURE_LOCK_LIFETIME,
         )
-        storage_object.locks = [
-            LockObjectInfo(storage_object.cid, lock_object_id, FIXTURE_LOCK_LIFETIME, expiration_epoch)
-        ]
+        storage_object.locks = [LockObjectInfo(storage_object.cid, lock_object_id, FIXTURE_LOCK_LIFETIME, expiration_epoch)]
 
-    yield storage_object
-
-    with reporter.step("Delete created locked object"):
-        current_epoch = get_epoch(client_shell, cluster)
-        epoch_diff = expiration_epoch - current_epoch + 1
-
-        if epoch_diff > 0:
-            with reporter.step(f"Tick {epoch_diff} epochs"):
-                for _ in range(epoch_diff):
-                    tick_epoch(client_shell, cluster)
-        try:
-            delete_object(
-                storage_object.wallet,
-                storage_object.cid,
-                storage_object.oid,
-                client_shell,
-                cluster.default_rpc_endpoint,
-            )
-        except Exception as ex:
-            ex_message = str(ex)
-            # It's okay if object already removed
-            if not re.search(OBJECT_NOT_FOUND, ex_message) and not re.search(OBJECT_ALREADY_REMOVED, ex_message):
-                raise ex
-            logger.debug(ex_message)
+    return storage_object
 
 
 @wait_for_success(datetime_utils.parse_time(STORAGE_GC_TIME))
 def check_object_not_found(wallet: WalletInfo, cid: str, oid: str, shell: Shell, rpc_endpoint: str):
     with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
-        head_object(
-            wallet,
-            cid,
-            oid,
-            shell,
-            rpc_endpoint,
-        )
+        head_object(wallet, cid, oid, shell, rpc_endpoint)
 
 
 def verify_object_available(wallet: WalletInfo, cid: str, oid: str, shell: Shell, rpc_endpoint: str):
     with expect_not_raises():
-        head_object(
-            wallet,
-            cid,
-            oid,
-            shell,
-            rpc_endpoint,
-        )
+        head_object(wallet, cid, oid, shell, rpc_endpoint)
 
 
+@pytest.mark.nightly
+@pytest.mark.grpc_api
 @pytest.mark.grpc_object_lock
 class TestObjectLockWithGrpc(ClusterTestBase):
     @pytest.fixture()
@@ -142,9 +94,7 @@ class TestObjectLockWithGrpc(ClusterTestBase):
         with reporter.step("Creating locked object"):
             current_epoch = self.get_epoch()
 
-            storage_object = user_container.generate_object(
-                object_size.value, expire_at=current_epoch + FIXTURE_OBJECT_LIFETIME
-            )
+            storage_object = user_container.generate_object(object_size.value, expire_at=current_epoch + FIXTURE_OBJECT_LIFETIME)
             lock_object(
                 storage_object.wallet,
                 storage_object.cid,
@@ -220,9 +170,7 @@ class TestObjectLockWithGrpc(ClusterTestBase):
                 1,
             )
 
-    @allure.title(
-        "Lock must contain valid lifetime or expire_at field: (lifetime={wrong_lifetime}, expire-at={wrong_expire_at})"
-    )
+    @allure.title("Lock must contain valid lifetime or expire_at field: (lifetime={wrong_lifetime}, expire-at={wrong_expire_at})")
     # We operate with only lock object here so no complex object needed in this test
     @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
     @pytest.mark.parametrize(
@@ -675,9 +623,7 @@ class TestObjectLockWithGrpc(ClusterTestBase):
 
         with reporter.step("Generate two objects"):
             for epoch_i in range(2):
-                storage_objects.append(
-                    user_container.generate_object(object_size.value, expire_at=current_epoch + epoch_i + 3)
-                )
+                storage_objects.append(user_container.generate_object(object_size.value, expire_at=current_epoch + epoch_i + 3))
 
         self.tick_epoch()
 

pytest_tests/testsuites/object/test_object_tombstone.py

@@ -0,0 +1,62 @@
+import allure
+import pytest
+from frostfs_testlib import reporter
+from frostfs_testlib.resources.common import EXPIRATION_EPOCH_ATTRIBUTE
+from frostfs_testlib.resources.error_patterns import OBJECT_NOT_FOUND
+from frostfs_testlib.storage.controllers.cluster_state_controller import ClusterStateController
+from frostfs_testlib.storage.controllers.state_managers.config_state_manager import ConfigStateManager
+from frostfs_testlib.storage.dataclasses.frostfs_services import StorageNode
+from frostfs_testlib.storage.grpc_operations.interfaces import GrpcClientWrapper
+from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
+from frostfs_testlib.utils.file_utils import TestFile
+
+
+@pytest.mark.nightly
+@pytest.mark.grpc_api
+class TestObjectTombstone(ClusterTestBase):
+    @pytest.fixture()
+    @allure.title("Change tombstone lifetime")
+    def tombstone_lifetime(self, cluster_state_controller: ClusterStateController, request: pytest.FixtureRequest):
+        config_manager = cluster_state_controller.manager(ConfigStateManager)
+        config_manager.set_on_all_nodes(StorageNode, {"object:delete:tombstone_lifetime": request.param}, True)
+
+        yield f"Tombstone lifetime was changed to {request.param}"
+
+        config_manager.revert_all(True)
+
+    @pytest.mark.parametrize("object_size, tombstone_lifetime", [("simple", 2)], indirect=True)
+    @allure.title("Tombstone object should be removed after expiration")
+    def test_tombstone_lifetime(
+        self,
+        new_epoch: int,
+        container: str,
+        grpc_client: GrpcClientWrapper,
+        test_file: TestFile,
+        rpc_endpoint: str,
+        tombstone_lifetime: str,
+    ):
+        allure.dynamic.description(tombstone_lifetime)
+
+        with reporter.step("Put object"):
+            oid = grpc_client.object.put(test_file.path, container, rpc_endpoint)
+
+        with reporter.step("Remove object"):
+            tombstone_oid = grpc_client.object.delete(container, oid, rpc_endpoint)
+
+        with reporter.step("Get tombstone object lifetime"):
+            tombstone_info = grpc_client.object.head(container, tombstone_oid, rpc_endpoint)
+            tombstone_expiration_epoch = tombstone_info["header"]["attributes"][EXPIRATION_EPOCH_ATTRIBUTE]
+
+        with reporter.step("Tombstone lifetime should be <= 3"):
+            epochs_to_skip = int(tombstone_expiration_epoch) - new_epoch + 1
+            assert epochs_to_skip <= 3
+
+        with reporter.step("Wait for tombstone expiration"):
+            self.tick_epochs(epochs_to_skip)
+
+        with reporter.step("Tombstone should be removed after expiration"):
+            with pytest.raises(RuntimeError, match=OBJECT_NOT_FOUND):
+                grpc_client.object.head(container, tombstone_oid, rpc_endpoint)
+
+            with pytest.raises(RuntimeError, match=OBJECT_NOT_FOUND):
+                grpc_client.object.get(container, tombstone_oid, rpc_endpoint)

pytest_tests/testsuites/object/test_object_without_user.py

@@ -1,5 +1,6 @@
 import logging
 import re
+from typing import Literal
 
 import allure
 import pytest
@@ -7,9 +8,8 @@ from frostfs_testlib import reporter
 from frostfs_testlib.cli import FrostfsCli
 from frostfs_testlib.resources.cli import CLI_DEFAULT_TIMEOUT, FROSTFS_CLI_EXEC
 from frostfs_testlib.resources.error_patterns import OBJECT_IS_LOCKED
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL_F
 from frostfs_testlib.shell import Shell
-from frostfs_testlib.steps.cli.container import create_container
+from frostfs_testlib.shell.interfaces import CommandResult
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.test_control import expect_not_raises
@@ -18,218 +18,192 @@ from frostfs_testlib.utils.file_utils import TestFile, get_file_hash
 logger = logging.getLogger("NeoLogger")
 
 
-@pytest.mark.grpc_without_user
-class TestObjectApiWithoutUser(ClusterTestBase):
-    def _parse_oid(self, stdout: str) -> str:
-        id_str = stdout.strip().split("\n")[-2]
+def parse_oid(response: CommandResult, response_type: Literal["tombstone", "patch"] = None) -> str:
+    if response_type == "tombstone":
+        id_str = response.stdout.split("\n")[1]
         oid = id_str.split(":")[1]
         return oid.strip()
 
-    def _parse_tombstone_oid(self, stdout: str) -> str:
-        id_str = stdout.split("\n")[1]
-        tombstone = id_str.split(":")[1]
-        return tombstone.strip()
+    if response_type == "patch":
+        return response.stdout.split(":")[1].strip()
 
-    @pytest.fixture(scope="function")
-    def public_container(self, default_wallet: WalletInfo) -> str:
-        with reporter.step("Create public container"):
-            cid_public = create_container(
-                default_wallet,
-                self.shell,
-                self.cluster.default_rpc_endpoint,
-                basic_acl=PUBLIC_ACL_F,
-            )
+    id_str = response.stdout.strip().split("\n")[-2]
+    oid = id_str.split(":")[1]
+    return oid.strip()
 
-        return cid_public
 
+@pytest.mark.nightly
+@pytest.mark.grpc_api
+@pytest.mark.grpc_without_user
+class TestObjectApiWithoutUser(ClusterTestBase):
     @pytest.fixture(scope="class")
-    def frostfs_cli(self, client_shell: Shell) -> FrostfsCli:
+    def cli_without_wallet(self, client_shell: Shell) -> FrostfsCli:
         return FrostfsCli(client_shell, FROSTFS_CLI_EXEC)
 
     @allure.title("Get public container by native API with generate private key")
-    def test_get_container_with_generated_key(self, frostfs_cli: FrostfsCli, public_container: str):
+    def test_get_container_with_generated_key(self, cli_without_wallet: FrostfsCli, container: str, rpc_endpoint: str):
         """
         Validate `container get` native API with flag `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("Get container with generate key"):
             with expect_not_raises():
-                frostfs_cli.container.get(rpc_endpoint, cid, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
+                cli_without_wallet.container.get(rpc_endpoint, container, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
 
     @allure.title("Get list containers by native API with generate private key")
-    def test_list_containers_with_generated_key(self, frostfs_cli: FrostfsCli, default_wallet: WalletInfo, public_container: str):
+    def test_list_containers_with_generated_key(
+        self, cli_without_wallet: FrostfsCli, default_wallet: WalletInfo, container: str, rpc_endpoint: str
+    ):
         """
         Validate `container list` native API with flag `--generate-key`.
         """
-
-        rpc_endpoint = self.cluster.default_rpc_endpoint
         owner = default_wallet.get_address_from_json(0)
 
         with reporter.step("List containers with generate key"):
             with expect_not_raises():
-                result = frostfs_cli.container.list(rpc_endpoint, owner=owner, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
+                result = cli_without_wallet.container.list(rpc_endpoint, owner=owner, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
 
         with reporter.step("Expect container in received containers list"):
             containers = result.stdout.split()
-            assert public_container in containers
+            assert container in containers
 
     @allure.title("Get list of public container objects by native API with generate private key")
-    def test_list_objects_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str):
+    def test_list_objects_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, rpc_endpoint: str):
         """
         Validate `container list_objects` native API with flag `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("List objects with generate key"):
             with expect_not_raises():
-                result = frostfs_cli.container.list_objects(rpc_endpoint, cid, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
+                result = cli_without_wallet.container.list_objects(rpc_endpoint, container, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
 
         with reporter.step("Expect empty objects list"):
             objects = result.stdout.split()
             assert len(objects) == 0, objects
 
     @allure.title("Search public container nodes by native API with generate private key")
-    def test_search_nodes_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str):
+    def test_search_nodes_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, rpc_endpoint: str):
         """
         Validate `container search_node` native API with flag `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("Search nodes with generate key"):
             with expect_not_raises():
-                frostfs_cli.container.search_node(rpc_endpoint, cid, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
+                cli_without_wallet.container.search_node(rpc_endpoint, container, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
 
     @allure.title("Put object into public container by native API with generate private key (obj_size={object_size})")
-    def test_put_object_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str, file_path: TestFile):
+    def test_put_object_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
         """
         Validate `object put` into container with public ACL and flag `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("Put object with generate key"):
             with expect_not_raises():
-                result = frostfs_cli.object.put(
+                result = cli_without_wallet.object.put(
                     rpc_endpoint,
-                    cid,
-                    file_path,
+                    container,
+                    test_file,
                     generate_key=True,
                     no_progress=True,
                     timeout=CLI_DEFAULT_TIMEOUT,
                 )
 
-        oid = self._parse_oid(result.stdout)
+        oid = parse_oid(result)
 
         with reporter.step("List objects with generate key"):
-            result = frostfs_cli.container.list_objects(rpc_endpoint, cid, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
+            result = cli_without_wallet.container.list_objects(rpc_endpoint, container, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
 
         with reporter.step("Expect object in received objects list"):
             objects = result.stdout.split()
             assert oid in objects, objects
 
     @allure.title("Get public container object by native API with generate private key (obj_size={object_size})")
-    def test_get_object_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str, file_path: TestFile):
+    def test_get_object_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
         """
         Validate `object get` for container with public ACL and flag `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-        expected_hash = get_file_hash(file_path)
+        expected_hash = get_file_hash(test_file)
 
         with reporter.step("Put object with generate key"):
-            result = frostfs_cli.object.put(
+            result = cli_without_wallet.object.put(
                 rpc_endpoint,
-                cid,
-                file_path,
+                container,
+                test_file,
                 generate_key=True,
                 no_progress=True,
                 timeout=CLI_DEFAULT_TIMEOUT,
             )
 
-        oid = self._parse_oid(result.stdout)
+        oid = parse_oid(result)
 
         with reporter.step("Get object with generate key"):
             with expect_not_raises():
-                frostfs_cli.object.get(
+                cli_without_wallet.object.get(
                     rpc_endpoint,
-                    cid,
+                    container,
                     oid,
-                    file=file_path,
+                    file=test_file,
                     generate_key=True,
                     no_progress=True,
                     timeout=CLI_DEFAULT_TIMEOUT,
                 )
 
-        downloaded_hash = get_file_hash(file_path)
+        downloaded_hash = get_file_hash(test_file)
 
         with reporter.step("Validate downloaded file"):
             assert expected_hash == downloaded_hash
 
     @allure.title("Head public container object by native API with generate private key (obj_size={object_size})")
-    def test_head_object_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str, file_path: TestFile):
+    def test_head_object_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
         """
         Validate `object head` for container with public ACL and flag `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("Put object with generate key"):
-            result = frostfs_cli.object.put(
+            result = cli_without_wallet.object.put(
                 rpc_endpoint,
-                cid,
-                file_path,
+                container,
+                test_file,
                 generate_key=True,
                 no_progress=True,
                 timeout=CLI_DEFAULT_TIMEOUT,
             )
 
-        oid = self._parse_oid(result.stdout)
+        oid = parse_oid(result)
 
         with reporter.step("Head object with generate key"):
             with expect_not_raises():
-                frostfs_cli.object.head(rpc_endpoint, cid, oid, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
+                cli_without_wallet.object.head(rpc_endpoint, container, oid, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
 
     @allure.title("Delete public container object by native API with generate private key (obj_size={object_size})")
-    def test_delete_object_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str, file_path: TestFile):
+    def test_delete_object_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
         """
         Validate `object delete` for container with public ACL and flag `--generate key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("Put object with generate key"):
-            result = frostfs_cli.object.put(
+            result = cli_without_wallet.object.put(
                 rpc_endpoint,
-                cid,
-                file_path,
+                container,
+                test_file,
                 generate_key=True,
                 no_progress=True,
                 timeout=CLI_DEFAULT_TIMEOUT,
             )
 
-        oid = self._parse_oid(result.stdout)
+        oid = parse_oid(result)
 
         with reporter.step("Delete object with generate key"):
             with expect_not_raises():
-                result = frostfs_cli.object.delete(rpc_endpoint, cid, oid, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
+                result = cli_without_wallet.object.delete(rpc_endpoint, container, oid, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
 
-        oid = self._parse_tombstone_oid(result.stdout)
+        oid = parse_oid(result, response_type="tombstone")
 
         with reporter.step("Head object with generate key"):
-            result = frostfs_cli.object.head(
+            result = cli_without_wallet.object.head(
                 rpc_endpoint,
-                cid,
+                container,
                 oid,
                 generate_key=True,
                 timeout=CLI_DEFAULT_TIMEOUT,
@@ -239,33 +213,59 @@ class TestObjectApiWithoutUser(ClusterTestBase):
             object_type = re.search(r"(?<=type: )tombstone", result.stdout, re.IGNORECASE).group()
             assert object_type == "TOMBSTONE", object_type
 
-    @allure.title("Lock public container object by native API with generate private key (obj_size={object_size})")
-    def test_lock_object_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str, file_path: TestFile):
-        """
-        Validate `object lock` for container with public ACL and flag `--generate-key`.
-        Attempt to delete the locked object.
-        """
-
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
+    @allure.title("Patch object in public container with generate private key (obj_size={object_size})")
+    def test_patch_object_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
         with reporter.step("Put object with generate key"):
-            result = frostfs_cli.object.put(
+            result = cli_without_wallet.object.put(
                 rpc_endpoint,
-                cid,
-                file_path,
+                container,
+                test_file,
                 generate_key=True,
                 no_progress=True,
                 timeout=CLI_DEFAULT_TIMEOUT,
             )
 
-        oid = self._parse_oid(result.stdout)
+        oid = parse_oid(result)
+
+        with reporter.step("Patch object with generate key"):
+            with expect_not_raises():
+                result = cli_without_wallet.object.patch(
+                    rpc_endpoint,
+                    container,
+                    oid,
+                    ["0:500"],
+                    [test_file],
+                    generate_key=True,
+                    timeout=CLI_DEFAULT_TIMEOUT,
+                )
+
+            patched_oid = parse_oid(result, response_type="patch")
+            assert oid != patched_oid, "Patched object must have new object id"
+
+    @allure.title("Lock public container object by native API with generate private key (obj_size={object_size})")
+    def test_lock_object_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
+        """
+        Validate `object lock` for container with public ACL and flag `--generate-key`.
+        Attempt to delete the locked object.
+        """
+
+        with reporter.step("Put object with generate key"):
+            result = cli_without_wallet.object.put(
+                rpc_endpoint,
+                container,
+                test_file,
+                generate_key=True,
+                no_progress=True,
+                timeout=CLI_DEFAULT_TIMEOUT,
+            )
+
+        oid = parse_oid(result)
 
         with reporter.step("Lock object with generate key"):
             with expect_not_raises():
-                frostfs_cli.object.lock(
+                cli_without_wallet.object.lock(
                     rpc_endpoint,
-                    cid,
+                    container,
                     oid,
                     generate_key=True,
                     timeout=CLI_DEFAULT_TIMEOUT,
@@ -274,102 +274,93 @@ class TestObjectApiWithoutUser(ClusterTestBase):
 
         with reporter.step("Delete locked object with generate key and expect error"):
             with pytest.raises(Exception, match=OBJECT_IS_LOCKED):
-                frostfs_cli.object.delete(
+                cli_without_wallet.object.delete(
                     rpc_endpoint,
-                    cid,
+                    container,
                     oid,
                     generate_key=True,
                     timeout=CLI_DEFAULT_TIMEOUT,
                 )
 
     @allure.title("Search public container objects by native API with generate private key (obj_size={object_size})")
-    def test_search_object_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str, file_path: TestFile):
+    def test_search_object_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
         """
         Validate `object search` for container with public ACL and flag `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("Put object with generate key"):
-            result = frostfs_cli.object.put(
+            result = cli_without_wallet.object.put(
                 rpc_endpoint,
-                cid,
-                file_path,
+                container,
+                test_file,
                 generate_key=True,
                 no_progress=True,
                 timeout=CLI_DEFAULT_TIMEOUT,
             )
 
-        oid = self._parse_oid(result.stdout)
+        oid = parse_oid(result)
 
         with reporter.step("Object search with generate key"):
             with expect_not_raises():
-                result = frostfs_cli.object.search(rpc_endpoint, cid, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
+                result = cli_without_wallet.object.search(rpc_endpoint, container, generate_key=True, timeout=CLI_DEFAULT_TIMEOUT)
 
         with reporter.step("Expect object in received objects list of container"):
             object_ids = re.findall(r"(\w{43,44})", result.stdout)
             assert oid in object_ids
 
     @allure.title("Get range of public container object by native API with generate private key (obj_size={object_size})")
-    def test_range_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str, file_path: TestFile):
+    def test_range_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
         """
         Validate `object range` for container with public ACL and `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("Put object with generate key"):
-            result = frostfs_cli.object.put(
+            result = cli_without_wallet.object.put(
                 rpc_endpoint,
-                cid,
-                file_path,
+                container,
+                test_file,
                 generate_key=True,
                 no_progress=True,
                 timeout=CLI_DEFAULT_TIMEOUT,
             )
 
-        oid = self._parse_oid(result.stdout)
+        oid = parse_oid(result)
 
         with reporter.step("Get range of object with generate key"):
             with expect_not_raises():
-                frostfs_cli.object.range(
+                cli_without_wallet.object.range(
                     rpc_endpoint,
-                    cid,
+                    container,
                     oid,
                     "0:10",
-                    file=file_path,
+                    file=test_file,
                     generate_key=True,
                     timeout=CLI_DEFAULT_TIMEOUT,
                 )
 
     @allure.title("Get hash of public container object by native API with generate private key (obj_size={object_size})")
-    def test_hash_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str, file_path: TestFile):
+    def test_hash_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
         """
         Validate `object hash` for container with public ACL and `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("Put object with generate key"):
-            result = frostfs_cli.object.put(
+            result = cli_without_wallet.object.put(
                 rpc_endpoint,
-                cid,
-                file_path,
+                container,
+                test_file,
                 generate_key=True,
                 no_progress=True,
                 timeout=CLI_DEFAULT_TIMEOUT,
             )
 
-        oid = self._parse_oid(result.stdout)
+        oid = parse_oid(result)
 
         with reporter.step("Get range hash of object with generate key"):
             with expect_not_raises():
-                frostfs_cli.object.hash(
+                cli_without_wallet.object.hash(
                     rpc_endpoint,
-                    cid,
+                    container,
                     oid,
                     range="0:10",
                     generate_key=True,
@@ -377,37 +368,34 @@ class TestObjectApiWithoutUser(ClusterTestBase):
                 )
 
     @allure.title("Get public container object nodes by native API with generate private key (obj_size={object_size})")
-    def test_nodes_with_generate_key(self, frostfs_cli: FrostfsCli, public_container: str, file_path: TestFile):
+    def test_nodes_with_generate_key(self, cli_without_wallet: FrostfsCli, container: str, test_file: TestFile, rpc_endpoint: str):
         """
         Validate `object nodes` for container with public ACL and `--generate-key`.
         """
 
-        cid = public_container
-        rpc_endpoint = self.cluster.default_rpc_endpoint
-
         with reporter.step("Put object with generate key"):
-            result = frostfs_cli.object.put(
+            result = cli_without_wallet.object.put(
                 rpc_endpoint,
-                cid,
-                file_path,
+                container,
+                test_file,
                 no_progress=True,
                 generate_key=True,
                 timeout=CLI_DEFAULT_TIMEOUT,
             )
 
-        oid = self._parse_oid(result.stdout)
+        oid = parse_oid(result)
 
         with reporter.step("Configure frostfs-cli for alive remote node"):
             alive_node = self.cluster.cluster_nodes[0]
             node_shell = alive_node.host.get_shell()
-            rpc_endpoint = alive_node.storage_node.get_rpc_endpoint()
-            node_frostfs_cli = FrostfsCli(node_shell, FROSTFS_CLI_EXEC)
+            alive_endpoint = alive_node.storage_node.get_rpc_endpoint()
+            node_frostfs_cli_wo_wallet = FrostfsCli(node_shell, FROSTFS_CLI_EXEC)
 
         with reporter.step("Get object nodes with generate key"):
             with expect_not_raises():
-                node_frostfs_cli.object.nodes(
-                    rpc_endpoint,
-                    cid,
+                node_frostfs_cli_wo_wallet.object.nodes(
+                    alive_endpoint,
+                    container,
                     oid=oid,
                     generate_key=True,
                     timeout=CLI_DEFAULT_TIMEOUT,

pytest_tests/testsuites/replication/test_ec_replication.py

@@ -7,10 +7,10 @@ import yaml
 from frostfs_testlib import reporter
 from frostfs_testlib.cli import FrostfsAdm, FrostfsCli
 from frostfs_testlib.cli.netmap_parser import NetmapParser
+from frostfs_testlib.clients import AwsCliClient, S3ClientWrapper
+from frostfs_testlib.clients.s3 import BucketContainerResolver, VersioningStatus
 from frostfs_testlib.resources.cli import CLI_DEFAULT_TIMEOUT, FROSTFS_ADM_CONFIG_PATH, FROSTFS_ADM_EXEC, FROSTFS_CLI_EXEC
 from frostfs_testlib.resources.common import COMPLEX_OBJECT_CHUNKS_COUNT, COMPLEX_OBJECT_TAIL_SIZE, HOSTING_CONFIG_FILE, MORPH_BLOCK_TIME
-from frostfs_testlib.s3 import AwsCliClient, S3ClientWrapper
-from frostfs_testlib.s3.interfaces import BucketContainerResolver, VersioningStatus
 from frostfs_testlib.storage.cluster import Cluster, ClusterNode, StorageNode
 from frostfs_testlib.storage.controllers import ClusterStateController
 from frostfs_testlib.storage.controllers.state_managers.config_state_manager import ConfigStateManager
@@ -20,7 +20,10 @@ from frostfs_testlib.storage.grpc_operations.interfaces import GrpcClientWrapper
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.test_control import wait_for_success
 from frostfs_testlib.utils import datetime_utils
-from frostfs_testlib.utils.file_utils import generate_file, get_file_hash
+from frostfs_testlib.utils.file_utils import TestFile, generate_file, get_file_hash
+
+from ...helpers.container_request import PUBLIC_WITH_POLICY, requires_container
+from ...resources.common import S3_POLICY_FILE_LOCATION
 
 
 def pytest_generate_tests(metafunc: pytest.Metafunc) -> None:
@@ -39,7 +42,8 @@ def pytest_generate_tests(metafunc: pytest.Metafunc) -> None:
         100: ["EC 12.4", "EC 8.4", "EC 5.3", "EC 4.4"],
     }
 
-    metafunc.parametrize("ec_policy, node_count", ((ec_policy, node_count) for ec_policy in ec_map[node_count]))
+    nearest_node_count = ([4] + (list(filter(lambda x: x <= node_count, ec_map.keys()))))[-1]
+    metafunc.parametrize("ec_policy, node_count", ((ec_policy, node_count) for ec_policy in ec_map[nearest_node_count]))
 
 
 @allure.title("Initialized remote FrostfsAdm")
@@ -50,6 +54,7 @@ def frostfs_remote_adm(cluster: Cluster) -> FrostfsAdm:
     return FrostfsAdm(shell, frostfs_adm_exec_path=FROSTFS_ADM_EXEC, config_file=FROSTFS_ADM_CONFIG_PATH)
 
 
+@pytest.mark.nightly
 @pytest.mark.replication
 @pytest.mark.ec_replication
 class TestECReplication(ClusterTestBase):
@@ -138,39 +143,37 @@ class TestECReplication(ClusterTestBase):
         assert len(chunks_nodes) == count
 
     @allure.title("Create container with EC policy (size={object_size})")
-    def test_create_container_with_ec_policy(self, object_size: ObjectSize, rep_count: int, grpc_client: GrpcClientWrapper) -> None:
-        test_file = generate_file(object_size.value)
-
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1", await_mode=True)
-
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1"))
+    def test_create_container_with_ec_policy(
+        self, container: str, rep_count: int, grpc_client: GrpcClientWrapper, remote_grpc_client: GrpcClientWrapper, test_file: TestFile
+    ) -> None:
         with reporter.step("Put object in container."):
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check replication chunks."):
-            assert self.check_replication(rep_count, grpc_client, cid, oid)
+            assert self.check_replication(rep_count, remote_grpc_client, container, oid)
 
     @allure.title("Lose node with chunk data")
     @pytest.mark.failover
+    @requires_container(PUBLIC_WITH_POLICY("EC 3.1"))
     def test_lose_node_with_data_chunk(
         self,
         grpc_client: GrpcClientWrapper,
+        remote_grpc_client: GrpcClientWrapper,
         simple_object_size: ObjectSize,
         cluster_state_controller: ClusterStateController,
+        container: str,
         disable_policer: None,
     ) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 3.1", await_mode=True)
-
         with reporter.step("Put object in container."):
             test_file = generate_file(simple_object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check chunk replication on 4 nodes."):
-            assert self.check_replication(4, grpc_client, cid, oid)
+            assert self.check_replication(4, remote_grpc_client, container, oid)
 
         with reporter.step("Search node data chunk"):
-            chunk = grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, cid, oid=oid)
+            chunk = remote_grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, container, oid=oid)
             chunk_node = grpc_client.object.chunks.get_chunk_node(self.cluster, chunk)
 
         with reporter.step("Stop node with data chunk."):
@@ -178,81 +181,81 @@ class TestECReplication(ClusterTestBase):
 
         with reporter.step("Get object"):
             node = list(set(self.cluster.cluster_nodes) - {chunk_node[0]})[0]
-            grpc_client.object.get(cid, oid, node.storage_node.get_rpc_endpoint())
+            grpc_client.object.get(container, oid, node.storage_node.get_rpc_endpoint())
 
         with reporter.step("Start stopped node, and check replication chunks."):
             cluster_state_controller.start_node_host(chunk_node[0])
-            self.wait_replication(4, grpc_client, cid, oid)
+            self.wait_replication(4, remote_grpc_client, container, oid)
 
     @allure.title("Lose node with chunk parity")
     @pytest.mark.failover
+    @requires_container(PUBLIC_WITH_POLICY("EC 3.1"))
     def test_lose_node_with_parity_chunk(
         self,
         grpc_client: GrpcClientWrapper,
+        remote_grpc_client: GrpcClientWrapper,
         simple_object_size: ObjectSize,
         cluster_state_controller: ClusterStateController,
+        container: str,
         disable_policer: None,
     ) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 3.1", await_mode=True)
-
         with reporter.step("Put object in container."):
             test_file = generate_file(simple_object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check chunk replication on 4 nodes."):
-            assert self.check_replication(4, grpc_client, cid, oid)
+            assert self.check_replication(4, remote_grpc_client, container, oid)
 
         with reporter.step("Search node with parity chunk"):
-            chunk = grpc_client.object.chunks.get_parity(self.cluster.default_rpc_endpoint, cid, oid=oid)
-            chunk_node = grpc_client.object.chunks.get_chunk_node(self.cluster, chunk)[0]
+            chunk = remote_grpc_client.object.chunks.get_parity(self.cluster.default_rpc_endpoint, container, oid=oid)
+            chunk_node = remote_grpc_client.object.chunks.get_chunk_node(self.cluster, chunk)[0]
 
         with reporter.step("Stop node parity chunk."):
             cluster_state_controller.stop_node_host(chunk_node, "hard")
 
         with reporter.step("Get object, expect success."):
             node = list(set(self.cluster.cluster_nodes) - {chunk_node})[0]
-            grpc_client.object.get(cid, oid, node.storage_node.get_rpc_endpoint())
+            grpc_client.object.get(container, oid, node.storage_node.get_rpc_endpoint())
 
         with reporter.step("Start stoped node, and check replication chunks."):
             cluster_state_controller.start_node_host(chunk_node)
-            self.wait_replication(4, grpc_client, cid, oid)
+            self.wait_replication(4, remote_grpc_client, container, oid)
 
     @allure.title("Lose nodes with chunk data and parity")
     @pytest.mark.failover
+    @requires_container(PUBLIC_WITH_POLICY("EC 3.1"))
     def test_lose_nodes_data_chunk_and_parity(
         self,
         grpc_client: GrpcClientWrapper,
+        remote_grpc_client: GrpcClientWrapper,
         simple_object_size: ObjectSize,
         cluster_state_controller: ClusterStateController,
+        container: str,
         disable_policer: None,
     ) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 3.1", await_mode=True)
-
         with reporter.step("Put object in container."):
             test_file = generate_file(simple_object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check count chunks, expect 4."):
-            assert self.check_replication(4, grpc_client, cid, oid)
+            assert self.check_replication(4, remote_grpc_client, container, oid)
 
         with reporter.step("Search node data chunk and node parity chunk"):
-            data_chunk = grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, cid, oid=oid)
-            data_chunk_node = grpc_client.object.chunks.get_chunk_node(self.cluster, data_chunk)[0]
-            parity_chunk = grpc_client.object.chunks.get_parity(self.cluster.default_rpc_endpoint, cid, oid=oid)
-            parity_chunk_node = grpc_client.object.chunks.get_chunk_node(self.cluster, parity_chunk)[0]
+            data_chunk = remote_grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, container, oid=oid)
+            data_chunk_node = remote_grpc_client.object.chunks.get_chunk_node(self.cluster, data_chunk)[0]
+            parity_chunk = remote_grpc_client.object.chunks.get_parity(self.cluster.default_rpc_endpoint, container, oid=oid)
+            parity_chunk_node = remote_grpc_client.object.chunks.get_chunk_node(self.cluster, parity_chunk)[0]
 
         with reporter.step("Stop node with data chunk."):
             cluster_state_controller.stop_node_host(data_chunk_node, "hard")
 
         with reporter.step("Get object"):
             node = list(set(self.cluster.cluster_nodes) - {data_chunk_node, parity_chunk_node})[0]
-            grpc_client.object.get(cid, oid, node.storage_node.get_rpc_endpoint())
+            grpc_client.object.get(container, oid, node.storage_node.get_rpc_endpoint())
 
         with reporter.step("Start stopped host and check chunks."):
             cluster_state_controller.start_node_host(data_chunk_node)
-            self.wait_replication(4, grpc_client, cid, oid)
+            self.wait_replication(4, remote_grpc_client, container, oid)
 
         with reporter.step("Stop node with parity chunk and one all node."):
             cluster_state_controller.stop_node_host(data_chunk_node, "hard")
@@ -260,35 +263,35 @@ class TestECReplication(ClusterTestBase):
 
         with reporter.step("Get object, expect error."):
             with pytest.raises(RuntimeError):
-                grpc_client.object.get(cid, oid, node.storage_node.get_rpc_endpoint())
+                grpc_client.object.get(container, oid, node.storage_node.get_rpc_endpoint())
 
         with reporter.step("Start stopped nodes and check replication chunk."):
             cluster_state_controller.start_stopped_hosts()
-            self.wait_replication(4, grpc_client, cid, oid)
+            self.wait_replication(4, remote_grpc_client, container, oid)
 
     @allure.title("Policer work with chunk")
     @pytest.mark.failover
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1"))
     def test_work_policer_with_nodes(
         self,
         simple_object_size: ObjectSize,
         grpc_client: GrpcClientWrapper,
+        remote_grpc_client: GrpcClientWrapper,
         cluster_state_controller: ClusterStateController,
+        container: str,
         include_excluded_nodes: None,
     ) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1", await_mode=True)
-
         with reporter.step("Put object on container."):
             test_file = generate_file(simple_object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check count chunks nodes on 3."):
-            assert self.check_replication(3, grpc_client, cid, oid)
+            assert self.check_replication(3, remote_grpc_client, container, oid)
 
         with reporter.step("Search node with chunk."):
-            data_chunk = grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, cid, oid=oid)
-            node_data_chunk = grpc_client.object.chunks.get_chunk_node(self.cluster, data_chunk)[0]
-            first_all_chunks = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
+            data_chunk = remote_grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, container, oid=oid)
+            node_data_chunk = remote_grpc_client.object.chunks.get_chunk_node(self.cluster, data_chunk)[0]
+            first_all_chunks = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, container, oid)
 
         with reporter.step("Remove chunk node from network map"):
             cluster_state_controller.remove_node_from_netmap([node_data_chunk.storage_node])
@@ -301,10 +304,10 @@ class TestECReplication(ClusterTestBase):
             node = grpc_client.object.chunks.search_node_without_chunks(
                 first_all_chunks, self.cluster, alive_node.storage_node.get_rpc_endpoint()
             )[0]
-            self.wait_replication(3, grpc_client, cid, oid)
+            self.wait_replication(3, remote_grpc_client, container, oid)
 
         with reporter.step("Get new chunks"):
-            second_all_chunks = grpc_client.object.chunks.get_all(node.storage_node.get_rpc_endpoint(), cid, oid)
+            second_all_chunks = remote_grpc_client.object.chunks.get_all(node.storage_node.get_rpc_endpoint(), container, oid)
 
         with reporter.step("Check that oid no change."):
             assert [chunk for chunk in second_all_chunks if data_chunk.object_id == chunk.object_id]
@@ -312,11 +315,17 @@ class TestECReplication(ClusterTestBase):
         with reporter.step("Include node in netmap"):
             cluster_state_controller.include_node_to_netmap(node_data_chunk.storage_node, alive_node.storage_node)
 
-        self.wait_sync_count_chunks_nodes(grpc_client, cid, oid, 3)
+        self.wait_sync_count_chunks_nodes(remote_grpc_client, container, oid, 3)
 
     @allure.title("EC X.Y combinations (nodes={node_count},policy={ec_policy},size={object_size})")
     def test_create_container_with_difference_count_nodes(
-        self, node_count: int, ec_policy: str, object_size: ObjectSize, grpc_client: GrpcClientWrapper
+        self,
+        frostfs_cli: FrostfsCli,
+        node_count: int,
+        ec_policy: str,
+        object_size: ObjectSize,
+        grpc_client: GrpcClientWrapper,
+        remote_grpc_client: GrpcClientWrapper,
     ) -> None:
         with reporter.step("Create container."):
             expected_chunks = int(ec_policy.split(" ")[1].split(".")[0]) + int(ec_policy.split(" ")[1].split(".")[1])
@@ -324,12 +333,20 @@ class TestECReplication(ClusterTestBase):
                 expected_chunks *= 4
             cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy=ec_policy, await_mode=True)
 
+        with reporter.step("Apply Ape rule for container"):
+            frostfs_cli.ape_manager.add(
+                self.cluster.default_rpc_endpoint, chain_id="allowAll", target_name=cid, target_type="container", rule="allow Object.* *"
+            )
+
+        with reporter.step("Wait for one block"):
+            self.wait_for_blocks()
+
         with reporter.step("Put object in container."):
             test_file = generate_file(object_size.value)
             oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check count object chunks."):
-            chunks = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
+            chunks = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
             assert len(chunks) == expected_chunks
 
         with reporter.step("get object and check hash."):
@@ -337,64 +354,66 @@ class TestECReplication(ClusterTestBase):
             assert get_file_hash(test_file) == get_file_hash(file_with_node)
 
     @allure.title("Request PUT with copies_number flag")
-    def test_put_object_with_copies_number(self, grpc_client: GrpcClientWrapper, simple_object_size: ObjectSize) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1", await_mode=True)
-
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1"))
+    def test_put_object_with_copies_number(
+        self, container: str, grpc_client: GrpcClientWrapper, remote_grpc_client: GrpcClientWrapper, simple_object_size: ObjectSize
+    ) -> None:
         with reporter.step("Put object in container with copies number = 1"):
             test_file = generate_file(simple_object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint, copies_number=1)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint, copies_number=1)
 
         with reporter.step("Check that count chunks > 1."):
-            chunks = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
+            chunks = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, container, oid)
             assert len(chunks) > 1
 
     @allure.title("Request PUT and 1 node off")
     @pytest.mark.failover
+    @requires_container(PUBLIC_WITH_POLICY("EC 3.1"))
     def test_put_object_with_off_cnr_node(
-        self, grpc_client: GrpcClientWrapper, cluster_state_controller: ClusterStateController, simple_object_size: ObjectSize
+        self,
+        container: str,
+        grpc_client: GrpcClientWrapper,
+        cluster_state_controller: ClusterStateController,
+        simple_object_size: ObjectSize,
     ) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 3.1", await_mode=True)
-
         with reporter.step("Stop one node in container nodes"):
             cluster_state_controller.stop_node_host(self.cluster.cluster_nodes[1], "hard")
 
         with reporter.step("Put object in container, expect success for EC container."):
             test_file = generate_file(simple_object_size.value)
-            grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint, copies_number=1)
+            grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint, copies_number=1)
 
     @allure.title("Request PUT (size={object_size})")
-    def test_put_object_with_ec_cnr(self, grpc_client: GrpcClientWrapper, object_size: ObjectSize) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1", await_mode=True)
-
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1"))
+    def test_put_object_with_ec_cnr(
+        self, container: str, grpc_client: GrpcClientWrapper, remote_grpc_client: GrpcClientWrapper, object_size: ObjectSize
+    ) -> None:
         with reporter.step("Put object in container"):
             test_file = generate_file(object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Get chunks object."):
-            chunks = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
+            chunks = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, container, oid)
 
         with reporter.step("Check header chunks object"):
             for chunk in chunks:
                 chunk_head = grpc_client.object.head(
-                    cid, chunk.object_id, self.cluster.default_rpc_endpoint, is_raw=True, json_output=False
+                    container, chunk.object_id, self.cluster.default_rpc_endpoint, is_raw=True, json_output=False
                 ).stdout
                 assert "EC header:" in chunk_head
 
     @allure.title("Request GET (size={object_size})")
-    def test_get_object_in_ec_cnr(self, grpc_client: GrpcClientWrapper, object_size: ObjectSize) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1 CBF 1", await_mode=True)
-
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1 CBF 1"))
+    def test_get_object_in_ec_cnr(
+        self, container: str, grpc_client: GrpcClientWrapper, remote_grpc_client: GrpcClientWrapper, object_size: ObjectSize
+    ) -> None:
         with reporter.step("Put object in container"):
             test_file = generate_file(object_size.value)
             hash_origin_file = get_file_hash(test_file)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Get id all chunks."):
-            chunks = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
+            chunks = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, container, oid)
 
         with reporter.step("Search chunk node and not chunks node."):
             chunk_node = grpc_client.object.chunks.get_chunk_node(self.cluster, chunks[0])[0]
@@ -403,88 +422,89 @@ class TestECReplication(ClusterTestBase):
             ]
 
         with reporter.step("GET request with chunk node, expect success"):
-            file_one = grpc_client.object.get(cid, oid, chunk_node.storage_node.get_rpc_endpoint())
+            file_one = grpc_client.object.get(container, oid, chunk_node.storage_node.get_rpc_endpoint())
             hash_file_one = get_file_hash(file_one)
             assert hash_file_one == hash_origin_file
 
         with reporter.step("Get request with not chunk node"):
-            file_two = grpc_client.object.get(cid, oid, not_chunk_node.storage_node.get_rpc_endpoint())
+            file_two = grpc_client.object.get(container, oid, not_chunk_node.storage_node.get_rpc_endpoint())
             hash_file_two = get_file_hash(file_two)
             assert hash_file_two == hash_file_one == hash_origin_file
 
     @allure.title("Request SEARCH with flags 'root' (size={object_size})")
-    def test_search_object_in_ec_cnr_root_flags(self, grpc_client: GrpcClientWrapper, object_size: ObjectSize) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1", await_mode=True)
-
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1"))
+    def test_search_object_in_ec_cnr_root_flags(self, container: str, grpc_client: GrpcClientWrapper, object_size: ObjectSize) -> None:
         with reporter.step("Put object in container"):
             test_file = generate_file(object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Search operation with --root flags"):
-            search_output = grpc_client.object.search(cid, self.cluster.default_rpc_endpoint, root=True)
+            search_output = grpc_client.object.search(container, self.cluster.default_rpc_endpoint, root=True)
             assert search_output[0] == oid
 
     @allure.title("Request SEARCH check valid chunk id (size={object_size})")
-    def test_search_object_in_ec_cnr_chunk_id(self, grpc_client: GrpcClientWrapper, object_size: ObjectSize) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1", await_mode=True)
-
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1"))
+    def test_search_object_in_ec_cnr_chunk_id(
+        self, container: str, grpc_client: GrpcClientWrapper, remote_grpc_client: GrpcClientWrapper, object_size: ObjectSize
+    ) -> None:
         with reporter.step("Put object in container"):
             test_file = generate_file(object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Search operation object"):
-            search_output = grpc_client.object.search(cid, self.cluster.default_rpc_endpoint)
-            chunks = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
+            search_output = grpc_client.object.search(container, self.cluster.default_rpc_endpoint)
+            chunks = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, container, oid)
             for chunk in chunks:
                 assert chunk.object_id in search_output
 
     @allure.title("Request SEARCH check no chunk index info (size={object_size})")
-    def test_search_object_in_ec_cnr(self, grpc_client: GrpcClientWrapper, object_size: ObjectSize) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1", await_mode=True)
-
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1"))
+    def test_search_object_in_ec_cnr(
+        self, container: str, grpc_client: GrpcClientWrapper, remote_grpc_client: GrpcClientWrapper, object_size: ObjectSize
+    ) -> None:
         with reporter.step("Put object in container"):
             test_file = generate_file(object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Search operation all chunk"):
-            chunks = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
+            chunks = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, container, oid)
             for chunk in chunks:
-                chunk_search = grpc_client.object.search(cid, self.cluster.default_rpc_endpoint, oid=chunk.object_id)
+                chunk_search = grpc_client.object.search(container, self.cluster.default_rpc_endpoint, oid=chunk.object_id)
                 assert "index" not in chunk_search
 
     @allure.title("Request DELETE (size={object_size})")
     @pytest.mark.failover
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1"))
     def test_delete_object_in_ec_cnr(
-        self, grpc_client: GrpcClientWrapper, object_size: ObjectSize, cluster_state_controller: ClusterStateController
+        self,
+        container: str,
+        grpc_client: GrpcClientWrapper,
+        remote_grpc_client: GrpcClientWrapper,
+        object_size: ObjectSize,
+        cluster_state_controller: ClusterStateController,
     ) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1", await_mode=True)
-
         with reporter.step("Put object in container."):
             test_file = generate_file(object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check object chunks nodes."):
-            chunks = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
+            chunks = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, container, oid)
             replication_count = 3 if object_size.name == "simple" else 3 * 4
             assert len(chunks) == replication_count
 
         with reporter.step("Delete object"):
-            grpc_client.object.delete(cid, oid, self.cluster.default_rpc_endpoint)
+            grpc_client.object.delete(container, oid, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check that delete all chunks."):
             for chunk in chunks:
                 with pytest.raises(RuntimeError, match="object already removed"):
-                    grpc_client.object.head(cid, chunk.object_id, self.cluster.default_rpc_endpoint)
+                    grpc_client.object.head(container, chunk.object_id, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Put second object."):
-            oid_second = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid_second = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check second object chunks nodes."):
-            chunks_second_object = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid_second)
+            chunks_second_object = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, container, oid_second)
             assert len(chunks_second_object) == replication_count
 
         with reporter.step("Stop nodes with chunk."):
@@ -493,48 +513,48 @@ class TestECReplication(ClusterTestBase):
 
         with reporter.step("Delete second object"):
             cluster_nodes = list(set(self.cluster.cluster_nodes) - {chunk_node[0]})
-            grpc_client.object.delete(cid, oid_second, cluster_nodes[0].storage_node.get_rpc_endpoint())
+            grpc_client.object.delete(container, oid_second, cluster_nodes[0].storage_node.get_rpc_endpoint())
 
         with reporter.step("Check that delete all chunk second object."):
             for chunk in chunks_second_object:
                 with pytest.raises(RuntimeError, match="object already removed|object not found"):
-                    grpc_client.object.head(cid, chunk.object_id, cluster_nodes[0].storage_node.get_rpc_endpoint())
+                    grpc_client.object.head(container, chunk.object_id, cluster_nodes[0].storage_node.get_rpc_endpoint())
 
     @allure.title("Request LOCK (size={object_size})")
     @pytest.mark.failover
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1"))
     def test_lock_object_in_ec_cnr(
         self,
+        container: str,
+        test_file: TestFile,
         grpc_client: GrpcClientWrapper,
+        remote_grpc_client: GrpcClientWrapper,
         frostfs_cli: FrostfsCli,
         object_size: ObjectSize,
         cluster_state_controller: ClusterStateController,
         include_excluded_nodes: None,
     ) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1", await_mode=True)
-
         with reporter.step("Put object in container."):
-            test_file = generate_file(object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check object chunks nodes."):
-            chunks_object = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, oid)
+            chunks_object = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, container, oid)
             replication_count = 3 if object_size.name == "simple" else 3 * 4
             assert len(chunks_object) == replication_count
 
         with reporter.step("Put LOCK in object."):
             # TODO Rework for the grpc_client when the netmap methods are implemented
             epoch = frostfs_cli.netmap.epoch(self.cluster.default_rpc_endpoint, timeout=CLI_DEFAULT_TIMEOUT).stdout.strip()
-            grpc_client.object.lock(cid, oid, self.cluster.default_rpc_endpoint, expire_at=(int(epoch) + 5))
+            grpc_client.object.lock(container, oid, self.cluster.default_rpc_endpoint, expire_at=(int(epoch) + 5))
 
         with reporter.step("Check don`t delete chunk"):
             for chunk in chunks_object:
                 with pytest.raises(RuntimeError, match="Lock EC chunk failed"):
-                    grpc_client.object.delete(cid, chunk.object_id, self.cluster.default_rpc_endpoint)
+                    grpc_client.object.delete(container, chunk.object_id, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check enable LOCK object"):
             with pytest.raises(RuntimeError, match="object is locked"):
-                grpc_client.object.delete(cid, oid, self.cluster.default_rpc_endpoint)
+                grpc_client.object.delete(container, oid, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Remove node in netmap."):
             chunk_node = grpc_client.object.chunks.get_chunk_node(self.cluster, chunks_object[0])[0]
@@ -544,11 +564,11 @@ class TestECReplication(ClusterTestBase):
         with reporter.step("Check don`t delete chunk."):
             for chunk in chunks_object:
                 with pytest.raises(RuntimeError, match="Lock EC chunk failed|object not found"):
-                    grpc_client.object.delete(cid, chunk.object_id, alive_node.storage_node.get_rpc_endpoint())
+                    grpc_client.object.delete(container, chunk.object_id, alive_node.storage_node.get_rpc_endpoint())
 
         with reporter.step("Check enable LOCK object"):
             with pytest.raises(RuntimeError, match="object is locked"):
-                grpc_client.object.delete(cid, oid, alive_node.storage_node.get_rpc_endpoint())
+                grpc_client.object.delete(container, oid, alive_node.storage_node.get_rpc_endpoint())
 
         with reporter.step("Include node in netmap"):
             cluster_state_controller.include_node_to_netmap(chunk_node.storage_node, alive_node.storage_node)
@@ -615,44 +635,47 @@ class TestECReplication(ClusterTestBase):
             assert len(container_nodes) == expected_nodes
 
     @allure.title("Create container with EC policy and FILTER")
-    def test_create_container_with_filter(self, grpc_client: GrpcClientWrapper, simple_object_size: ObjectSize) -> None:
-        with reporter.step("Create Container."):
-            policy = "EC 1.1 IN RUS SELECT 2 FROM RU AS RUS FILTER Country EQ Russia AS RU"
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy=policy, await_mode=True)
-
+    @requires_container(PUBLIC_WITH_POLICY("EC 1.1 IN RUS SELECT 2 FROM RU AS RUS FILTER Country EQ Russia AS RU"))
+    def test_create_container_with_filter(
+        self,
+        grpc_client: GrpcClientWrapper,
+        remote_grpc_client: GrpcClientWrapper,
+        simple_object_size: ObjectSize,
+        container: str,
+    ) -> None:
         with reporter.step("Put object in container."):
             test_file = generate_file(simple_object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Check object is decomposed exclusively on Russian nodes"):
-            data_chunk = grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, cid, oid=oid)
-            parity_chunk = grpc_client.object.chunks.get_parity(self.cluster.default_rpc_endpoint, cid, oid=oid)
-            node_data_chunk = grpc_client.object.chunks.get_chunk_node(self.cluster, data_chunk)
-            node_parity_chunk = grpc_client.object.chunks.get_chunk_node(self.cluster, parity_chunk)
+            data_chunk = remote_grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, container, oid=oid)
+            parity_chunk = remote_grpc_client.object.chunks.get_parity(self.cluster.default_rpc_endpoint, container, oid=oid)
+            node_data_chunk = remote_grpc_client.object.chunks.get_chunk_node(self.cluster, data_chunk)
+            node_parity_chunk = remote_grpc_client.object.chunks.get_chunk_node(self.cluster, parity_chunk)
 
             for node in [node_data_chunk[1], node_parity_chunk[1]]:
                 assert "Russia" in node.country
 
     @allure.title("Evacuation shard with chunk (type={type})")
     @pytest.mark.parametrize("type, get_chunk", [("data", get_data_chunk_object), ("parity", get_parity_chunk_object)])
+    @requires_container(PUBLIC_WITH_POLICY("EC 1.1 CBF 1"))
     def test_evacuation_data_shard(
         self,
+        container: str,
         restore_nodes_shards_mode: None,
         frostfs_cli: FrostfsCli,
+        remote_frostfs_cli: FrostfsCli,
         grpc_client: GrpcClientWrapper,
         max_object_size: int,
         type: str,
         get_chunk,
     ) -> None:
-        with reporter.step("Create container."):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 1.1 CBF 1", await_mode=True)
-
         with reporter.step("Put object in container."):
             test_file = generate_file(max_object_size - 1000)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Get object chunks."):
-            chunk = get_chunk(self, frostfs_cli, cid, oid, self.cluster.default_rpc_endpoint)
+            chunk = get_chunk(self, remote_frostfs_cli, container, oid, self.cluster.default_rpc_endpoint)
             chunk_node = grpc_client.object.chunks.get_chunk_node(self.cluster, chunk)
             frostfs_node_cli = self.get_node_cli(chunk_node[0], config=chunk_node[0].storage_node.get_remote_wallet_config_path())
 
@@ -665,7 +688,7 @@ class TestECReplication(ClusterTestBase):
             frostfs_node_cli.shards.evacuation_start(chunk_node[0].storage_node.get_control_endpoint(), shard_id, await_mode=True)
 
         with reporter.step("Get object after evacuation shard"):
-            grpc_client.object.get(cid, oid, self.cluster.default_rpc_endpoint)
+            grpc_client.object.get(container, oid, self.cluster.default_rpc_endpoint)
 
     @allure.title("[NEGATIVE] Don`t create more 1 EC policy")
     def test_more_one_ec_policy(self, grpc_client: GrpcClientWrapper) -> None:
@@ -676,7 +699,7 @@ class TestECReplication(ClusterTestBase):
                 )
 
     @allure.title("Create bucket with EC policy (s3_client={s3_client})")
-    @pytest.mark.parametrize("s3_policy, s3_client", [("pytest_tests/resources/files/policy.json", AwsCliClient)], indirect=True)
+    @pytest.mark.parametrize("s3_policy, s3_client", [(S3_POLICY_FILE_LOCATION, AwsCliClient)], indirect=True)
     def test_create_bucket_with_ec_location(
         self, s3_client: S3ClientWrapper, bucket_container_resolver: BucketContainerResolver, grpc_client: GrpcClientWrapper
     ) -> None:
@@ -691,12 +714,13 @@ class TestECReplication(ClusterTestBase):
             assert container
 
     @allure.title("Bucket object count chunks (s3_client={s3_client}, size={object_size})")
-    @pytest.mark.parametrize("s3_policy, s3_client", [("pytest_tests/resources/files/policy.json", AwsCliClient)], indirect=True)
+    @pytest.mark.parametrize("s3_policy, s3_client", [(S3_POLICY_FILE_LOCATION, AwsCliClient)], indirect=True)
     def test_count_chunks_bucket_with_ec_location(
         self,
+        test_file: TestFile,
         s3_client: S3ClientWrapper,
         bucket_container_resolver: BucketContainerResolver,
-        grpc_client: GrpcClientWrapper,
+        remote_grpc_client: GrpcClientWrapper,
         object_size: ObjectSize,
     ) -> None:
         with reporter.step("Create bucket with EC location constrain"):
@@ -708,33 +732,31 @@ class TestECReplication(ClusterTestBase):
             assert bucket_status == VersioningStatus.ENABLED.value
 
         with reporter.step("Put object in bucket"):
-            test_file = generate_file(object_size.value)
             bucket_object = s3_client.put_object(bucket, test_file)
 
         with reporter.step("Watch replication count chunks"):
             cid = bucket_container_resolver.resolve(self.cluster.cluster_nodes[0], bucket)
-            chunks = grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, bucket_object)
+            chunks = remote_grpc_client.object.chunks.get_all(self.cluster.default_rpc_endpoint, cid, bucket_object)
             expect_chunks = 4 if object_size.name == "simple" else 16
             assert len(chunks) == expect_chunks
 
     @allure.title("Replication chunk after drop (size={object_size})")
-    def test_drop_chunk_and_replication(self, grpc_client: GrpcClientWrapper, object_size: ObjectSize, rep_count: int) -> None:
-        with reporter.step("Create container"):
-            cid = grpc_client.container.create(self.cluster.default_rpc_endpoint, policy="EC 2.1 CBF 1", await_mode=True)
-
+    @requires_container(PUBLIC_WITH_POLICY("EC 2.1 CBF 1"))
+    def test_drop_chunk_and_replication(
+        self, test_file: TestFile, container: str, grpc_client: GrpcClientWrapper, remote_grpc_client: GrpcClientWrapper, rep_count: int
+    ) -> None:
         with reporter.step("Put object"):
-            test_file = generate_file(object_size.value)
-            oid = grpc_client.object.put(test_file, cid, self.cluster.default_rpc_endpoint)
+            oid = grpc_client.object.put(test_file, container, self.cluster.default_rpc_endpoint)
 
         with reporter.step("Get all chunks"):
-            data_chunk = grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, cid, oid=oid)
+            data_chunk = remote_grpc_client.object.chunks.get_first_data(self.cluster.default_rpc_endpoint, container, oid=oid)
 
         with reporter.step("Search chunk node"):
-            chunk_node = grpc_client.object.chunks.get_chunk_node(self.cluster, data_chunk)
+            chunk_node = remote_grpc_client.object.chunks.get_chunk_node(self.cluster, data_chunk)
             shell_chunk_node = chunk_node[0].host.get_shell()
 
         with reporter.step("Get replication count"):
-            assert self.check_replication(rep_count, grpc_client, cid, oid)
+            assert self.check_replication(rep_count, remote_grpc_client, container, oid)
 
         with reporter.step("Delete chunk"):
             frostfs_node_cli = FrostfsCli(
@@ -742,7 +764,7 @@ class TestECReplication(ClusterTestBase):
                 frostfs_cli_exec_path=FROSTFS_CLI_EXEC,
                 config_file=chunk_node[0].storage_node.get_remote_wallet_config_path(),
             )
-            frostfs_node_cli.control.drop_objects(chunk_node[0].storage_node.get_control_endpoint(), f"{cid}/{data_chunk.object_id}")
+            frostfs_node_cli.control.drop_objects(chunk_node[0].storage_node.get_control_endpoint(), f"{container}/{data_chunk.object_id}")
 
         with reporter.step("Wait replication count after drop one chunk"):
-            self.wait_replication(rep_count, grpc_client, cid, oid)
+            self.wait_replication(rep_count, remote_grpc_client, container, oid)

pytest_tests/testsuites/replication/test_replication.py

@@ -5,15 +5,16 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.shell import Shell
-from frostfs_testlib.steps.cli.container import create_container
-from frostfs_testlib.steps.cli.object import head_object, put_object
+from frostfs_testlib.steps.cli.container import delete_container
+from frostfs_testlib.steps.cli.object import delete_object, head_object, put_object
 from frostfs_testlib.storage.cluster import Cluster
 from frostfs_testlib.storage.controllers.cluster_state_controller import ClusterStateController
-from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils.failover_utils import wait_object_replication
-from frostfs_testlib.utils.file_utils import generate_file
+from frostfs_testlib.utils.file_utils import TestFile
+
+from ...helpers.container_request import PUBLIC_WITH_POLICY, requires_container
 
 logger = logging.getLogger("NeoLogger")
 
@@ -21,70 +22,49 @@ OBJECT_ATTRIBUTES = {"common_key": "common_value"}
 WAIT_FOR_REPLICATION = 60
 
 # Adding failover mark because it may make cluster unhealthy
-@pytest.mark.sanity
 @pytest.mark.failover
 @pytest.mark.replication
 class TestReplication(ClusterTestBase):
     @allure.title("Replication (obj_size={object_size})")
+    @requires_container(PUBLIC_WITH_POLICY("REP %NODE_COUNT% CBF 1", short_name="Public_all_except_one_node"))
     def test_replication(
         self,
-        default_wallet: WalletInfo,
+        wallet: WalletInfo,
         client_shell: Shell,
         cluster: Cluster,
-        object_size: ObjectSize,
+        container: str,
+        test_file: TestFile,
         cluster_state_controller: ClusterStateController,
     ):
         nodes_count = len(cluster.cluster_nodes)
         node_for_rep = random.choice(cluster.cluster_nodes)
         alive_nodes = [node for node in cluster.cluster_nodes if node != node_for_rep]
-        cid = create_container(
-            wallet=default_wallet,
-            shell=client_shell,
-            endpoint=cluster.default_rpc_endpoint,
-            rule=f"REP 1 IN SELF_PLACE REP {nodes_count - 1} IN OTHER_PLACE CBF 1 "
-            "SELECT 1 FROM SELF AS SELF_PLACE "
-            f"SELECT {nodes_count - 1} FROM OTHER AS OTHER_PLACE "
-            f"FILTER 'UN-LOCODE' EQ '{node_for_rep.storage_node.get_un_locode()}' AS SELF "
-            f"FILTER 'UN-LOCODE' NE '{node_for_rep.storage_node.get_un_locode()}' AS OTHER",
-        )
 
-        cluster_state_controller.stop_node_host(node_for_rep, mode="hard")
-
-        file_path = generate_file(object_size.value)
+        with reporter.step("Stop container node host"):
+            cluster_state_controller.stop_node_host(node_for_rep, mode="hard")
 
         with reporter.step("Put object"):
             oid = put_object(
-                wallet=default_wallet,
-                path=file_path,
-                cid=cid,
+                wallet=wallet,
+                path=test_file,
+                cid=container,
                 shell=client_shell,
                 attributes=OBJECT_ATTRIBUTES,
-                copies_number=3,
+                copies_number=nodes_count - 1,
                 endpoint=random.choice(alive_nodes).storage_node.get_rpc_endpoint(),
                 timeout="45s",
             )
 
-        cluster_state_controller.start_node_host(node_for_rep)
-        with reporter.step(f"Wait for replication."):
-            object_nodes = wait_object_replication(
-                cid=cid,
-                oid=oid,
-                expected_copies=len(self.cluster.cluster_nodes),
-                shell=client_shell,
-                nodes=self.cluster.storage_nodes,
-            )
+        with reporter.step("Start container node host"):
+            cluster_state_controller.start_node_host(node_for_rep)
+
+        with reporter.step(f"Wait for replication"):
+            object_nodes = wait_object_replication(container, oid, nodes_count, client_shell, self.cluster.storage_nodes)
 
         with reporter.step("Check attributes"):
             for node in object_nodes:
-                header_info = head_object(
-                    wallet=default_wallet,
-                    oid=oid,
-                    cid=cid,
-                    shell=self.shell,
-                    endpoint=node.get_rpc_endpoint(),
-                    is_direct=True,
-                )["header"]
-                attributes = header_info["attributes"]
+                header_info = head_object(wallet, container, oid, client_shell, node.get_rpc_endpoint(), is_direct=True).get("header", {})
+                attributes = header_info.get("attributes", {})
                 for attribute_key, attribute_value in OBJECT_ATTRIBUTES.items():
                     assert attribute_key in attributes, f"{attribute_key} not found in {header_info}"
                     assert header_info["attributes"].get(attribute_key) == str(attribute_value), (
@@ -93,19 +73,6 @@ class TestReplication(ClusterTestBase):
                         f"expected attribute value: {attribute_value}"
                     )
 
-        # TODO: Research why this fails
-        # with reporter.step("Cleanup"):
-        #     delete_object(
-        #         wallet=default_wallet,
-        #         cid=cid,
-        #         oid=oid,
-        #         shell=client_shell,
-        #         endpoint=cluster.default_rpc_endpoint,
-        #     )
-
-        #     delete_container(
-        #         wallet=default_wallet,
-        #         cid=cid,
-        #         shell=client_shell,
-        #         endpoint=cluster.default_rpc_endpoint,
-        #     )
+        with reporter.step("Cleanup"):
+            delete_object(wallet, container, oid, client_shell, cluster.default_rpc_endpoint)
+            delete_container(wallet, container, client_shell, cluster.default_rpc_endpoint)

pytest_tests/testsuites/services/http_gate/test_http_bearer.py

@@ -4,10 +4,8 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
 from frostfs_testlib.steps.acl import bearer_token_base64_from_file
-from frostfs_testlib.steps.cli.container import create_container
-from frostfs_testlib.steps.http.http_gate import upload_via_http_gate_curl, verify_object_hash
+from frostfs_testlib.steps.http_gate import upload_via_http_gate_curl, verify_object_hash
 from frostfs_testlib.storage.cluster import Cluster
 from frostfs_testlib.storage.dataclasses import ape
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
@@ -15,7 +13,8 @@ from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils.file_utils import generate_file
 
-from pytest_tests.helpers.bearer_token import create_bearer_token
+from ....helpers.bearer_token import create_bearer_token
+from ....helpers.container_request import APE_EVERYONE_ALLOW_ALL, ContainerRequest, requires_container
 
 logger = logging.getLogger("NeoLogger")
 
@@ -24,55 +23,43 @@ logger = logging.getLogger("NeoLogger")
 @pytest.mark.http_put
 class Test_http_bearer(ClusterTestBase):
     PLACEMENT_RULE = "REP 2 IN X CBF 1 SELECT 2 FROM * AS X"
+    OWNER_ROLE = ape.Condition.by_role(ape.Role.OWNER)
+    CUSTOM_APE_RULE = ape.Rule(ape.Verb.DENY, ape.ObjectOperations.PUT, OWNER_ROLE)
 
-    @pytest.fixture(scope="class")
-    def user_container(self, frostfs_cli: FrostfsCli, default_wallet: WalletInfo, cluster: Cluster) -> str:
-        with reporter.step("Create container"):
-            cid = create_container(default_wallet, self.shell, self.cluster.default_rpc_endpoint, self.PLACEMENT_RULE, PUBLIC_ACL)
-
-        with reporter.step("Deny PUT via APE rule to container"):
-            role_condition = ape.Condition.by_role(ape.Role.OWNER)
-            rule = ape.Rule(ape.Verb.DENY, ape.ObjectOperations.PUT, role_condition)
-            frostfs_cli.ape_manager.add(
-                cluster.default_rpc_endpoint, rule.chain_id, target_name=cid, target_type="container", rule=rule.as_string()
-            )
-
-        with reporter.step("Wait for one block"):
-            self.wait_for_blocks()
-
-        return cid
-
-    @pytest.fixture(scope="class")
-    def bearer_token(self, frostfs_cli: FrostfsCli, user_container: str, temp_directory: str, cluster: Cluster) -> str:
+    @pytest.fixture()
+    def bearer_token(self, frostfs_cli: FrostfsCli, container: str, temp_directory: str, cluster: Cluster) -> str:
         with reporter.step(f"Create bearer token for {ape.Role.OTHERS} with all operations allowed"):
             role_condition = ape.Condition.by_role(ape.Role.OTHERS)
             rule = ape.Rule(ape.Verb.ALLOW, ape.ObjectOperations.WILDCARD_ALL, role_condition)
-            bearer = create_bearer_token(frostfs_cli, temp_directory, user_container, rule, cluster.default_rpc_endpoint)
+            bearer = create_bearer_token(frostfs_cli, temp_directory, container, rule, cluster.default_rpc_endpoint)
 
             return bearer_token_base64_from_file(bearer)
 
     @allure.title(f"[NEGATIVE] Put object without bearer token for {ape.Role.OTHERS}")
-    def test_unable_put_without_bearer_token(self, simple_object_size: ObjectSize, user_container: str):
+    def test_unable_put_without_bearer_token(self, simple_object_size: ObjectSize, container: str):
         upload_via_http_gate_curl(
-            cid=user_container,
+            cid=container,
             filepath=generate_file(simple_object_size.value),
             endpoint=self.cluster.default_http_gate_endpoint,
             error_pattern="access to object operation denied",
         )
 
     @allure.title("Put object via HTTP using bearer token (object_size={object_size})")
-    def test_put_with_bearer_when_eacl_restrict(
+    @requires_container(
+        ContainerRequest(PLACEMENT_RULE, [APE_EVERYONE_ALLOW_ALL, CUSTOM_APE_RULE], short_name="custom with denied owner put")
+    )
+    def test_put_with_bearer_when_ape_restrict(
         self,
         object_size: ObjectSize,
         default_wallet: WalletInfo,
-        user_container: str,
+        container: str,
         bearer_token: str,
     ):
         file_path = generate_file(object_size.value)
         with reporter.step(f"Put object with bearer token for {ape.Role.OTHERS}, then get and verify hashes"):
             headers = [f" -H 'Authorization: Bearer {bearer_token}'"]
             oid = upload_via_http_gate_curl(
-                cid=user_container,
+                cid=container,
                 filepath=file_path,
                 endpoint=self.cluster.default_http_gate_endpoint,
                 headers=headers,
@@ -81,7 +68,7 @@ class Test_http_bearer(ClusterTestBase):
                 oid=oid,
                 file_name=file_path,
                 wallet=default_wallet,
-                cid=user_container,
+                cid=container,
                 shell=self.shell,
                 nodes=self.cluster.storage_nodes,
                 request_node=self.cluster.cluster_nodes[0],

pytest_tests/testsuites/services/http_gate/test_http_gate.py

@@ -1,11 +1,8 @@
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
-from frostfs_testlib.steps.cli.container import create_container
-from frostfs_testlib.steps.cli.object import put_object_to_random_node
 from frostfs_testlib.steps.epoch import get_epoch
-from frostfs_testlib.steps.http.http_gate import (
+from frostfs_testlib.steps.http_gate import (
     attr_into_header,
     get_object_by_attr_and_verify_hashes,
     get_via_http_curl,
@@ -17,85 +14,16 @@ from frostfs_testlib.steps.http.http_gate import (
     verify_object_hash,
 )
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
+from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
-from frostfs_testlib.utils.file_utils import generate_file, get_file_hash
+from frostfs_testlib.utils.file_utils import TestFile, generate_file, get_file_hash
 
-from pytest_tests.helpers.utility import wait_for_gc_pass_on_storage_nodes
+from ....helpers.container_request import REP_2_2_2_PUBLIC, requires_container
+from ....helpers.utility import wait_for_gc_pass_on_storage_nodes
 
 OBJECT_NOT_FOUND_ERROR = "not found"
 
 
-@allure.link(
-    "https://git.frostfs.info/TrueCloudLab/frostfs-http-gw#frostfs-http-gateway",
-    name="frostfs-http-gateway",
-)
-@allure.link("https://git.frostfs.info/TrueCloudLab/frostfs-http-gw#uploading", name="uploading")
-@allure.link("https://git.frostfs.info/TrueCloudLab/frostfs-http-gw#downloading", name="downloading")
-@pytest.mark.sanity
-@pytest.mark.http_gate
-class TestHttpGate(ClusterTestBase):
-    PLACEMENT_RULE_1 = "REP 1 IN X CBF 1 SELECT 1 FROM * AS X"
-    PLACEMENT_RULE_2 = "REP 2 IN X CBF 2 SELECT 2 FROM * AS X"
-
-    @pytest.fixture(scope="class", autouse=True)
-    @allure.title("[Class/Autouse]: Prepare wallet and deposit")
-    def prepare_wallet(self, default_wallet):
-        TestHttpGate.wallet = default_wallet
-
-    @allure.title("Put over gRPC, Get over HTTP")
-    def test_put_grpc_get_http(self, complex_object_size: ObjectSize, simple_object_size: ObjectSize):
-        """
-        Test that object can be put using gRPC interface and get using HTTP.
-
-        Steps:
-        1. Create simple and large objects.
-        2. Put objects using gRPC (frostfs-cli).
-        3. Download objects using HTTP gate (https://git.frostfs.info/TrueCloudLab/frostfs-http-gw#downloading).
-        4. Get objects using gRPC (frostfs-cli).
-        5. Compare hashes for got objects.
-        6. Compare hashes for got and original objects.
-
-        Expected result:
-        Hashes must be the same.
-        """
-        cid = create_container(
-            self.wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=self.PLACEMENT_RULE_1,
-            basic_acl=PUBLIC_ACL,
-        )
-        file_path_simple = generate_file(simple_object_size.value)
-        file_path_large = generate_file(complex_object_size.value)
-
-        with reporter.step("Put objects using gRPC"):
-            oid_simple = put_object_to_random_node(
-                wallet=self.wallet,
-                path=file_path_simple,
-                cid=cid,
-                shell=self.shell,
-                cluster=self.cluster,
-            )
-            oid_large = put_object_to_random_node(
-                wallet=self.wallet,
-                path=file_path_large,
-                cid=cid,
-                shell=self.shell,
-                cluster=self.cluster,
-            )
-
-        for oid, file_path in ((oid_simple, file_path_simple), (oid_large, file_path_large)):
-            verify_object_hash(
-                oid=oid,
-                file_name=file_path,
-                wallet=self.wallet,
-                cid=cid,
-                shell=self.shell,
-                nodes=self.cluster.storage_nodes,
-                request_node=self.cluster.cluster_nodes[0],
-            )
-
-
 @allure.link(
     "https://git.frostfs.info/TrueCloudLab/frostfs-http-gw#frostfs-http-gateway",
     name="frostfs-http-gateway",
@@ -107,9 +35,10 @@ class TestHttpGate(ClusterTestBase):
 class TestHttpPut(ClusterTestBase):
     @allure.link("https://git.frostfs.info/TrueCloudLab/frostfs-http-gw#uploading", name="uploading")
     @allure.link("https://git.frostfs.info/TrueCloudLab/frostfs-http-gw#downloading", name="downloading")
-    @allure.title("Put over HTTP, Get over HTTP")
+    @allure.title("Put over HTTP, Get over HTTP (object_size={object_size})")
     @pytest.mark.smoke
-    def test_put_http_get_http(self, complex_object_size: ObjectSize, simple_object_size: ObjectSize):
+    @requires_container(REP_2_2_2_PUBLIC)
+    def test_put_http_get_http(self, container: str, default_wallet: WalletInfo, test_file: TestFile):
         """
         Test that object can be put and get using HTTP interface.
 
@@ -122,33 +51,19 @@ class TestHttpPut(ClusterTestBase):
         Expected result:
         Hashes must be the same.
         """
-        cid = create_container(
-            self.wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=self.PLACEMENT_RULE_2,
-            basic_acl=PUBLIC_ACL,
-        )
-        file_path_simple = generate_file(simple_object_size.value)
-        file_path_large = generate_file(complex_object_size.value)
 
-        with reporter.step("Put objects using HTTP"):
-            oid_simple = upload_via_http_gate(
-                cid=cid, path=file_path_simple, endpoint=self.cluster.default_http_gate_endpoint
-            )
-            oid_large = upload_via_http_gate(
-                cid=cid, path=file_path_large, endpoint=self.cluster.default_http_gate_endpoint
-            )
+        with reporter.step("Put object using HTTP"):
+            object_id = upload_via_http_gate(container, test_file.path, self.cluster.default_http_gate_endpoint)
 
-        for oid, file_path in ((oid_simple, file_path_simple), (oid_large, file_path_large)):
+        with reporter.step("Get object and check hash"):
             verify_object_hash(
-                oid=oid,
-                file_name=file_path,
-                wallet=self.wallet,
-                cid=cid,
-                shell=self.shell,
-                nodes=self.cluster.storage_nodes,
-                request_node=self.cluster.cluster_nodes[0],
+                object_id,
+                test_file.path,
+                default_wallet,
+                container,
+                self.shell,
+                self.cluster.storage_nodes,
+                self.cluster.cluster_nodes[0],
             )
 
     @allure.link(
@@ -165,7 +80,8 @@ class TestHttpPut(ClusterTestBase):
         ],
         ids=["simple", "hyphen", "percent"],
     )
-    def test_put_http_get_http_with_headers(self, attributes: dict, simple_object_size: ObjectSize, id: str):
+    @requires_container(REP_2_2_2_PUBLIC)
+    def test_put_http_get_http_with_headers(self, container: str, attributes: dict, simple_object_size: ObjectSize, id: str):
         """
         Test that object can be downloaded using different attributes in HTTP header.
 
@@ -178,46 +94,27 @@ class TestHttpPut(ClusterTestBase):
         Expected result:
         Hashes must be the same.
         """
-        cid = create_container(
-            self.wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=self.PLACEMENT_RULE_2,
-            basic_acl=PUBLIC_ACL,
-        )
         file_path = generate_file(simple_object_size.value)
 
         with reporter.step("Put objects using HTTP with attribute"):
             headers = attr_into_header(attributes)
-            oid = upload_via_http_gate(
-                cid=cid,
-                path=file_path,
-                headers=headers,
-                endpoint=self.cluster.default_http_gate_endpoint,
-            )
+            oid = upload_via_http_gate(container, file_path, self.cluster.default_http_gate_endpoint, headers)
 
         get_object_by_attr_and_verify_hashes(
-            oid=oid,
-            file_name=file_path,
-            cid=cid,
-            attrs=attributes,
-            node=self.cluster.cluster_nodes[0],
+            oid,
+            file_path,
+            container,
+            attributes,
+            self.cluster.cluster_nodes[0],
         )
 
     @allure.title("Expiration-Epoch in HTTP header (epoch_gap={epoch_gap})")
     @pytest.mark.parametrize("epoch_gap", [0, 1])
-    def test_expiration_epoch_in_http(self, simple_object_size: ObjectSize, epoch_gap: int):
-        endpoint = self.cluster.default_rpc_endpoint
+    @requires_container(REP_2_2_2_PUBLIC)
+    def test_expiration_epoch_in_http(self, container: str, simple_object_size: ObjectSize, epoch_gap: int):
         http_endpoint = self.cluster.default_http_gate_endpoint
         min_valid_epoch = get_epoch(self.shell, self.cluster) + epoch_gap
 
-        cid = create_container(
-            self.wallet,
-            shell=self.shell,
-            endpoint=endpoint,
-            rule=self.PLACEMENT_RULE_2,
-            basic_acl=PUBLIC_ACL,
-        )
         file_path = generate_file(simple_object_size.value)
         oids_to_be_expired = []
         oids_to_be_valid = []
@@ -228,7 +125,7 @@ class TestHttpPut(ClusterTestBase):
 
             with reporter.step("Put objects using HTTP with attribute Expiration-Epoch"):
                 oid = upload_via_http_gate(
-                    cid=cid,
+                    cid=container,
                     path=file_path,
                     headers=headers,
                     endpoint=http_endpoint,
@@ -238,7 +135,7 @@ class TestHttpPut(ClusterTestBase):
                 else:
                     oids_to_be_expired.append(oid)
                 with reporter.step("This object can be got"):
-                    get_via_http_gate(cid=cid, oid=oid, node=self.cluster.cluster_nodes[0])
+                    get_via_http_gate(container, oid, self.cluster.cluster_nodes[0])
 
         self.tick_epoch()
 
@@ -248,24 +145,18 @@ class TestHttpPut(ClusterTestBase):
         for oid in oids_to_be_expired:
             with reporter.step(f"{oid} shall be expired and cannot be got"):
                 try_to_get_object_and_expect_error(
-                    cid=cid,
+                    cid=container,
                     oid=oid,
                     node=self.cluster.cluster_nodes[0],
                     error_pattern=OBJECT_NOT_FOUND_ERROR,
                 )
         for oid in oids_to_be_valid:
             with reporter.step(f"{oid} shall be valid and can be got"):
-                get_via_http_gate(cid=cid, oid=oid, node=self.cluster.cluster_nodes[0])
+                get_via_http_gate(cid=container, oid=oid, node=self.cluster.cluster_nodes[0])
 
     @allure.title("Zip in HTTP header")
-    def test_zip_in_http(self, complex_object_size: ObjectSize, simple_object_size: ObjectSize):
-        cid = create_container(
-            self.wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=self.PLACEMENT_RULE_2,
-            basic_acl=PUBLIC_ACL,
-        )
+    @requires_container(REP_2_2_2_PUBLIC)
+    def test_zip_in_http(self, container: str, complex_object_size: ObjectSize, simple_object_size: ObjectSize):
         file_path_simple = generate_file(simple_object_size.value)
         file_path_large = generate_file(complex_object_size.value)
         common_prefix = "my_files"
@@ -274,45 +165,33 @@ class TestHttpPut(ClusterTestBase):
         headers2 = {"X-Attribute-FilePath": f"{common_prefix}/file2"}
 
         upload_via_http_gate(
-            cid=cid,
+            cid=container,
             path=file_path_simple,
             headers=headers1,
             endpoint=self.cluster.default_http_gate_endpoint,
         )
-        upload_via_http_gate(
-            cid=cid,
-            path=file_path_large,
-            headers=headers2,
-            endpoint=self.cluster.default_http_gate_endpoint,
-        )
+        upload_via_http_gate(container, file_path_large, headers2, self.cluster.default_http_gate_endpoint)
+        upload_via_http_gate(container, file_path_large, headers2, self.cluster.default_http_gate_endpoint)
 
-        dir_path = get_via_zip_http_gate(cid=cid, prefix=common_prefix, node=self.cluster.cluster_nodes[0])
+        dir_path = get_via_zip_http_gate(cid=container, prefix=common_prefix, node=self.cluster.cluster_nodes[0])
 
         with reporter.step("Verify hashes"):
             assert get_file_hash(f"{dir_path}/file1") == get_file_hash(file_path_simple)
             assert get_file_hash(f"{dir_path}/file2") == get_file_hash(file_path_large)
 
-    @pytest.mark.long
     @allure.title("Put over HTTP/Curl, Get over HTTP/Curl for large object")
-    def test_put_http_get_http_large_file(self, complex_object_size: ObjectSize):
+    @requires_container(REP_2_2_2_PUBLIC)
+    def test_put_http_get_http_large_file(self, default_wallet: WalletInfo, container: str, complex_object_size: ObjectSize):
         """
         This test checks upload and download using curl with 'large' object.
         Large is object with size up to 20Mb.
         """
-        cid = create_container(
-            self.wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=self.PLACEMENT_RULE_2,
-            basic_acl=PUBLIC_ACL,
-        )
-
         file_path = generate_file(complex_object_size.value)
 
         with reporter.step("Put objects using HTTP"):
-            oid_gate = upload_via_http_gate(cid=cid, path=file_path, endpoint=self.cluster.default_http_gate_endpoint)
+            oid_gate = upload_via_http_gate(cid=container, path=file_path, endpoint=self.cluster.default_http_gate_endpoint)
             oid_curl = upload_via_http_gate_curl(
-                cid=cid,
+                cid=container,
                 filepath=file_path,
                 endpoint=self.cluster.default_http_gate_endpoint,
             )
@@ -320,8 +199,8 @@ class TestHttpPut(ClusterTestBase):
         verify_object_hash(
             oid=oid_gate,
             file_name=file_path,
-            wallet=self.wallet,
-            cid=cid,
+            wallet=default_wallet,
+            cid=container,
             shell=self.shell,
             nodes=self.cluster.storage_nodes,
             request_node=self.cluster.cluster_nodes[0],
@@ -329,47 +208,32 @@ class TestHttpPut(ClusterTestBase):
         verify_object_hash(
             oid=oid_curl,
             file_name=file_path,
-            wallet=self.wallet,
-            cid=cid,
+            wallet=default_wallet,
+            cid=container,
             shell=self.shell,
             nodes=self.cluster.storage_nodes,
             request_node=self.cluster.cluster_nodes[0],
             object_getter=get_via_http_curl,
         )
 
-    @allure.title("Put/Get over HTTP using Curl utility")
-    def test_put_http_get_http_curl(self, complex_object_size: ObjectSize, simple_object_size: ObjectSize):
+    @allure.title("Put/Get over HTTP using Curl utility (object_size={object_size})")
+    @requires_container(REP_2_2_2_PUBLIC)
+    def test_put_http_get_http_curl(self, default_wallet: WalletInfo, container: str, test_file: TestFile):
         """
         Test checks upload and download over HTTP using curl utility.
         """
-        cid = create_container(
-            self.wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=self.PLACEMENT_RULE_2,
-            basic_acl=PUBLIC_ACL,
-        )
-        file_path_simple = generate_file(simple_object_size.value)
-        file_path_large = generate_file(complex_object_size.value)
 
-        with reporter.step("Put objects using curl utility"):
-            oid_simple = upload_via_http_gate_curl(
-                cid=cid, filepath=file_path_simple, endpoint=self.cluster.default_http_gate_endpoint
-            )
-            oid_large = upload_via_http_gate_curl(
-                cid=cid,
-                filepath=file_path_large,
-                endpoint=self.cluster.default_http_gate_endpoint,
-            )
+        with reporter.step("Put object using curl utility"):
+            object_id = upload_via_http_gate_curl(container, test_file.path, self.cluster.default_http_gate_endpoint)
 
-        for oid, file_path in ((oid_simple, file_path_simple), (oid_large, file_path_large)):
+        with reporter.step("Get object and check hash"):
             verify_object_hash(
-                oid=oid,
-                file_name=file_path,
-                wallet=self.wallet,
-                cid=cid,
-                shell=self.shell,
-                nodes=self.cluster.storage_nodes,
-                request_node=self.cluster.cluster_nodes[0],
-                object_getter=get_via_http_curl,
+                object_id,
+                test_file.path,
+                default_wallet,
+                container,
+                self.shell,
+                self.cluster.storage_nodes,
+                self.cluster.cluster_nodes[0],
+                get_via_http_curl,
             )

pytest_tests/testsuites/services/http_gate/test_http_headers.py

@@ -4,15 +4,9 @@ import os
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
-from frostfs_testlib.steps.cli.container import (
-    create_container,
-    delete_container,
-    list_containers,
-    wait_for_container_deletion,
-)
+from frostfs_testlib.steps.cli.container import delete_container, list_containers, wait_for_container_deletion
 from frostfs_testlib.steps.cli.object import delete_object
-from frostfs_testlib.steps.http.http_gate import (
+from frostfs_testlib.steps.http_gate import (
     attr_into_str_header_curl,
     get_object_by_attr_and_verify_hashes,
     try_to_get_object_and_expect_error,
@@ -21,9 +15,12 @@ from frostfs_testlib.steps.http.http_gate import (
 )
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.storage_object_info import StorageObjectInfo
+from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils.file_utils import generate_file
 
+from ....helpers.container_request import REP_2_1_4_PUBLIC, requires_container
+
 OBJECT_ALREADY_REMOVED_ERROR = "object already removed"
 logger = logging.getLogger("NeoLogger")
 
@@ -31,7 +28,6 @@ logger = logging.getLogger("NeoLogger")
 @pytest.mark.http_gate
 @pytest.mark.http_put
 class Test_http_headers(ClusterTestBase):
-    PLACEMENT_RULE = "REP 2 IN X CBF 1 SELECT 4 FROM * AS X"
     obj1_keys = ["Writer", "Chapter1", "Chapter2"]
     obj2_keys = ["Writer", "Ch@pter1", "chapter2"]
     values = ["Leo Tolstoy", "peace", "w@r"]
@@ -40,34 +36,23 @@ class Test_http_headers(ClusterTestBase):
         {obj2_keys[0]: values[0], obj2_keys[1]: values[1], obj2_keys[2]: values[2]},
     ]
 
-    @pytest.fixture(scope="class", autouse=True)
-    @allure.title("[Class/Autouse]: Prepare wallet and deposit")
-    def prepare_wallet(self, default_wallet):
-        Test_http_headers.wallet = default_wallet
-
-    def storage_objects_with_attributes(self, object_size: ObjectSize) -> list[StorageObjectInfo]:
+    @pytest.fixture
+    def storage_objects_with_attributes(self, container: str, wallet: WalletInfo, object_size: ObjectSize) -> list[StorageObjectInfo]:
         # TODO: Deal with http tests
         if object_size.value > 1000:
             pytest.skip("Complex objects for HTTP temporarly disabled for v0.37")
 
         storage_objects = []
-        wallet = self.wallet
-        cid = create_container(
-            wallet=self.wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=self.PLACEMENT_RULE,
-            basic_acl=PUBLIC_ACL,
-        )
+
         file_path = generate_file(object_size.value)
         for attributes in self.OBJECT_ATTRIBUTES:
             storage_object_id = upload_via_http_gate_curl(
-                cid=cid,
+                cid=container,
                 filepath=file_path,
                 endpoint=self.cluster.default_http_gate_endpoint,
                 headers=attr_into_str_header_curl(attributes),
             )
-            storage_object = StorageObjectInfo(cid, storage_object_id)
+            storage_object = StorageObjectInfo(container, storage_object_id)
             storage_object.size = os.path.getsize(file_path)
             storage_object.wallet = wallet
             storage_object.file_path = file_path
@@ -75,9 +60,10 @@ class Test_http_headers(ClusterTestBase):
 
             storage_objects.append(storage_object)
 
-        yield storage_objects
+        return storage_objects
 
-    @allure.title("Get object1 by attribute")
+    @allure.title("Get object1 by attribute (object_size={object_size})")
+    @requires_container(REP_2_1_4_PUBLIC)
     def test_object1_can_be_get_by_attr(self, storage_objects_with_attributes: list[StorageObjectInfo]):
         """
         Test to get object#1 by attribute and comapre hashes
@@ -99,8 +85,9 @@ class Test_http_headers(ClusterTestBase):
                 node=self.cluster.cluster_nodes[0],
             )
 
-    @allure.title("Get object2 with different attributes, then delete object2 and get object1")
-    def test_object2_can_be_get_by_attr(self, storage_objects_with_attributes: list[StorageObjectInfo]):
+    @allure.title("Get object2 with different attributes, then delete object2 and get object1 (object_size={object_size})")
+    @requires_container(REP_2_1_4_PUBLIC)
+    def test_object2_can_be_get_by_attr(self, default_wallet: WalletInfo, storage_objects_with_attributes: list[StorageObjectInfo]):
         """
         Test to get object2 with different attributes, then delete object2 and get object1 using 1st attribute. Note: obj1 and obj2 have the same attribute#1,
         and when obj2 is deleted you can get obj1 by 1st attribute
@@ -131,7 +118,7 @@ class Test_http_headers(ClusterTestBase):
                 )
         with reporter.step("Delete object#2 and verify is the container deleted"):
             delete_object(
-                wallet=self.wallet,
+                wallet=default_wallet,
                 cid=storage_object_2.cid,
                 oid=storage_object_2.oid,
                 shell=self.shell,
@@ -145,9 +132,7 @@ class Test_http_headers(ClusterTestBase):
             )
             storage_objects_with_attributes.remove(storage_object_2)
 
-        with reporter.step(
-            f'Download object#1 with attributes [Writer={storage_object_1.attributes["Writer"]}] and compare hashes'
-        ):
+        with reporter.step(f'Download object#1 with attributes [Writer={storage_object_1.attributes["Writer"]}] and compare hashes'):
             key_value_pair = {"Writer": storage_object_1.attributes["Writer"]}
             get_object_by_attr_and_verify_hashes(
                 oid=storage_object_1.oid,
@@ -157,8 +142,9 @@ class Test_http_headers(ClusterTestBase):
                 node=self.cluster.cluster_nodes[0],
             )
 
-    @allure.title("[NEGATIVE] Put object and get right after container is deleted")
-    def test_negative_put_and_get_object3(self, storage_objects_with_attributes: list[StorageObjectInfo]):
+    @allure.title("[NEGATIVE] Put object and get right after container is deleted (object_size={object_size})")
+    @requires_container(REP_2_1_4_PUBLIC)
+    def test_negative_put_and_get_object3(self, default_wallet: WalletInfo, storage_objects_with_attributes: list[StorageObjectInfo]):
         """
         Test to attempt to put object and try to download it right after the container has been deleted
 
@@ -188,7 +174,7 @@ class Test_http_headers(ClusterTestBase):
             )
         with reporter.step("Delete container and verify container deletion"):
             delete_container(
-                wallet=self.wallet,
+                wallet=default_wallet,
                 cid=storage_object_1.cid,
                 shell=self.shell,
                 endpoint=self.cluster.default_rpc_endpoint,
@@ -196,14 +182,12 @@ class Test_http_headers(ClusterTestBase):
             )
             self.tick_epoch()
             wait_for_container_deletion(
-                self.wallet,
+                default_wallet,
                 storage_object_1.cid,
                 shell=self.shell,
                 endpoint=self.cluster.default_rpc_endpoint,
             )
-            assert storage_object_1.cid not in list_containers(
-                self.wallet, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint
-            )
+            assert storage_object_1.cid not in list_containers(default_wallet, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint)
         with reporter.step("[Negative] Try to download (wget) object via wget with attributes [peace=peace]"):
             request = f"/get/{storage_object_1.cid}/peace/peace"
             error_pattern = "404 Not Found"

pytest_tests/testsuites/services/http_gate/test_http_object.py

@@ -3,37 +3,34 @@ import logging
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
-from frostfs_testlib.s3 import AwsCliClient, S3ClientWrapper
-from frostfs_testlib.steps.cli.container import create_container
+from frostfs_testlib.clients import S3ClientWrapper
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.steps.cli.object import put_object_to_random_node
-from frostfs_testlib.steps.http.http_gate import (
+from frostfs_testlib.steps.http_gate import (
     assert_hashes_are_equal,
     get_object_by_attr_and_verify_hashes,
     get_via_http_gate,
     try_to_get_object_via_passed_request_and_expect_error,
     verify_object_hash,
 )
-from frostfs_testlib.steps.s3 import s3_helper
-from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
+from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
-from frostfs_testlib.utils.file_utils import generate_file
+from frostfs_testlib.utils.file_utils import TestFile, generate_file, split_file
+
+from ....helpers.container_request import REP_2_1_4_PUBLIC, requires_container
 
 logger = logging.getLogger("NeoLogger")
 
+PART_SIZE = 5 * 1024 * 1024
 
+
+@pytest.mark.nightly
 @pytest.mark.sanity
 @pytest.mark.http_gate
 class Test_http_object(ClusterTestBase):
-    PLACEMENT_RULE = "REP 2 IN X CBF 1 SELECT 4 FROM * AS X"
-
-    @pytest.fixture(scope="class", autouse=True)
-    @allure.title("[Class/Autouse]: Prepare wallet and deposit")
-    def prepare_wallet(self, default_wallet):
-        Test_http_object.wallet = default_wallet
-
     @allure.title("Put over gRPC, Get over HTTP with attributes (obj_size={object_size})")
-    def test_object_put_get_attributes(self, object_size: ObjectSize):
+    @requires_container(REP_2_1_4_PUBLIC)
+    def test_object_put_get_attributes(self, default_wallet: WalletInfo, container: str, test_file: TestFile):
         """
         Test that object can be put using gRPC interface and got using HTTP.
 
@@ -52,18 +49,6 @@ class Test_http_object(ClusterTestBase):
         Hashes must be the same.
         """
 
-        with reporter.step("Create public container"):
-            cid = create_container(
-                self.wallet,
-                shell=self.shell,
-                endpoint=self.cluster.default_rpc_endpoint,
-                rule=self.PLACEMENT_RULE,
-                basic_acl=PUBLIC_ACL,
-            )
-
-        # Generate file
-        file_path = generate_file(object_size.value)
-
         # List of Key=Value attributes
         obj_key1 = "chapter1"
         obj_value1 = "peace"
@@ -76,19 +61,20 @@ class Test_http_object(ClusterTestBase):
 
         with reporter.step("Put objects using gRPC [--attributes chapter1=peace,chapter2=war]"):
             oid = put_object_to_random_node(
-                wallet=self.wallet,
-                path=file_path,
-                cid=cid,
+                wallet=default_wallet,
+                path=test_file.path,
+                cid=container,
                 shell=self.shell,
                 cluster=self.cluster,
                 attributes=f"{key_value1},{key_value2}",
             )
+
         with reporter.step("Get object and verify hashes [ get/$CID/$OID ]"):
             verify_object_hash(
                 oid=oid,
-                file_name=file_path,
-                wallet=self.wallet,
-                cid=cid,
+                file_name=test_file.path,
+                wallet=default_wallet,
+                cid=container,
                 shell=self.shell,
                 nodes=self.cluster.storage_nodes,
                 request_node=self.cluster.cluster_nodes[0],
@@ -96,10 +82,10 @@ class Test_http_object(ClusterTestBase):
 
         with reporter.step("[Negative] try to get object: [get/$CID/chapter1/peace]"):
             attrs = {obj_key1: obj_value1, obj_key2: obj_value2}
-            request = f"/get/{cid}/{obj_key1}/{obj_value1}"
+            request = f"/get/{container}/{obj_key1}/{obj_value1}"
             expected_err_msg = "Failed to get object via HTTP gate:"
             try_to_get_object_via_passed_request_and_expect_error(
-                cid=cid,
+                cid=container,
                 oid=oid,
                 node=self.cluster.cluster_nodes[0],
                 error_pattern=expected_err_msg,
@@ -108,26 +94,20 @@ class Test_http_object(ClusterTestBase):
             )
 
         with reporter.step("Download the object with attribute [get_by_attribute/$CID/chapter1/peace]"):
-            get_object_by_attr_and_verify_hashes(
-                oid=oid,
-                file_name=file_path,
-                cid=cid,
-                attrs=attrs,
-                node=self.cluster.cluster_nodes[0],
-            )
+            get_object_by_attr_and_verify_hashes(oid, test_file, container, attrs, self.cluster.cluster_nodes[0])
+
         with reporter.step("[Negative] try to get object: get_by_attribute/$CID/$OID"):
-            request = f"/get_by_attribute/{cid}/{oid}"
+            request = f"/get_by_attribute/{container}/{oid}"
             try_to_get_object_via_passed_request_and_expect_error(
-                cid=cid,
-                oid=oid,
-                node=self.cluster.cluster_nodes[0],
+                container,
+                oid,
+                self.cluster.cluster_nodes[0],
                 error_pattern=expected_err_msg,
                 http_request_path=request,
             )
 
-    @allure.title("Put over s3, Get over HTTP with bucket name and key (object_size={object_size})")
-    @pytest.mark.parametrize("s3_client", [AwsCliClient], indirect=True)
-    def test_object_put_get_bucketname_key(self, object_size: ObjectSize, s3_client: S3ClientWrapper):
+    @allure.title("Put object over S3, get over HTTP with bucket name and key (s3_client={s3_client}, object_size={object_size})")
+    def test_object_put_get_bucketname_key(self, test_file: TestFile, s3_client: S3ClientWrapper):
         """
         Test that object can be put using s3-gateway interface and got via HTTP with bucket name and object key.
 
@@ -142,18 +122,55 @@ class Test_http_object(ClusterTestBase):
         Hashes must be the same.
         """
 
-        file_path = generate_file(object_size.value)
-        object_key = s3_helper.object_key_from_file_path(file_path)
-        bucket = s3_client.create_bucket(acl="public-read-write")
-        s3_client.put_object(bucket=bucket, filepath=file_path, key=object_key)
-        obj_s3 = s3_client.get_object(bucket=bucket, key=object_key)
+        object_key = s3_helper.object_key_from_file_path(test_file)
 
-        request = f"/get/{bucket}/{object_key}"
-        obj_http = get_via_http_gate(
-            cid=None,
-            oid=None,
-            node=self.cluster.cluster_nodes[0],
-            request_path=request,
-        )
-        with reporter.step("Verify hashes"):
-            assert_hashes_are_equal(file_path, obj_http, obj_s3)
+        with reporter.step("Create public bucket"):
+            bucket = s3_client.create_bucket(acl="public-read-write")
+
+        with reporter.step("Put object"):
+            s3_client.put_object(bucket, test_file, object_key)
+
+        with reporter.step("Get object via S3 gate"):
+            obj_s3 = s3_client.get_object(bucket, object_key)
+
+        with reporter.step("Get object via HTTP gate"):
+            obj_http = get_via_http_gate(bucket, object_key, node=self.cluster.cluster_nodes[0])
+
+        with reporter.step("Make sure the hashes of both objects are the same"):
+            assert_hashes_are_equal(test_file.path, obj_http, obj_s3)
+
+    @allure.title("Put multipart object over S3, get over HTTP with bucket name and key (s3_client={s3_client})")
+    def test_object_put_get_bucketname_key_multipart(self, s3_client: S3ClientWrapper):
+        parts = []
+        parts_count = 5
+        original_size = PART_SIZE * parts_count
+
+        with reporter.step("Create public container"):
+            bucket = s3_client.create_bucket(acl="public-read-write")
+
+        with reporter.step("Generate original object and split it into parts"):
+            original_file = generate_file(original_size)
+            file_parts = split_file(original_file, parts_count)
+            object_key = s3_helper.object_key_from_file_path(original_file)
+
+        with reporter.step("Create multipart and upload parts"):
+            upload_id = s3_client.create_multipart_upload(bucket, object_key)
+            for part_id, file_path in enumerate(file_parts, start=1):
+                etag = s3_client.upload_part(bucket, object_key, upload_id, part_id, file_path)
+                parts.append((part_id, etag))
+
+        with reporter.step("Check all parts are visible in bucket"):
+            got_parts = s3_client.list_parts(bucket, object_key, upload_id)
+            assert len(got_parts) == len(file_parts), f"Expected {parts_count} parts, got:\n{got_parts}"
+
+        with reporter.step("Complete multipart upload"):
+            s3_client.complete_multipart_upload(bucket, object_key, upload_id, parts)
+
+        with reporter.step("Get multipart object via S3 gate"):
+            obj_s3 = s3_client.get_object(bucket, object_key)
+
+        with reporter.step("Get multipart object via HTTP gate"):
+            obj_http = get_via_http_gate(bucket, object_key, self.cluster.cluster_nodes[0])
+
+        with reporter.step("Make sure the hashes of both objects are the same"):
+            assert_hashes_are_equal(original_file, obj_http, obj_s3)

pytest_tests/testsuites/services/http_gate/test_http_streaming.py

@@ -3,28 +3,23 @@ import logging
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
-from frostfs_testlib.steps.cli.container import create_container
-from frostfs_testlib.steps.http.http_gate import upload_via_http_gate_curl, verify_object_hash
+from frostfs_testlib.steps.http_gate import upload_via_http_gate_curl, verify_object_hash
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
+from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils.file_utils import generate_file
 
+from ....helpers.container_request import REP_2_1_4_PUBLIC, requires_container
+
 logger = logging.getLogger("NeoLogger")
 
 
 @pytest.mark.http_gate
 @pytest.mark.http_put
 class Test_http_streaming(ClusterTestBase):
-    PLACEMENT_RULE = "REP 2 IN X CBF 1 SELECT 4 FROM * AS X"
-
-    @pytest.fixture(scope="class", autouse=True)
-    @allure.title("[Class/Autouse]: Prepare wallet and deposit")
-    def prepare_wallet(self, default_wallet):
-        Test_http_streaming.wallet = default_wallet
-
     @allure.title("Put via pipe (streaming), Get over HTTP and verify hashes")
-    def test_object_can_be_put_get_by_streaming(self, complex_object_size: ObjectSize):
+    @requires_container(REP_2_1_4_PUBLIC)
+    def test_object_can_be_put_get_by_streaming(self, default_wallet: WalletInfo, container: str, complex_object_size: ObjectSize):
         """
         Test that object can be put using gRPC interface and get using HTTP.
 
@@ -37,27 +32,20 @@ class Test_http_streaming(ClusterTestBase):
         Expected result:
         Hashes must be the same.
         """
-        with reporter.step("Create public container and verify container creation"):
-            cid = create_container(
-                self.wallet,
-                shell=self.shell,
-                endpoint=self.cluster.default_rpc_endpoint,
-                rule=self.PLACEMENT_RULE,
-                basic_acl=PUBLIC_ACL,
-            )
+
         with reporter.step("Allocate big object"):
             # Generate file
             file_path = generate_file(complex_object_size.value)
 
-        with reporter.step("Put objects using curl utility and Get object and verify hashes [ get/$CID/$OID ]"):
-            oid = upload_via_http_gate_curl(
-                cid=cid, filepath=file_path, endpoint=self.cluster.default_http_gate_endpoint
-            )
+        with reporter.step("Put objects using curl utility"):
+            oid = upload_via_http_gate_curl(container, file_path, self.cluster.default_http_gate_endpoint)
+
+        with reporter.step("Get object and verify hashes [ get/$CID/$OID ]"):
             verify_object_hash(
                 oid=oid,
                 file_name=file_path,
-                wallet=self.wallet,
-                cid=cid,
+                wallet=default_wallet,
+                cid=container,
                 shell=self.shell,
                 nodes=self.cluster.storage_nodes,
                 request_node=self.cluster.cluster_nodes[0],

pytest_tests/testsuites/services/http_gate/test_http_system_header.py

@@ -7,23 +7,27 @@ import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.resources.error_patterns import OBJECT_NOT_FOUND
-from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL
-from frostfs_testlib.steps.cli.container import create_container
 from frostfs_testlib.steps.cli.object import get_netmap_netinfo, get_object_from_random_node, head_object
 from frostfs_testlib.steps.epoch import get_epoch, wait_for_epochs_align
-from frostfs_testlib.steps.http.http_gate import (
+from frostfs_testlib.steps.http_gate import (
     attr_into_str_header_curl,
     try_to_get_object_and_expect_error,
     upload_via_http_gate_curl,
     verify_object_hash,
 )
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
+from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils.file_utils import generate_file
 
+from ....helpers.container_request import REP_2_1_2_PUBLIC, requires_container
+
 logger = logging.getLogger("NeoLogger")
 EXPIRATION_TIMESTAMP_HEADER = "__SYSTEM__EXPIRATION_TIMESTAMP"
+
+# TODO: Depreacated. Use EXPIRATION_EPOCH_ATTRIBUTE from testlib
 EXPIRATION_EPOCH_HEADER = "__SYSTEM__EXPIRATION_EPOCH"
+
 EXPIRATION_DURATION_HEADER = "__SYSTEM__EXPIRATION_DURATION"
 EXPIRATION_EXPIRATION_RFC = "__SYSTEM__EXPIRATION_RFC3339"
 SYSTEM_EXPIRATION_EPOCH = "System-Expiration-Epoch"
@@ -35,29 +39,11 @@ SYSTEM_EXPIRATION_RFC3339 = "System-Expiration-RFC3339"
 @pytest.mark.http_gate
 @pytest.mark.http_put
 class Test_http_system_header(ClusterTestBase):
-    PLACEMENT_RULE = "REP 2 IN X CBF 1 SELECT 2 FROM * AS X"
-
-    @pytest.fixture(scope="class", autouse=True)
-    @allure.title("[Class/Autouse]: Prepare wallet and deposit")
-    def prepare_wallet(self, default_wallet):
-        Test_http_system_header.wallet = default_wallet
-
-    @pytest.fixture(scope="class")
-    @allure.title("Create container")
-    def user_container(self):
-        return create_container(
-            wallet=self.wallet,
-            shell=self.shell,
-            endpoint=self.cluster.default_rpc_endpoint,
-            rule=self.PLACEMENT_RULE,
-            basic_acl=PUBLIC_ACL,
-        )
-
     @pytest.fixture(scope="class")
     @allure.title("epoch_duration in seconds")
-    def epoch_duration(self) -> int:
+    def epoch_duration(self, default_wallet: WalletInfo) -> int:
         net_info = get_netmap_netinfo(
-            wallet=self.wallet,
+            wallet=default_wallet,
             endpoint=self.cluster.default_rpc_endpoint,
             shell=self.shell,
         )
@@ -80,7 +66,7 @@ class Test_http_system_header(ClusterTestBase):
         else:
             return str(calendar.timegm(future_datetime.timetuple()))
 
-    @allure.title("Check is  (header_output) Key=Value exists and equal in passed (header_to_find)")
+    @allure.title("Check if (header_output) Key=Value exists and equal in passed (header_to_find)")
     def check_key_value_presented_header(self, header_output: dict, header_to_find: dict) -> bool:
         header_att = header_output["header"]["attributes"]
         for key_to_check, val_to_check in header_to_find.items():
@@ -109,25 +95,25 @@ class Test_http_system_header(ClusterTestBase):
         ), f"Only {EXPIRATION_EXPIRATION_RFC} can be displayed in header attributes"
 
     @allure.title("Put / get / verify object and return head command result to invoker")
-    def oid_header_info_for_object(self, file_path: str, attributes: dict, user_container: str):
+    def oid_header_info_for_object(self, default_wallet: WalletInfo, container: str, test_file: str, attributes: dict):
         oid = upload_via_http_gate_curl(
-            cid=user_container,
-            filepath=file_path,
+            cid=container,
+            filepath=test_file,
             endpoint=self.cluster.default_http_gate_endpoint,
             headers=attr_into_str_header_curl(attributes),
         )
         verify_object_hash(
             oid=oid,
-            file_name=file_path,
-            wallet=self.wallet,
-            cid=user_container,
+            file_name=test_file,
+            wallet=default_wallet,
+            cid=container,
             shell=self.shell,
             nodes=self.cluster.storage_nodes,
             request_node=self.cluster.cluster_nodes[0],
         )
         head = head_object(
-            wallet=self.wallet,
-            cid=user_container,
+            wallet=default_wallet,
+            cid=container,
             oid=oid,
             shell=self.shell,
             endpoint=self.cluster.default_rpc_endpoint,
@@ -135,12 +121,13 @@ class Test_http_system_header(ClusterTestBase):
         return oid, head
 
     @allure.title("[NEGATIVE] Put object with expired epoch")
-    def test_unable_put_expired_epoch(self, user_container: str, simple_object_size: ObjectSize):
+    @requires_container(REP_2_1_2_PUBLIC)
+    def test_unable_put_expired_epoch(self, container: str, simple_object_size: ObjectSize):
         headers = attr_into_str_header_curl({"System-Expiration-Epoch": str(get_epoch(self.shell, self.cluster) - 1)})
         file_path = generate_file(simple_object_size.value)
         with reporter.step("Put object using HTTP with attribute Expiration-Epoch where epoch is expired"):
             upload_via_http_gate_curl(
-                cid=user_container,
+                cid=container,
                 filepath=file_path,
                 endpoint=self.cluster.default_http_gate_endpoint,
                 headers=headers,
@@ -148,14 +135,13 @@ class Test_http_system_header(ClusterTestBase):
             )
 
     @allure.title("[NEGATIVE] Put object with negative System-Expiration-Duration")
-    def test_unable_put_negative_duration(self, user_container: str, simple_object_size: ObjectSize):
+    @requires_container(REP_2_1_2_PUBLIC)
+    def test_unable_put_negative_duration(self, container: str, simple_object_size: ObjectSize):
         headers = attr_into_str_header_curl({"System-Expiration-Duration": "-1h"})
         file_path = generate_file(simple_object_size.value)
-        with reporter.step(
-            "Put object using HTTP with attribute System-Expiration-Duration where duration is negative"
-        ):
+        with reporter.step("Put object using HTTP with attribute System-Expiration-Duration where duration is negative"):
             upload_via_http_gate_curl(
-                cid=user_container,
+                cid=container,
                 filepath=file_path,
                 endpoint=self.cluster.default_http_gate_endpoint,
                 headers=headers,
@@ -163,28 +149,26 @@ class Test_http_system_header(ClusterTestBase):
             )
 
     @allure.title("[NEGATIVE] Put object with System-Expiration-Timestamp value in the past")
-    def test_unable_put_expired_timestamp(self, user_container: str, simple_object_size: ObjectSize):
+    @requires_container(REP_2_1_2_PUBLIC)
+    def test_unable_put_expired_timestamp(self, container: str, simple_object_size: ObjectSize):
         headers = attr_into_str_header_curl({"System-Expiration-Timestamp": "1635075727"})
         file_path = generate_file(simple_object_size.value)
-        with reporter.step(
-            "Put object using HTTP with attribute System-Expiration-Timestamp where duration is in the past"
-        ):
+        with reporter.step("Put object using HTTP with attribute System-Expiration-Timestamp where duration is in the past"):
             upload_via_http_gate_curl(
-                cid=user_container,
+                cid=container,
                 filepath=file_path,
                 endpoint=self.cluster.default_http_gate_endpoint,
                 headers=headers,
                 error_pattern=f"{EXPIRATION_TIMESTAMP_HEADER} must be in the future",
             )
 
-    @allure.title(
-        "[NEGATIVE] Put object using HTTP with attribute System-Expiration-RFC3339 where duration is in the past"
-    )
-    def test_unable_put_expired_rfc(self, user_container: str, simple_object_size: ObjectSize):
+    @allure.title("[NEGATIVE] Put object using HTTP with attribute System-Expiration-RFC3339 where duration is in the past")
+    @requires_container(REP_2_1_2_PUBLIC)
+    def test_unable_put_expired_rfc(self, container: str, simple_object_size: ObjectSize):
         headers = attr_into_str_header_curl({"System-Expiration-RFC3339": "2021-11-22T09:55:49Z"})
         file_path = generate_file(simple_object_size.value)
         upload_via_http_gate_curl(
-            cid=user_container,
+            cid=container,
             filepath=file_path,
             endpoint=self.cluster.default_http_gate_endpoint,
             headers=headers,
@@ -192,7 +176,10 @@ class Test_http_system_header(ClusterTestBase):
         )
 
     @allure.title("Priority of attributes epoch>duration (obj_size={object_size})")
-    def test_http_attr_priority_epoch_duration(self, user_container: str, object_size: ObjectSize, epoch_duration: int):
+    @requires_container(REP_2_1_2_PUBLIC)
+    def test_http_attr_priority_epoch_duration(
+        self, default_wallet: WalletInfo, container: str, object_size: ObjectSize, epoch_duration: int
+    ):
         self.tick_epoch()
         epoch_count = 1
         expected_epoch = get_epoch(self.shell, self.cluster) + epoch_count
@@ -204,9 +191,7 @@ class Test_http_system_header(ClusterTestBase):
         with reporter.step(
             f"Put objects using HTTP with attributes and head command should display {EXPIRATION_EPOCH_HEADER}: {expected_epoch} attr"
         ):
-            oid, head_info = self.oid_header_info_for_object(
-                file_path=file_path, attributes=attributes, user_container=user_container
-            )
+            oid, head_info = self.oid_header_info_for_object(default_wallet, file_path, attributes, container)
             self.validation_for_http_header_attr(head_info=head_info, expected_epoch=expected_epoch)
         with reporter.step("Check that object becomes unavailable when epoch is expired"):
             for _ in range(0, epoch_count + 1):
@@ -218,17 +203,20 @@ class Test_http_system_header(ClusterTestBase):
             with reporter.step("Check object deleted because it expires-on epoch"):
                 wait_for_epochs_align(self.shell, self.cluster)
                 try_to_get_object_and_expect_error(
-                    cid=user_container,
+                    cid=container,
                     oid=oid,
                     node=self.cluster.cluster_nodes[0],
                     error_pattern="404 Not Found",
                 )
                 # check that object is not available via grpc
                 with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
-                    get_object_from_random_node(self.wallet, user_container, oid, self.shell, self.cluster)
+                    get_object_from_random_node(default_wallet, container, oid, self.shell, self.cluster)
 
     @allure.title("Priority of attributes duration>timestamp (obj_size={object_size})")
-    def test_http_attr_priority_dur_timestamp(self, user_container: str, object_size: ObjectSize, epoch_duration: int):
+    @requires_container(REP_2_1_2_PUBLIC)
+    def test_http_attr_priority_dur_timestamp(
+        self, default_wallet: WalletInfo, container: str, object_size: ObjectSize, epoch_duration: int
+    ):
         self.tick_epoch()
         epoch_count = 2
         expected_epoch = get_epoch(self.shell, self.cluster) + epoch_count
@@ -243,9 +231,7 @@ class Test_http_system_header(ClusterTestBase):
         with reporter.step(
             f"Put objects using HTTP with attributes and head command should display {EXPIRATION_EPOCH_HEADER}: {expected_epoch} attr"
         ):
-            oid, head_info = self.oid_header_info_for_object(
-                file_path=file_path, attributes=attributes, user_container=user_container
-            )
+            oid, head_info = self.oid_header_info_for_object(default_wallet, file_path, attributes, container)
             self.validation_for_http_header_attr(head_info=head_info, expected_epoch=expected_epoch)
         with reporter.step("Check that object becomes unavailable when epoch is expired"):
             for _ in range(0, epoch_count + 1):
@@ -257,65 +243,19 @@ class Test_http_system_header(ClusterTestBase):
             with reporter.step("Check object deleted because it expires-on epoch"):
                 wait_for_epochs_align(self.shell, self.cluster)
                 try_to_get_object_and_expect_error(
-                    cid=user_container,
+                    cid=container,
                     oid=oid,
                     node=self.cluster.cluster_nodes[0],
                     error_pattern="404 Not Found",
                 )
                 # check that object is not available via grpc
                 with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
-                    get_object_from_random_node(self.wallet, user_container, oid, self.shell, self.cluster)
+                    get_object_from_random_node(default_wallet, container, oid, self.shell, self.cluster)
 
     @allure.title("Priority of attributes timestamp>Expiration-RFC (obj_size={object_size})")
-    def test_http_attr_priority_timestamp_rfc(self, user_container: str, object_size: ObjectSize, epoch_duration: int):
-        self.tick_epoch()
-        epoch_count = 2
-        expected_epoch = get_epoch(self.shell, self.cluster) + epoch_count
-        logger.info(
-            f"epoch duration={epoch_duration}, current_epoch= {get_epoch(self.shell, self.cluster)} expected_epoch {expected_epoch}"
-        )
-        attributes = {
-            SYSTEM_EXPIRATION_TIMESTAMP: self.epoch_count_into_timestamp(epoch_duration=epoch_duration, epoch=2),
-            SYSTEM_EXPIRATION_RFC3339: self.epoch_count_into_timestamp(
-                epoch_duration=epoch_duration, epoch=1, rfc3339=True
-            ),
-        }
-        file_path = generate_file(object_size.value)
-        with reporter.step(
-            f"Put objects using HTTP with attributes and head command should display {EXPIRATION_EPOCH_HEADER}: {expected_epoch} attr"
-        ):
-            oid, head_info = self.oid_header_info_for_object(
-                file_path=file_path, attributes=attributes, user_container=user_container
-            )
-            self.validation_for_http_header_attr(head_info=head_info, expected_epoch=expected_epoch)
-        with reporter.step("Check that object becomes unavailable when epoch is expired"):
-            for _ in range(0, epoch_count + 1):
-                self.tick_epoch()
-            assert (
-                get_epoch(self.shell, self.cluster) == expected_epoch + 1
-            ), f"Epochs should be equal: {get_epoch(self.shell, self.cluster)} != {expected_epoch + 1}"
-
-            with reporter.step("Check object deleted because it expires-on epoch"):
-                wait_for_epochs_align(self.shell, self.cluster)
-                try_to_get_object_and_expect_error(
-                    cid=user_container,
-                    oid=oid,
-                    node=self.cluster.cluster_nodes[0],
-                    error_pattern="404 Not Found",
-                )
-                # check that object is not available via grpc
-                with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
-                    get_object_from_random_node(self.wallet, user_container, oid, self.shell, self.cluster)
-
-    @allure.title("Object should be deleted when expiration passed (obj_size={object_size})")
-    @pytest.mark.parametrize(
-        "object_size",
-        # TODO: "complex" temporarly disabled for v0.37
-        ["simple"],
-        indirect=True,
-    )
-    def test_http_rfc_object_unavailable_after_expir(
-        self, user_container: str, object_size: ObjectSize, epoch_duration: int
+    @requires_container(REP_2_1_2_PUBLIC)
+    def test_http_attr_priority_timestamp_rfc(
+        self, default_wallet: WalletInfo, container: str, object_size: ObjectSize, epoch_duration: int
     ):
         self.tick_epoch()
         epoch_count = 2
@@ -324,19 +264,57 @@ class Test_http_system_header(ClusterTestBase):
             f"epoch duration={epoch_duration}, current_epoch= {get_epoch(self.shell, self.cluster)} expected_epoch {expected_epoch}"
         )
         attributes = {
-            SYSTEM_EXPIRATION_RFC3339: self.epoch_count_into_timestamp(
-                epoch_duration=epoch_duration, epoch=2, rfc3339=True
-            )
+            SYSTEM_EXPIRATION_TIMESTAMP: self.epoch_count_into_timestamp(epoch_duration=epoch_duration, epoch=2),
+            SYSTEM_EXPIRATION_RFC3339: self.epoch_count_into_timestamp(epoch_duration=epoch_duration, epoch=1, rfc3339=True),
         }
         file_path = generate_file(object_size.value)
         with reporter.step(
             f"Put objects using HTTP with attributes and head command should display {EXPIRATION_EPOCH_HEADER}: {expected_epoch} attr"
         ):
-            oid, head_info = self.oid_header_info_for_object(
-                file_path=file_path,
-                attributes=attributes,
-                user_container=user_container,
-            )
+            oid, head_info = self.oid_header_info_for_object(default_wallet, file_path, attributes, container)
+            self.validation_for_http_header_attr(head_info=head_info, expected_epoch=expected_epoch)
+        with reporter.step("Check that object becomes unavailable when epoch is expired"):
+            for _ in range(0, epoch_count + 1):
+                self.tick_epoch()
+            assert (
+                get_epoch(self.shell, self.cluster) == expected_epoch + 1
+            ), f"Epochs should be equal: {get_epoch(self.shell, self.cluster)} != {expected_epoch + 1}"
+
+            with reporter.step("Check object deleted because it expires-on epoch"):
+                wait_for_epochs_align(self.shell, self.cluster)
+                try_to_get_object_and_expect_error(
+                    cid=container,
+                    oid=oid,
+                    node=self.cluster.cluster_nodes[0],
+                    error_pattern="404 Not Found",
+                )
+                # check that object is not available via grpc
+                with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
+                    get_object_from_random_node(default_wallet, container, oid, self.shell, self.cluster)
+
+    @allure.title("Object should be deleted when expiration passed (obj_size={object_size})")
+    @pytest.mark.parametrize(
+        "object_size",
+        # TODO: "complex" temporarly disabled for v0.37
+        ["simple"],
+        indirect=True,
+    )
+    @requires_container(REP_2_1_2_PUBLIC)
+    def test_http_rfc_object_unavailable_after_expir(
+        self, default_wallet: WalletInfo, container: str, object_size: ObjectSize, epoch_duration: int
+    ):
+        self.tick_epoch()
+        epoch_count = 2
+        expected_epoch = get_epoch(self.shell, self.cluster) + epoch_count
+        logger.info(
+            f"epoch duration={epoch_duration}, current_epoch= {get_epoch(self.shell, self.cluster)} expected_epoch {expected_epoch}"
+        )
+        attributes = {SYSTEM_EXPIRATION_RFC3339: self.epoch_count_into_timestamp(epoch_duration=epoch_duration, epoch=2, rfc3339=True)}
+        file_path = generate_file(object_size.value)
+        with reporter.step(
+            f"Put objects using HTTP with attributes and head command should display {EXPIRATION_EPOCH_HEADER}: {expected_epoch} attr"
+        ):
+            oid, head_info = self.oid_header_info_for_object(default_wallet, file_path, attributes, container)
             self.validation_for_http_header_attr(head_info=head_info, expected_epoch=expected_epoch)
         with reporter.step("Check that object becomes unavailable when epoch is expired"):
             for _ in range(0, epoch_count + 1):
@@ -349,11 +327,11 @@ class Test_http_system_header(ClusterTestBase):
             with reporter.step("Check object deleted because it expires-on epoch"):
                 wait_for_epochs_align(self.shell, self.cluster)
                 try_to_get_object_and_expect_error(
-                    cid=user_container,
+                    cid=container,
                     oid=oid,
                     node=self.cluster.cluster_nodes[0],
                     error_pattern="404 Not Found",
                 )
                 # check that object is not available via grpc
                 with pytest.raises(Exception, match=OBJECT_NOT_FOUND):
-                    get_object_from_random_node(self.wallet, user_container, oid, self.shell, self.cluster)
+                    get_object_from_random_node(default_wallet, container, oid, self.shell, self.cluster)

pytest_tests/testsuites/services/s3_gate/test_s3_ACL.py

@@ -1,14 +1,15 @@
 import allure
 import pytest
 from frostfs_testlib import reporter
+from frostfs_testlib.clients import S3ClientWrapper
 from frostfs_testlib.resources.error_patterns import S3_BUCKET_DOES_NOT_ALLOW_ACL
 from frostfs_testlib.resources.s3_acl_grants import PRIVATE_GRANTS, PUBLIC_READ_GRANTS, PUBLIC_READ_WRITE_GRANTS
-from frostfs_testlib.s3 import S3ClientWrapper
-from frostfs_testlib.steps.s3 import s3_helper
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.utils.file_utils import generate_file
 
 
+@pytest.mark.nightly
 @pytest.mark.acl
 @pytest.mark.s3_gate
 class TestS3GateACL:
@@ -32,32 +33,32 @@ class TestS3GateACL:
     def test_s3_create_bucket_with_ACL(self, s3_client: S3ClientWrapper):
         with reporter.step("Create bucket with ACL private"):
             bucket = s3_client.create_bucket(object_lock_enabled_for_bucket=True, acl="private")
-            bucket_grants = s3_client.get_bucket_acl(bucket)
+            bucket_grants = s3_client.get_bucket_acl(bucket).get("Grants")
             s3_helper.verify_acl_permissions(bucket_grants, PRIVATE_GRANTS)
 
         with reporter.step("Create bucket with ACL public-read"):
             read_bucket = s3_client.create_bucket(object_lock_enabled_for_bucket=True, acl="public-read")
-            bucket_grants = s3_client.get_bucket_acl(read_bucket)
+            bucket_grants = s3_client.get_bucket_acl(read_bucket).get("Grants")
             s3_helper.verify_acl_permissions(bucket_grants, PUBLIC_READ_GRANTS)
 
         with reporter.step("Create bucket with ACL public-read-write"):
             public_rw_bucket = s3_client.create_bucket(object_lock_enabled_for_bucket=True, acl="public-read-write")
-            bucket_grants = s3_client.get_bucket_acl(public_rw_bucket)
+            bucket_grants = s3_client.get_bucket_acl(public_rw_bucket).get("Grants")
             s3_helper.verify_acl_permissions(bucket_grants, PUBLIC_READ_WRITE_GRANTS)
 
     @allure.title("Bucket ACL (s3_client={s3_client})")
     def test_s3_bucket_ACL(self, s3_client: S3ClientWrapper):
         with reporter.step("Create bucket with public-read-write ACL"):
             bucket = s3_client.create_bucket(object_lock_enabled_for_bucket=True, acl="public-read-write")
-            bucket_grants = s3_client.get_bucket_acl(bucket)
+            bucket_grants = s3_client.get_bucket_acl(bucket).get("Grants")
             s3_helper.verify_acl_permissions(bucket_grants, PUBLIC_READ_WRITE_GRANTS)
 
         with reporter.step("Change bucket ACL to private"):
             s3_client.put_bucket_acl(bucket, acl="private")
-            bucket_grants = s3_client.get_bucket_acl(bucket)
+            bucket_grants = s3_client.get_bucket_acl(bucket).get("Grants")
             s3_helper.verify_acl_permissions(bucket_grants, PRIVATE_GRANTS)
 
         with reporter.step("Change bucket ACL to public-read"):
             s3_client.put_bucket_acl(bucket, acl="public-read")
-            bucket_grants = s3_client.get_bucket_acl(bucket)
+            bucket_grants = s3_client.get_bucket_acl(bucket).get("Grants")
             s3_helper.verify_acl_permissions(bucket_grants, PUBLIC_READ_GRANTS)

pytest_tests/testsuites/services/s3_gate/test_s3_bucket.py

@@ -1,14 +1,23 @@
+import string
 from datetime import datetime, timedelta
 
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.s3 import S3ClientWrapper, VersioningStatus
-from frostfs_testlib.steps.s3 import s3_helper
+from frostfs_testlib.clients.s3 import S3ClientWrapper, VersioningStatus
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
+from frostfs_testlib.utils import string_utils
 from frostfs_testlib.utils.file_utils import generate_file
 
+VALID_SYMBOLS_WITHOUT_DOT = string.ascii_lowercase + string.digits + "-"
+VALID_AND_INVALID_SYMBOLS = string.ascii_letters + string.punctuation
 
+# TODO: The dot symbol is temporarily not supported.
+VALID_SYMBOLS_WITH_DOT = VALID_SYMBOLS_WITHOUT_DOT + "."
+
+
+@pytest.mark.nightly
 @pytest.mark.s3_gate
 @pytest.mark.s3_gate_bucket
 class TestS3GateBucket:
@@ -139,3 +148,87 @@ class TestS3GateBucket:
             s3_client.delete_bucket(bucket)
             with pytest.raises(Exception, match=r".*Not Found.*"):
                 s3_client.head_bucket(bucket)
+
+    @allure.title("Create bucket with valid name length (s3_client={s3_client}, length={length})")
+    @pytest.mark.parametrize("length", [3, 4, 32, 62, 63])
+    def test_s3_create_bucket_with_valid_length(self, s3_client: S3ClientWrapper, length: int):
+        bucket_name = string_utils.random_string(length, VALID_SYMBOLS_WITHOUT_DOT)
+        while not (bucket_name[0].isalnum() and bucket_name[-1].isalnum()):
+            bucket_name = string_utils.random_string(length, VALID_SYMBOLS_WITHOUT_DOT)
+
+        with reporter.step("Create bucket with valid name length"):
+            s3_client.create_bucket(bucket_name)
+
+        with reporter.step("Check bucket name in buckets"):
+            assert bucket_name in s3_client.list_buckets()
+
+    @allure.title("[NEGATIVE] Bucket with invalid name length should not be created (s3_client={s3_client}, length={length})")
+    @pytest.mark.parametrize("length", [2, 64, 254, 255, 256])
+    def test_s3_create_bucket_with_invalid_length(self, s3_client: S3ClientWrapper, length: int):
+        bucket_name = string_utils.random_string(length, VALID_SYMBOLS_WITHOUT_DOT)
+        while not (bucket_name[0].isalnum() and bucket_name[-1].isalnum()):
+            bucket_name = string_utils.random_string(length, VALID_SYMBOLS_WITHOUT_DOT)
+
+        with reporter.step("Create bucket with invalid name length and catch exception"):
+            with pytest.raises(Exception, match=".*(?:InvalidBucketName|Invalid bucket name).*"):
+                s3_client.create_bucket(bucket_name)
+
+    @allure.title("[NEGATIVE] Bucket with invalid name should not be created (s3_client={s3_client}, bucket_name={bucket_name})")
+    @pytest.mark.parametrize(
+        "bucket_name",
+        [
+            "BUCKET-1",
+            "buckeT-2",
+            # The following case for AWS CLI is not handled correctly
+            # "-bucket-3",
+            "bucket-4-",
+            ".bucket-5",
+            "bucket-6.",
+            "bucket..7",
+            "bucket+8",
+            "bucket_9",
+            "bucket 10",
+            "127.10.5.11",
+            "xn--bucket-12",
+            "bucket-13-s3alias",
+            # The following names can be used in FrostFS but are prohibited by the AWS specification.
+            # "sthree-bucket-14"
+            # "sthree-configurator-bucket-15"
+            # "amzn-s3-demo-bucket-16"
+            # "sthree-bucket-17"
+            # "bucket-18--ol-s3"
+            # "bucket-19--x-s3"
+            # "bucket-20.mrap"
+        ],
+    )
+    def test_s3_create_bucket_with_invalid_name(self, s3_client: S3ClientWrapper, bucket_name: str):
+        with reporter.step("Create bucket with invalid name and catch exception"):
+            with pytest.raises(Exception, match=".*(?:InvalidBucketName|Invalid bucket name).*"):
+                s3_client.create_bucket(bucket_name)
+
+    @allure.title("[NEGATIVE] Delete non-empty bucket (s3_client={s3_client})")
+    def test_s3_check_availability_non_empty_bucket_after_deleting(
+        self,
+        bucket: str,
+        simple_object_size: ObjectSize,
+        s3_client: S3ClientWrapper,
+    ):
+        object_path = generate_file(simple_object_size.value)
+        object_name = s3_helper.object_key_from_file_path(object_path)
+
+        with reporter.step("Put object into bucket"):
+            s3_client.put_object(bucket, object_path)
+
+        with reporter.step("Check that object appears in bucket"):
+            objects = s3_client.list_objects(bucket)
+            assert objects, f"Expected bucket with object, got empty {objects}"
+            assert object_name in objects, f"Object {object_name} not found in bucket object list {objects}"
+
+        with reporter.step("Try to delete not empty bucket and get error"):
+            with pytest.raises(Exception, match=r".*The bucket you tried to delete is not empty.*"):
+                s3_client.delete_bucket(bucket)
+
+        with reporter.step("Check bucket availability"):
+            objects = s3_client.list_objects(bucket)
+            assert objects, f"Expected bucket with object, got empty {objects}"
+            assert object_name in objects, f"Object {object_name} not found in bucket object list {objects}"

pytest_tests/testsuites/services/s3_gate/test_s3_locking.py

@@ -4,8 +4,8 @@ from datetime import datetime, timedelta
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.s3 import S3ClientWrapper
-from frostfs_testlib.steps.s3 import s3_helper
+from frostfs_testlib.clients import S3ClientWrapper
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.utils.file_utils import generate_file, generate_file_with_content
 
@@ -22,14 +22,13 @@ def bucket_no_lock(s3_client: S3ClientWrapper):
     return s3_client.create_bucket(object_lock_enabled_for_bucket=False)
 
 
+@pytest.mark.nightly
 @pytest.mark.s3_gate
 @pytest.mark.s3_gate_locking
 @pytest.mark.parametrize("version_id", [None, "second"])
 class TestS3GateLocking:
     @allure.title("Retention period and legal lock on object (version_id={version_id}, s3_client={s3_client})")
-    def test_s3_object_locking(
-        self, s3_client: S3ClientWrapper, bucket_w_lock: str, version_id: str, simple_object_size: ObjectSize
-    ):
+    def test_s3_object_locking(self, s3_client: S3ClientWrapper, bucket_w_lock: str, version_id: str, simple_object_size: ObjectSize):
         file_path = generate_file(simple_object_size.value)
         file_name = s3_helper.object_key_from_file_path(file_path)
         retention_period = 2
@@ -73,9 +72,7 @@ class TestS3GateLocking:
                 s3_client.delete_object(bucket_w_lock, file_name, version_id)
 
     @allure.title("Impossible to change retention mode COMPLIANCE (version_id={version_id}, s3_client={s3_client})")
-    def test_s3_mode_compliance(
-        self, s3_client: S3ClientWrapper, bucket_w_lock: str, version_id: str, simple_object_size: ObjectSize
-    ):
+    def test_s3_mode_compliance(self, s3_client: S3ClientWrapper, bucket_w_lock: str, version_id: str, simple_object_size: ObjectSize):
         file_path = generate_file(simple_object_size.value)
         file_name = s3_helper.object_key_from_file_path(file_path)
         retention_period = 2
@@ -105,9 +102,7 @@ class TestS3GateLocking:
                 s3_client.put_object_retention(bucket_w_lock, file_name, retention, version_id)
 
     @allure.title("Change retention mode GOVERNANCE (version_id={version_id}, s3_client={s3_client})")
-    def test_s3_mode_governance(
-        self, s3_client: S3ClientWrapper, bucket_w_lock: str, version_id: str, simple_object_size: ObjectSize
-    ):
+    def test_s3_mode_governance(self, s3_client: S3ClientWrapper, bucket_w_lock: str, version_id: str, simple_object_size: ObjectSize):
         file_path = generate_file(simple_object_size.value)
         file_name = s3_helper.object_key_from_file_path(file_path)
         retention_period = 3
@@ -155,12 +150,8 @@ class TestS3GateLocking:
             s3_client.put_object_retention(bucket_w_lock, file_name, retention, version_id, True)
             s3_helper.assert_object_lock_mode(s3_client, bucket_w_lock, file_name, "GOVERNANCE", date_obj, "OFF")
 
-    @allure.title(
-        "[NEGATIVE] Lock object in bucket with disabled locking (version_id={version_id}, s3_client={s3_client})"
-    )
-    def test_s3_legal_hold(
-        self, s3_client: S3ClientWrapper, bucket_no_lock: str, version_id: str, simple_object_size: ObjectSize
-    ):
+    @allure.title("[NEGATIVE] Lock object in bucket with disabled locking (version_id={version_id}, s3_client={s3_client})")
+    def test_s3_legal_hold(self, s3_client: S3ClientWrapper, bucket_no_lock: str, version_id: str, simple_object_size: ObjectSize):
         file_path = generate_file(simple_object_size.value)
         file_name = s3_helper.object_key_from_file_path(file_path)
 
@@ -174,6 +165,7 @@ class TestS3GateLocking:
                 s3_client.put_object_legal_hold(bucket_no_lock, file_name, "ON", version_id)
 
 
+@pytest.mark.nightly
 @pytest.mark.s3_gate
 class TestS3GateLockingBucket:
     @allure.title("Bucket Lock (s3_client={s3_client})")

pytest_tests/testsuites/services/s3_gate/test_s3_multipart.py

@@ -1,10 +1,9 @@
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.s3 import S3ClientWrapper, VersioningStatus
-from frostfs_testlib.s3.interfaces import BucketContainerResolver
+from frostfs_testlib.clients.s3 import BucketContainerResolver, S3ClientWrapper, VersioningStatus
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.steps.cli.container import list_objects
-from frostfs_testlib.steps.s3 import s3_helper
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
@@ -14,6 +13,7 @@ from frostfs_testlib.utils.file_utils import generate_file, get_file_hash, split
 PART_SIZE = 5 * 1024 * 1024
 
 
+@pytest.mark.nightly
 @pytest.mark.s3_gate
 @pytest.mark.s3_gate_multipart
 class TestS3GateMultipart(ClusterTestBase):

pytest_tests/testsuites/services/s3_gate/test_s3_object.py

@@ -8,23 +8,19 @@ from typing import Literal
 import allure
 import pytest
 from frostfs_testlib import reporter
+from frostfs_testlib.clients import AwsCliClient, S3ClientWrapper
+from frostfs_testlib.clients.s3 import VersioningStatus
 from frostfs_testlib.resources.common import ASSETS_DIR, DEFAULT_WALLET_PASS
 from frostfs_testlib.resources.error_patterns import S3_BUCKET_DOES_NOT_ALLOW_ACL, S3_MALFORMED_XML_REQUEST
 from frostfs_testlib.resources.s3_acl_grants import PRIVATE_GRANTS
-from frostfs_testlib.s3 import AwsCliClient, S3ClientWrapper, VersioningStatus
-from frostfs_testlib.steps.s3 import s3_helper
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.testing.test_control import expect_not_raises
 from frostfs_testlib.utils import wallet_utils
-from frostfs_testlib.utils.file_utils import (
-    TestFile,
-    concat_files,
-    generate_file,
-    generate_file_with_content,
-    get_file_hash,
-)
+from frostfs_testlib.utils.file_utils import TestFile, concat_files, generate_file, generate_file_with_content, get_file_hash
 
 
+@pytest.mark.nightly
 @pytest.mark.s3_gate
 @pytest.mark.s3_gate_object
 class TestS3GateObject:
@@ -356,9 +352,7 @@ class TestS3GateObject:
         s3_helper.set_bucket_versioning(s3_client, bucket, VersioningStatus.ENABLED)
         with reporter.step("Put several versions of object into bucket"):
             version_id_1 = s3_client.put_object(bucket, file_name_simple)
-            file_name_1 = generate_file_with_content(
-                simple_object_size.value, file_path=file_name_simple, content=version_2_content
-            )
+            file_name_1 = generate_file_with_content(simple_object_size.value, file_path=file_name_simple, content=version_2_content)
             version_id_2 = s3_client.put_object(bucket, file_name_1)
 
         with reporter.step("Get first version of object"):
@@ -444,9 +438,7 @@ class TestS3GateObject:
             assert get_file_hash(con_file_1) == get_file_hash(file_name_1), "Hashes must be the same"
 
         with reporter.step("Get object"):
-            object_3_part_1 = s3_client.get_object(
-                bucket, file_name, object_range=[0, int(simple_object_size.value / 3)]
-            )
+            object_3_part_1 = s3_client.get_object(bucket, file_name, object_range=[0, int(simple_object_size.value / 3)])
             object_3_part_2 = s3_client.get_object(
                 bucket,
                 file_name,
@@ -560,9 +552,7 @@ class TestS3GateObject:
             elif list_type == "v2":
                 list_obj = s3_client.list_objects_v2(bucket)
             assert len(list_obj) == 2, "bucket should have 2 objects"
-            assert (
-                list_obj.sort() == [file_name, file_name_2].sort()
-            ), f"bucket should have object key {file_name, file_name_2}"
+            assert list_obj.sort() == [file_name, file_name_2].sort(), f"bucket should have object key {file_name, file_name_2}"
 
         with reporter.step("Delete object"):
             delete_obj = s3_client.delete_object(bucket, file_name)
@@ -695,13 +685,9 @@ class TestS3GateObject:
             with pytest.raises(Exception, match=S3_BUCKET_DOES_NOT_ALLOW_ACL):
                 s3_client.put_object(bucket, file_path, grant_full_control=f"id={second_wallet_public_key}")
 
-        with reporter.step(
-            "[NEGATIVE] Put object with --grant-read uri=http://acs.amazonaws.com/groups/global/AllUsers"
-        ):
+        with reporter.step("[NEGATIVE] Put object with --grant-read uri=http://acs.amazonaws.com/groups/global/AllUsers"):
             with pytest.raises(Exception, match=S3_BUCKET_DOES_NOT_ALLOW_ACL):
-                s3_client.put_object(
-                    bucket, file_path, grant_read="uri=http://acs.amazonaws.com/groups/global/AllUsers"
-                )
+                s3_client.put_object(bucket, file_path, grant_read="uri=http://acs.amazonaws.com/groups/global/AllUsers")
 
     @allure.title("Put object with lock-mode (s3_client={s3_client})")
     def test_s3_put_object_lock_mode(
@@ -727,9 +713,7 @@ class TestS3GateObject:
             )
             s3_helper.assert_object_lock_mode(s3_client, bucket, file_name, "GOVERNANCE", date_obj, "OFF")
 
-        with reporter.step(
-            "Put new version of object with [--object-lock-mode COMPLIANCE] и [--object-lock-retain-until-date +3days]"
-        ):
+        with reporter.step("Put new version of object with [--object-lock-mode COMPLIANCE] и [--object-lock-retain-until-date +3days]"):
             date_obj = datetime.utcnow() + timedelta(days=2)
             generate_file_with_content(simple_object_size.value, file_path=file_path_1)
             s3_client.put_object(
@@ -740,9 +724,7 @@ class TestS3GateObject:
             )
             s3_helper.assert_object_lock_mode(s3_client, bucket, file_name, "COMPLIANCE", date_obj, "OFF")
 
-        with reporter.step(
-            "Put new version of object with [--object-lock-mode COMPLIANCE] и [--object-lock-retain-until-date +2days]"
-        ):
+        with reporter.step("Put new version of object with [--object-lock-mode COMPLIANCE] и [--object-lock-retain-until-date +2days]"):
             date_obj = datetime.utcnow() + timedelta(days=3)
             generate_file_with_content(simple_object_size.value, file_path=file_path_1)
             s3_client.put_object(
@@ -809,9 +791,7 @@ class TestS3GateObject:
 
             with reporter.step(f"Check all objects put in bucket_{i} successfully"):
                 bucket_objects = s3_client.list_objects_v2(bucket)
-                assert set(put_objects) == set(
-                    bucket_objects
-                ), f"Expected all objects {put_objects} in objects list {bucket_objects}"
+                assert set(put_objects) == set(bucket_objects), f"Expected all objects {put_objects} in objects list {bucket_objects}"
 
         with reporter.step("Delete some objects from bucket_1 one by one"):
             objects_to_delete_b1 = random.sample(put_objects, k=max_delete_objects)
@@ -871,9 +851,7 @@ class TestS3GateObject:
         with reporter.step("Check these are the same objects"):
             for obj_key in objects:
                 got_object = s3_client.get_object(bucket, obj_key)
-                assert get_file_hash(got_object) == get_file_hash(
-                    key_to_path.get(obj_key)
-                ), "Expected hashes are the same"
+                assert get_file_hash(got_object) == get_file_hash(key_to_path.get(obj_key)), "Expected hashes are the same"
                 obj_head = s3_client.head_object(bucket, obj_key)
                 assert obj_head.get("Metadata") == object_metadata, f"Metadata of object is {object_metadata}"
                 object_grants = s3_client.get_object_acl(bucket, obj_key)
@@ -890,11 +868,7 @@ class TestS3GateObject:
 
         with reporter.step("Put object"):
             test_file = generate_file(simple_object_size.value)
-            obj_key = (
-                "/"
-                + "/".join(["".join(random.choices(key_characters_sample, k=5)) for _ in range(10)])
-                + "/test_file_1"
-            )
+            obj_key = "/" + "/".join(["".join(random.choices(key_characters_sample, k=5)) for _ in range(10)]) + "/test_file_1"
             s3_client.put_object(bucket, test_file, obj_key)
 
         with reporter.step("Check object can be downloaded"):

pytest_tests/testsuites/services/s3_gate/test_s3_object_patch.py

@@ -0,0 +1,623 @@
+import random
+import time
+from datetime import datetime
+from email.utils import formatdate
+
+import allure
+import pytest
+from frostfs_testlib import reporter
+from frostfs_testlib.cli.generic_cli import GenericCli
+from frostfs_testlib.clients import Boto3ClientWrapper, S3ClientWrapper, S3HttpClient
+from frostfs_testlib.clients.s3 import VersioningStatus
+from frostfs_testlib.credentials.interfaces import CredentialsProvider, User
+from frostfs_testlib.shell.interfaces import CommandOptions
+from frostfs_testlib.shell.local_shell import LocalShell
+from frostfs_testlib.steps import s3_helper
+from frostfs_testlib.storage.cluster import Cluster, ClusterNode
+from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
+from frostfs_testlib.storage.dataclasses.policy import PlacementPolicy
+from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
+from frostfs_testlib.utils.file_utils import TestFile, generate_file, get_file_hash, split_file
+from frostfs_testlib.utils.string_utils import unique_name
+
+from ....resources.common import S3_POLICY_FILE_LOCATION
+
+FIVE_GIGABYTES = 5_368_709_120
+PART_SIZE_FOR_MULTIPART = 5 * 1024 * 1024
+
+
+@reporter.step("Allow patch for bucket")
+def allow_patch_for_bucket(s3_client: S3ClientWrapper, bucket: str):
+    s3_client.put_bucket_policy(
+        bucket,
+        policy={
+            "Version": "2012-10-17",
+            "Id": "aaaa-bbbb-cccc-dddd",
+            "Statement": [
+                {
+                    "Sid": "AddPerm",
+                    "Effect": "Allow",
+                    "Principal": "*",
+                    "Action": ["s3:PatchObject"],
+                    "Resource": [f"arn:aws:s3:::{bucket}/*"],
+                },
+            ],
+        },
+    )
+
+
+def pytest_generate_tests(metafunc: pytest.Metafunc):
+    if "s3_client" not in metafunc.fixturenames:
+        return
+    metafunc.parametrize("s3_policy", [S3_POLICY_FILE_LOCATION], ids=["s3policy"], indirect=True)
+
+
+@pytest.fixture(scope="session", params=[pytest.param("rep3", marks=pytest.mark.rep), pytest.param("ec3.1", marks=pytest.mark.ec)])
+def placement_policy(request: pytest.FixtureRequest) -> PlacementPolicy:
+    if request.param == "ec3.1":
+        return PlacementPolicy("ec3.1", "ec3.1")
+    return PlacementPolicy("rep3", "rep3")
+
+
+@pytest.fixture(scope="session")
+def versioning_status(request: pytest.FixtureRequest) -> VersioningStatus:
+    if "param" in request.__dict__:
+        return request.param
+    return VersioningStatus.UNDEFINED
+
+
+@allure.title("[Class] Create bucket")
+@pytest.fixture(scope="class")
+def bucket(s3_client: S3ClientWrapper, versioning_status: VersioningStatus, placement_policy: PlacementPolicy) -> str:
+    with reporter.step(f"Create bucket with location constraint {placement_policy.value}"):
+        bucket = s3_client.create_bucket(location_constraint=placement_policy.value)
+
+    s3_helper.set_bucket_versioning(s3_client, bucket, versioning_status)
+    allow_patch_for_bucket(s3_client, bucket)
+    return bucket
+
+
+@pytest.fixture(scope="function")
+def original_object(s3_client: S3ClientWrapper, bucket: str, test_file: TestFile) -> str:
+    with reporter.step("Put object"):
+        key = s3_helper.object_key_from_file_path(test_file)
+        s3_client.put_object(bucket, test_file, key)
+
+    return key
+
+
+@allure.title("[Session]: Create S3 client for another user")
+@pytest.fixture(scope="session")
+def another_s3_client(
+    users_pool: list[User],
+    s3_policy: str | None,
+    cluster: Cluster,
+    credentials_provider: CredentialsProvider,
+    s3_client: S3ClientWrapper,
+) -> S3ClientWrapper:
+    user = users_pool[0]
+    node = cluster.cluster_nodes[0]
+    credentials_provider.S3.provide(user, node, s3_policy)
+    s3_client_cls = type(s3_client)
+    return s3_client_cls(user.s3_credentials.access_key, user.s3_credentials.secret_key, cluster.default_s3_gate_endpoint)
+
+
+@allure.title("[Class] Create bucket under another user")
+@pytest.fixture(scope="class")
+def another_bucket(another_s3_client: S3ClientWrapper, versioning_status: VersioningStatus, placement_policy: PlacementPolicy) -> str:
+    with reporter.step(f"Create bucket with location constraint {placement_policy.value}"):
+        bucket = another_s3_client.create_bucket(location_constraint=placement_policy.value)
+
+    s3_helper.set_bucket_versioning(another_s3_client, bucket, versioning_status)
+    allow_patch_for_bucket(another_s3_client, bucket)
+    return bucket
+
+
+@pytest.mark.nightly
+@pytest.mark.s3_gate
+class TestS3ObjectPatch(ClusterTestBase):
+    @allure.title("Patch simple object payload (range={patch_range}, s3_client={s3_client}, policy={placement_policy})")
+    @pytest.mark.parametrize("object_size", ["simple"], indirect=True)
+    @pytest.mark.parametrize(
+        "patch_range",
+        # String "object" denotes size of object.
+        ["0:19", "500:550", "object/2-100:object/2+200", "object-1:object", "object:object", "object:object+123"],
+    )
+    def test_patch_simple_object_payload(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+        object_size: ObjectSize,
+        patch_range: str,
+    ):
+        start, end = s3_helper.get_range_relative_to_object(patch_range, object_size.value, int_values=True)
+        content_size = end - start + 1
+        content_range = f"bytes {start}-{end}/*"
+
+        with reporter.step("Generate payload object"):
+            content_file = generate_file(content_size)
+
+        with reporter.step("Patch simple object"):
+            s3_http_client.patch_object(bucket, original_object, content_file, content_range)
+
+        with reporter.step("Get patched part of object and make sure it has changed correctly"):
+            patched_file_part = s3_client.get_object(bucket, original_object, object_range=(start, end))
+            assert get_file_hash(patched_file_part) == get_file_hash(
+                content_file
+            ), "Expected content hash did not match actual content hash"
+
+    @allure.title("Patch complex object payload (range={patch_range}, s3_client={s3_client}, policy={placement_policy})")
+    @pytest.mark.parametrize("object_size", ["complex"], indirect=True)
+    @pytest.mark.parametrize(
+        "patch_range",
+        # Strings "object" and "part" denote size of object and its part, respectively.
+        ["part:part+100", "object-part:object", "0:part", "part*2:part*3", "part-1:part*2", "part+1:part*2-1"],
+    )
+    def test_patch_complex_object_payload(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+        object_size: ObjectSize,
+        max_object_size: int,
+        patch_range: str,
+    ):
+        start, end = s3_helper.get_range_relative_to_object(patch_range, object_size.value, max_object_size, int_values=True)
+        content_size = end - start + 1
+        content_range = f"bytes {start}-{end}/*"
+
+        with reporter.step("Generate payload object"):
+            content_file = generate_file(content_size)
+
+        with reporter.step("Patch complex object"):
+            s3_http_client.patch_object(bucket, original_object, content_file, content_range)
+
+        with reporter.step("Get patched part of object and make sure it has changed correctly"):
+            patched_file_part = s3_client.get_object(bucket, original_object, object_range=(start, end))
+            assert get_file_hash(patched_file_part) == get_file_hash(
+                content_file
+            ), "Expected content hash did not match actual content hash"
+
+    @allure.title(
+        "Patch object with fulfilled If-Match condition (s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    def test_patch_with_fulfilled_if_match_contidion(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+    ):
+        start, end = 100, 199
+        content_size = end - start + 1
+        content_range = f"bytes {start}-{end}/*"
+
+        with reporter.step("Generate payload object"):
+            content_file = generate_file(content_size)
+            expected_hash = get_file_hash(content_file)
+
+        with reporter.step("Get object ETag attribute"):
+            object_info = s3_client.head_object(bucket, original_object)
+            etag = object_info["ETag"]
+
+        with reporter.step("Patch object with If-Match header"):
+            s3_http_client.patch_object(bucket, original_object, content_file, content_range, if_match=etag)
+
+        with reporter.step("Get patched object and make sure it has changed correctly"):
+            patched_file = s3_client.get_object(bucket, original_object)
+            patched_hash = get_file_hash(patched_file, offset=start, len=content_size)
+            assert patched_hash == expected_hash, "Expected content hash did not match actual content hash"
+
+    @allure.title(
+        "[NEGATIVE] Patch cannot be applied with failed If-Match condition "
+        "(s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    def test_patch_with_failed_if_match_condition(self, s3_http_client: S3HttpClient, bucket: str, original_object: str):
+        with reporter.step("Try patch object with If-Match header and get exception"):
+            with pytest.raises(Exception, match="PreconditionFailed"):
+                s3_http_client.patch_object(bucket, original_object, "content", "bytes 0-6/*", if_match="nonexistentetag")
+
+    @allure.title(
+        "Patch object with fulfilled If-Unmodified-Since condition "
+        "(s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    def test_patch_with_fulfilled_if_unmodified_since_condition(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+    ):
+        start, end = 235, 341
+        content_size = end - start + 1
+        content_range = f"bytes {start}-{end}/*"
+
+        with reporter.step("Generate payload object"):
+            content_file = generate_file(content_size)
+            expected_hash = get_file_hash(content_file)
+
+        with reporter.step("Get object LastModified attribute"):
+            response = s3_client.head_object(bucket, original_object)
+            if isinstance(response["LastModified"], str):
+                response["LastModified"] = datetime.fromisoformat(response["LastModified"])
+
+            # Convert datetime to RFC 7232 format
+            last_modified = formatdate(response["LastModified"].timestamp(), localtime=False, usegmt=True)
+
+        with reporter.step("Patch object with If-Unmodified-Since header"):
+            s3_http_client.patch_object(bucket, original_object, content_file, content_range, if_unmodified_since=last_modified)
+
+        with reporter.step("Get patched object and make sure it has changed correctly"):
+            patched_file = s3_client.get_object(bucket, original_object)
+            patched_hash = get_file_hash(patched_file, offset=start, len=content_size)
+            assert patched_hash == expected_hash, "Expected content hash did not match actual content hash"
+
+    @allure.title(
+        "[NEGATIVE] Patch cannot be applied with failed If-Unmodified-Since condition "
+        "(s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    def test_patch_with_failed_if_unmodified_since_condition(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+        test_file: TestFile,
+    ):
+        with reporter.step("Get original object LastModified attribute"):
+            response = s3_client.head_object(bucket, original_object)
+            if isinstance(response["LastModified"], str):
+                response["LastModified"] = datetime.fromisoformat(response["LastModified"])
+
+            # Convert datetime to RFC 7232 format
+            previous_last_modified = formatdate(response["LastModified"].timestamp(), localtime=False, usegmt=True)
+
+        with reporter.step("Wait two seconds for LastModified to update"):
+            # Next PUT for a simple object occurs at the same second the object was initially loaded,
+            # so the LastModified attribute "as if" does not change after the operation.
+            time.sleep(2)
+
+        with reporter.step("Put new data for existing object"):
+            s3_client.put_object(bucket, test_file, original_object)
+
+        with reporter.step("Get object LastModified attribute with new data and make sure it has changed"):
+            response = s3_client.head_object(bucket, original_object)
+            if isinstance(response["LastModified"], str):
+                response["LastModified"] = datetime.fromisoformat(response["LastModified"])
+
+            # Convert datetime to RFC 7232 format
+            last_modified = formatdate(response["LastModified"].timestamp(), localtime=False, usegmt=True)
+            assert last_modified != previous_last_modified, f"Attribute LastModified was expected to change: {last_modified}"
+
+        with reporter.step("Try patch object with If-Unmodified-Since header and get exception"):
+            with pytest.raises(Exception, match="PreconditionFailed"):
+                s3_http_client.patch_object(bucket, original_object, b"modify", "bytes 0-5/*", if_unmodified_since=previous_last_modified)
+
+    @allure.title(
+        "Patch object with fulfilled x-amz-expected-bucket-owner condition "
+        "(s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    def test_patch_with_fulfilled_if_expected_bucket_owner_condition(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+    ):
+        start, end = 512, 749
+        content_size = end - start + 1
+        content_range = f"bytes {start}-{end}/*"
+
+        with reporter.step("Generate payload object"):
+            content_file = generate_file(content_size)
+            expected_hash = get_file_hash(content_file)
+
+        with reporter.step("Get bucket owner ID"):
+            bucket_acl = s3_client.get_bucket_acl(bucket)
+            expected_bucket_owner = bucket_acl["Owner"]["DisplayName"]
+
+        with reporter.step("Patch object with x-amz-expected-bucket-owner header"):
+            s3_http_client.patch_object(
+                bucket,
+                original_object,
+                content_file,
+                content_range,
+                x_amz_expected_bucket_owner=expected_bucket_owner,
+            )
+
+        with reporter.step("Get patched object and make sure it has changed correctly"):
+            patched_file = s3_client.get_object(bucket, original_object)
+            patched_hash = get_file_hash(patched_file, offset=start, len=content_size)
+            assert patched_hash == expected_hash, "Expected content hash did not match actual content hash"
+
+    @allure.title(
+        "[NEGATIVE] Patch cannot be applied with non-existent bucket owner ID in x-amz-expected-bucket-owner header "
+        "(s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    def test_patch_with_non_existent_bucket_owner_id(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+    ):
+        with reporter.step("Get bucket owner ID"):
+            bucket_acl = s3_client.get_bucket_acl(bucket)
+            bucket_owner = bucket_acl["Owner"]["DisplayName"]
+
+        with reporter.step("Change owner ID to non-existent"):
+            unexpected_bucket_owner = list(bucket_owner)
+            random.shuffle(unexpected_bucket_owner)
+            unexpected_bucket_owner = "".join(unexpected_bucket_owner)
+
+        with reporter.step("Try patch object with x-amz-expected-bucket-owner header and get exception"):
+            with pytest.raises(Exception, match="AccessDenied"):
+                s3_http_client.patch_object(
+                    bucket,
+                    original_object,
+                    b"blablabla",
+                    "bytes 10-18/*",
+                    x_amz_expected_bucket_owner=unexpected_bucket_owner,
+                )
+
+    # AwsCliClient is not configured correctly for some cases,
+    # resulting in both buckets being created from the same user, which causes an error.
+    @allure.title(
+        "[NEGATIVE] Patch cannot be applied with another bucket owner ID in x-amz-expected-bucket-owner header "
+        "(s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    @pytest.mark.parametrize("s3_client", [Boto3ClientWrapper], indirect=True)
+    def test_patch_with_another_bucket_owner_id(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+        another_bucket: str,
+    ):
+        with reporter.step("Get owner ID of another bucket"):
+            bucket_acl = s3_client.get_bucket_acl(another_bucket)
+            another_bucket_owner = bucket_acl["Owner"]["DisplayName"]
+
+        with reporter.step("Try patch object with x-amz-expected-bucket-owner header and get exception"):
+            with pytest.raises(Exception, match="AccessDenied"):
+                s3_http_client.patch_object(
+                    bucket,
+                    original_object,
+                    b"blablabla",
+                    "bytes 10-18/*",
+                    x_amz_expected_bucket_owner=another_bucket_owner,
+                )
+
+    @allure.title(
+        "[NEGATIVE] Patch cannot be applied with invalid Content-Range header "
+        "(range={patch_range}, s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    @pytest.mark.parametrize(
+        "patch_range",
+        # String "object" denotes size of object.
+        ["object+100:200", "object+10:object+16", "-1:1", "20:100", "0:2", f"0:{FIVE_GIGABYTES}", "0:0"],
+    )
+    def test_patch_with_invalid_content_range(
+        self,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+        object_size: ObjectSize,
+        patch_range: str,
+    ):
+        content_range = s3_helper.get_range_relative_to_object(patch_range, object_size.value)
+        with reporter.step("Try patch object with invalid Content-Range header and get exception"):
+            with pytest.raises(Exception, match="InvalidRange"):
+                s3_http_client.patch_object(bucket, original_object, b"content", content_range)
+
+    @allure.title(
+        "[NEGATIVE] Patch cannot be applied without Content-Range header "
+        "(s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    def test_patch_without_content_range(self, s3_http_client: S3HttpClient, bucket: str, original_object: str):
+        with reporter.step("Try patch object without Content-Range header and get exception"):
+            with pytest.raises(Exception, match="MissingContentRange"):
+                s3_http_client.patch_object(bucket, original_object, b"content", None)
+
+    @allure.title(
+        "[NEGATIVE] Patch cannot be applied without Content-Length header "
+        "(s3_client={s3_client}, object_size={object_size}, policy={placement_policy})"
+    )
+    def test_patch_without_content_length(
+        self,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        original_object: str,
+        node_under_test: ClusterNode,
+    ):
+        with reporter.step("Generate headers that comply with AWS specification"):
+            data = "content"
+            url = f"{self.cluster.default_s3_gate_endpoint}/{bucket}/{original_object}"
+            host = self.cluster.default_s3_gate_endpoint[8:]
+            headers = {"Host": host, "Url": url, "Content-Range": "bytes 0-6/*"}
+            headers = dict(s3_http_client._create_aws_request("PATCH", url, headers, data).headers)
+            headers.pop("Content-Length", None)
+
+        with reporter.step("Try patch object without Content-Length header and get exception"):
+            curl = GenericCli("curl", node_under_test.host)
+            request = f" {url} -X PATCH"
+
+            for header, value in headers.items():
+                request += f" -H '{header}: {value}'"
+
+            # Remove Content-Length header
+            # *Header without a value means to CURL that it should not be inserted into the request.
+            request += " -H 'Content-Length:'"
+            request += f" -d '{data}' -k"
+
+            response = curl(request, shell=LocalShell(), options=CommandOptions(check=False))
+            assert "MissingContentLength" in response.stdout, response.stdout
+
+    @allure.title("[NEGATIVE] Patch cannot be applied to non-existent bucket")
+    def test_patch_non_existent_bucket(self, s3_http_client: S3HttpClient):
+        with reporter.step("Try patch object in non-existent bucket and get exception"):
+            with pytest.raises(Exception, match="NoSuchBucket"):
+                s3_http_client.patch_object("fake-bucket", unique_name("object-"), b"content", "bytes 0-6/*")
+
+    @allure.title("[NEGATIVE] Patch cannot be applied to non-existent object (s3_client={s3_client}, policy={placement_policy})")
+    def test_patch_non_existent_object(self, s3_http_client: S3HttpClient, bucket: str):
+        with reporter.step("Try patch non-existent object and get exception"):
+            with pytest.raises(Exception, match="NoSuchKey"):
+                s3_http_client.patch_object(bucket, "fake-object", b"content", "bytes 0-6/*")
+
+    @allure.title("Patch object in versioned bucket (s3_client={s3_client}, object_size={object_size}, policy={placement_policy})")
+    @pytest.mark.parametrize("versioning_status", [VersioningStatus.ENABLED], indirect=True)
+    def test_patch_object_in_versioned_bucket(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        object_size: ObjectSize,
+    ):
+        patch_ranges = ["0:35", "40:49", "object-100:object", "object:object+231"]
+
+        with reporter.step("Generate original object"):
+            original_file = generate_file(object_size.value)
+            original_key = s3_helper.object_key_from_file_path(original_file)
+
+        with reporter.step("Put object"):
+            version = s3_client.put_object(bucket, original_file, original_key)
+            expected_versions = {version}
+
+        with reporter.step("Patch versioned object"):
+            for rng in patch_ranges:
+                start, end = s3_helper.get_range_relative_to_object(rng, object_size=object_size.value, int_values=True)
+                content_size = end - start + 1
+                content_range = f"bytes {start}-{end}/*"
+
+                with reporter.step(f"Generate payload object of {content_size} bytes"):
+                    content_file = generate_file(content_size)
+
+                with reporter.step(f"Patch object and get new version"):
+                    response = s3_http_client.patch_object(bucket, original_key, content_file, content_range, version_id=version)
+                    version = response["VersionId"]
+                    expected_versions.add(version)
+
+                with reporter.step(f"Get patched part of object and make sure it has changed correctly"):
+                    got_part = s3_client.get_object(bucket, original_key, version_id=version, object_range=(start, end))
+                    assert get_file_hash(got_part) == get_file_hash(content_file), "Expected content hash did not match actual content hash"
+
+        with reporter.step("Check that all expected versions are in bucket"):
+            got_versions = {
+                version.get("VersionId") for version in s3_client.list_objects_versions(bucket) if version.get("Key") == original_key
+            }
+            assert expected_versions == got_versions, f"Expected versions of object are missing from bucket: {expected_versions}"
+
+    @allure.title("Patch multipart object (range={patch_range}, s3_client={s3_client}, policy={placement_policy})")
+    @pytest.mark.parametrize("patch_range", ["0:part-1", "part:part*2-1", "part-100:part*2+200", "object-part-1:object"])
+    def test_s3_patch_multipart_object(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+        patch_range: str,
+    ):
+        parts_count = 5
+        parts = []
+        original_size = PART_SIZE_FOR_MULTIPART * parts_count
+
+        with reporter.step("Generate original object and split it into parts"):
+            original_file = generate_file(original_size)
+            file_parts = split_file(original_file, parts_count)
+            object_key = s3_helper.object_key_from_file_path(original_file)
+
+        start, end = s3_helper.get_range_relative_to_object(
+            patch_range, object_size=original_size, part_size=PART_SIZE_FOR_MULTIPART, int_values=True
+        )
+        content_size = end - start + 1
+        content_range = f"bytes {start}-{end}/*"
+
+        with reporter.step("Generate payload object"):
+            content_file = generate_file(content_size)
+
+        with reporter.step("Create multipart and upload parts"):
+            upload_id = s3_client.create_multipart_upload(bucket, object_key)
+            for part_id, file_path in enumerate(file_parts, start=1):
+                etag = s3_client.upload_part(bucket, object_key, upload_id, part_id, file_path)
+                parts.append((part_id, etag))
+
+        with reporter.step("Check all parts are visible in bucket"):
+            got_parts = s3_client.list_parts(bucket, object_key, upload_id)
+            assert len(got_parts) == len(file_parts), f"Expected {parts_count} parts, got:\n{got_parts}"
+
+        with reporter.step("Complete multipart upload"):
+            s3_client.complete_multipart_upload(bucket, object_key, upload_id, parts)
+
+        with reporter.step("Patch multipart object"):
+            s3_http_client.patch_object(bucket, object_key, content_file, content_range, timeout=200)
+
+        with reporter.step("Get patched part of object and make sure it has changed correctly"):
+            got_part = s3_client.get_object(bucket, object_key, object_range=(start, end))
+            assert get_file_hash(got_part) == get_file_hash(content_file), "Expected content hash did not match actual content hash"
+
+    @allure.title("Patch multipart object in versioned bucket (s3_client={s3_client}, policy={placement_policy})")
+    @pytest.mark.parametrize("versioning_status", [VersioningStatus.ENABLED], indirect=True)
+    def test_s3_patch_multipart_object_in_versioned_bucket(
+        self,
+        s3_client: S3ClientWrapper,
+        s3_http_client: S3HttpClient,
+        bucket: str,
+    ):
+        parts = []
+        parts_count = 5
+        original_size = PART_SIZE_FOR_MULTIPART * parts_count
+        patch_ranges = ["0:part-1", "part:part*2-1", "part-100:part*2+200", "object-part-1:object"]
+
+        with reporter.step("Generate original object and split it into parts"):
+            original_file = generate_file(original_size)
+            original_key = s3_helper.object_key_from_file_path(original_file)
+            file_parts = split_file(original_file, parts_count)
+
+        with reporter.step("Create multipart and upload parts"):
+            upload_id = s3_client.create_multipart_upload(bucket, original_key)
+            for part_id, file_path in enumerate(file_parts, start=1):
+                etag = s3_client.upload_part(bucket, original_key, upload_id, part_id, file_path)
+                parts.append((part_id, etag))
+
+        with reporter.step("Check all parts are visible in bucket"):
+            got_parts = s3_client.list_parts(bucket, original_key, upload_id)
+            assert len(got_parts) == len(file_parts), f"Expected {parts_count} parts, got:\n{got_parts}"
+
+        with reporter.step("Complete multipart upload"):
+            response = s3_client.complete_multipart_upload(bucket, original_key, upload_id, parts)
+            version = response["VersionId"]
+            expected_versions = {version}
+
+        with reporter.step("Patch versioned multipart object"):
+            for rng in patch_ranges:
+                start, end = s3_helper.get_range_relative_to_object(
+                    rng, object_size=original_size, part_size=PART_SIZE_FOR_MULTIPART, int_values=True
+                )
+                content_size = end - start + 1
+                content_range = f"bytes {start}-{end}/*"
+
+                with reporter.step("Generate payload object"):
+                    content_file = generate_file(content_size)
+
+                with reporter.step("Patch multipart object and get new version"):
+                    response = s3_http_client.patch_object(
+                        bucket, original_key, content_file, content_range, version_id=version, timeout=200
+                    )
+                    version = response["VersionId"]
+                    expected_versions.add(version)
+
+                with reporter.step("Get patched part of object and make sure it has changed correctly"):
+                    got_part = s3_client.get_object(bucket, original_key, version_id=version, object_range=(start, end))
+                    assert get_file_hash(got_part) == get_file_hash(content_file), "Expected content hash did not match actual content hash"
+
+        with reporter.step("Check that all expected versions are in bucket"):
+            got_versions = {
+                version.get("VersionId") for version in s3_client.list_objects_versions(bucket) if version.get("Key") == original_key
+            }
+            assert expected_versions == got_versions, f"Expected versions of object are missing from bucket: {expected_versions}"
+
+    # TODO: Negative scenario for SSE objects is postponed for now.

pytest_tests/testsuites/services/s3_gate/test_s3_policy.py

@@ -1,13 +1,11 @@
 import json
-import os
 
 import allure
 import pytest
 from botocore.exceptions import ClientError
 from frostfs_testlib import reporter
-from frostfs_testlib.s3 import S3ClientWrapper, VersioningStatus
-from frostfs_testlib.s3.interfaces import BucketContainerResolver
-from frostfs_testlib.steps.s3 import s3_helper
+from frostfs_testlib.clients.s3 import BucketContainerResolver, S3ClientWrapper, VersioningStatus
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.steps.storage_policy import get_simple_object_copies
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
@@ -15,9 +13,12 @@ from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.test_control import expect_not_raises
 from frostfs_testlib.utils.file_utils import generate_file
 
+from ....resources.common import S3_POLICY_FILE_LOCATION
 
+
+@pytest.mark.nightly
 @pytest.mark.s3_gate
-@pytest.mark.parametrize("s3_policy", ["pytest_tests/resources/files/policy.json"], indirect=True)
+@pytest.mark.parametrize("s3_policy", [S3_POLICY_FILE_LOCATION], indirect=True)
 class TestS3GatePolicy(ClusterTestBase):
     @allure.title("Bucket creation with retention policy applied (s3_client={s3_client})")
     def test_s3_bucket_location(
@@ -38,9 +39,7 @@ class TestS3GatePolicy(ClusterTestBase):
             bucket_2 = s3_client.create_bucket(location_constraint="rep-3")
             s3_helper.set_bucket_versioning(s3_client, bucket_2, VersioningStatus.ENABLED)
             list_buckets = s3_client.list_buckets()
-            assert (
-                bucket_1 in list_buckets and bucket_2 in list_buckets
-            ), f"Expected two buckets {bucket_1, bucket_2}, got {list_buckets}"
+            assert bucket_1 in list_buckets and bucket_2 in list_buckets, f"Expected two buckets {bucket_1, bucket_2}, got {list_buckets}"
 
         with reporter.step("Check head buckets"):
             with expect_not_raises():
@@ -101,7 +100,6 @@ class TestS3GatePolicy(ClusterTestBase):
                 s3_client.get_bucket_policy(bucket)
 
         with reporter.step("Put new policy"):
-            custom_policy = f"file://{os.getcwd()}/pytest_tests/resources/files/bucket_policy.json"
             custom_policy = {
                 "Version": "2012-10-17",
                 "Id": "aaaa-bbbb-cccc-dddd",

pytest_tests/testsuites/services/s3_gate/test_s3_tagging.py

@@ -5,12 +5,13 @@ from typing import Tuple
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.s3 import S3ClientWrapper
-from frostfs_testlib.steps.s3 import s3_helper
+from frostfs_testlib.clients import S3ClientWrapper
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.utils.file_utils import generate_file
 
 
+@pytest.mark.nightly
 @pytest.mark.s3_gate
 @pytest.mark.s3_gate_tagging
 class TestS3GateTagging:

pytest_tests/testsuites/services/s3_gate/test_s3_versioning.py

@@ -3,12 +3,13 @@ import os
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.s3 import S3ClientWrapper, VersioningStatus
-from frostfs_testlib.steps.s3 import s3_helper
+from frostfs_testlib.clients.s3 import S3ClientWrapper, VersioningStatus
+from frostfs_testlib.steps import s3_helper
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.utils.file_utils import generate_file, generate_file_with_content, get_file_content
 
 
+@pytest.mark.nightly
 @pytest.mark.s3_gate
 @pytest.mark.s3_gate_versioning
 class TestS3GateVersioning:
@@ -77,9 +78,7 @@ class TestS3GateVersioning:
 
             file_name = s3_client.get_object(bucket, obj_key)
             got_content = get_file_content(file_name)
-            assert (
-                got_content == version_2_content
-            ), f"Expected object content is\n{version_2_content}\nGot\n{got_content}"
+            assert got_content == version_2_content, f"Expected object content is\n{version_2_content}\nGot\n{got_content}"
 
     @allure.title("Enable and disable versioning without object_lock (s3_client={s3_client})")
     def test_s3_version(self, s3_client: S3ClientWrapper, simple_object_size: ObjectSize):
@@ -97,9 +96,7 @@ class TestS3GateVersioning:
             actual_version = [version.get("VersionId") for version in object_version if version.get("Key") == file_name]
             assert actual_version == ["null"], f"Expected version is null in list-object-versions, got {object_version}"
             object_0 = s3_client.head_object(bucket, file_name)
-            assert (
-                object_0.get("VersionId") == "null"
-            ), f"Expected version is null in head-object, got {object_0.get('VersionId')}"
+            assert object_0.get("VersionId") == "null", f"Expected version is null in head-object, got {object_0.get('VersionId')}"
 
         s3_helper.set_bucket_versioning(s3_client, bucket, VersioningStatus.ENABLED)
 

pytest_tests/testsuites/services/test_binaries.py

@@ -18,6 +18,7 @@ def _check_version_format(version):
 
 
 @allure.title("Check binaries versions")
+@pytest.mark.nightly
 @pytest.mark.check_binaries
 def test_binaries_versions(hosting: Hosting):
     """

pytest_tests/testsuites/session_token/conftest.py

@@ -1,26 +1,25 @@
-from datetime import datetime
-
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.credentials.interfaces import CredentialsProvider, User
 from frostfs_testlib.storage.cluster import Cluster
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
+from frostfs_testlib.utils import string_utils
 
 
 @pytest.fixture(scope="module")
-def owner_wallet(default_wallet: WalletInfo) -> WalletInfo:
-    return default_wallet
+def owner_wallet(wallet: WalletInfo) -> WalletInfo:
+    return wallet
 
 
 @pytest.fixture(scope="module")
 def user_wallet(credentials_provider: CredentialsProvider, cluster: Cluster) -> WalletInfo:
     with reporter.step("Create user wallet which will use objects from owner via static session"):
-        user = User(f"user_{hex(int(datetime.now().timestamp() * 1000000))}")
+        user = User(string_utils.unique_name("user-"))
         return credentials_provider.GRPC.provide(user, cluster.cluster_nodes[0])
 
 
 @pytest.fixture(scope="module")
 def stranger_wallet(credentials_provider: CredentialsProvider, cluster: Cluster) -> WalletInfo:
     with reporter.step("Create stranger user wallet which should fail to obtain data"):
-        user = User(f"user_{hex(int(datetime.now().timestamp() * 1000000))}")
+        user = User(string_utils.unique_name("user-"))
         return credentials_provider.GRPC.provide(user, cluster.cluster_nodes[0])

pytest_tests/testsuites/session_token/test_object_session_token.py

@@ -3,22 +3,26 @@ import random
 import allure
 import pytest
 from frostfs_testlib import reporter
+from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
 from frostfs_testlib.resources.error_patterns import SESSION_NOT_FOUND
-from frostfs_testlib.steps.cli.container import create_container
 from frostfs_testlib.steps.cli.object import delete_object, put_object, put_object_to_random_node
 from frostfs_testlib.steps.session_token import create_session_token
 from frostfs_testlib.storage.dataclasses.object_size import ObjectSize
 from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
-from frostfs_testlib.utils import wallet_utils
 from frostfs_testlib.utils.file_utils import generate_file
 
+from ...helpers.container_creation import create_container_with_ape
+from ...helpers.container_request import APE_OWNER_ALLOW_ALL, ContainerRequest
 
+
+@pytest.mark.nightly
 @pytest.mark.sanity
 @pytest.mark.session_token
 class TestDynamicObjectSession(ClusterTestBase):
     @allure.title("Object Operations with Session Token (obj_size={object_size})")
-    def test_object_session_token(self, default_wallet: WalletInfo, object_size: ObjectSize):
+    @pytest.mark.parametrize("user_tag", ["TestDynamicObjectSession"], indirect=True)  # provide dedicated user with no APE side-policies
+    def test_object_session_token(self, wallet: WalletInfo, frostfs_cli: FrostfsCli, object_size: ObjectSize):
         """
         Test how operations over objects are executed with a session token
 
@@ -32,17 +36,14 @@ class TestDynamicObjectSession(ClusterTestBase):
             with a session token
         """
 
-        with reporter.step("Init wallet"):
-            wallet = default_wallet
-
         with reporter.step("Nodes Settlements"):
             session_token_node, container_node, non_container_node = random.sample(self.cluster.storage_nodes, 3)
 
         with reporter.step("Create Session Token"):
             session_token = create_session_token(
                 shell=self.shell,
-                owner=default_wallet.get_address(),
-                wallet=default_wallet,
+                owner=wallet.get_address(),
+                wallet=wallet,
                 rpc_endpoint=session_token_node.get_rpc_endpoint(),
             )
 
@@ -54,11 +55,13 @@ class TestDynamicObjectSession(ClusterTestBase):
                 f'AS LOC_{locode}_PLACE FILTER "UN-LOCODE" '
                 f'EQ "{un_locode}" AS LOC_{locode}'
             )
-            cid = create_container(
+            cid = create_container_with_ape(
+                ContainerRequest(placement_policy, APE_OWNER_ALLOW_ALL),
+                frostfs_cli,
                 wallet,
-                shell=self.shell,
-                endpoint=self.cluster.default_rpc_endpoint,
-                rule=placement_policy,
+                self.shell,
+                self.cluster,
+                self.cluster.default_rpc_endpoint,
             )
 
         with reporter.step("Put Objects"):

pytest_tests/testsuites/session_token/test_static_object_session_token.py

@@ -3,14 +3,9 @@ import logging
 import allure
 import pytest
 from frostfs_testlib import reporter
-from frostfs_testlib.resources.error_patterns import (
-    EXPIRED_SESSION_TOKEN,
-    MALFORMED_REQUEST,
-    OBJECT_ACCESS_DENIED,
-    OBJECT_NOT_FOUND,
-)
+from frostfs_testlib.cli.frostfs_cli.cli import FrostfsCli
+from frostfs_testlib.resources.error_patterns import EXPIRED_SESSION_TOKEN, MALFORMED_REQUEST, OBJECT_ACCESS_DENIED, OBJECT_NOT_FOUND
 from frostfs_testlib.shell import Shell
-from frostfs_testlib.steps.cli.container import create_container
 from frostfs_testlib.steps.cli.object import (
     delete_object,
     get_object,
@@ -43,16 +38,24 @@ from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.testing.test_control import expect_not_raises
 from frostfs_testlib.utils.file_utils import generate_file
 
+from ...helpers.container_creation import create_containers_with_ape
+from ...helpers.container_request import OWNER_ALLOW_ALL, MultipleContainersRequest
+
 logger = logging.getLogger("NeoLogger")
 
 RANGE_OFFSET_FOR_COMPLEX_OBJECT = 200
 
 
 @pytest.fixture(scope="module")
-def storage_containers(owner_wallet: WalletInfo, client_shell: Shell, cluster: Cluster) -> list[str]:
-    cid = create_container(owner_wallet, shell=client_shell, endpoint=cluster.default_rpc_endpoint)
-    other_cid = create_container(owner_wallet, shell=client_shell, endpoint=cluster.default_rpc_endpoint)
-    yield [cid, other_cid]
+def storage_containers(owner_wallet: WalletInfo, frostfs_cli: FrostfsCli, client_shell: Shell, cluster: Cluster) -> list[str]:
+    return create_containers_with_ape(
+        frostfs_cli,
+        owner_wallet,
+        client_shell,
+        cluster,
+        cluster.default_rpc_endpoint,
+        MultipleContainersRequest([OWNER_ALLOW_ALL, OWNER_ALLOW_ALL]),
+    )
 
 
 @pytest.fixture(
@@ -138,7 +141,9 @@ def static_sessions(
     }
 
 
+@pytest.mark.nightly
 @pytest.mark.static_session
+@pytest.mark.parametrize("user_tag", ["TestObjectStaticSession"], indirect=True)  # provide dedicated user with no APE side-policies
 class TestObjectStaticSession(ClusterTestBase):
     @allure.title("Read operations with static session (method={method_under_test.__name__}, obj_size={object_size})")
     @pytest.mark.parametrize(

pytest_tests/testsuites/session_token/test_static_session_token_container.py

@@ -8,6 +8,7 @@ from frostfs_testlib.storage.dataclasses.wallet import WalletInfo
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 
 
+@pytest.mark.nightly
 @pytest.mark.static_session_container
 class TestSessionTokenContainer(ClusterTestBase):
     @pytest.fixture(scope="module")

pytest_tests/testsuites/shard/test_control_shard.py

@@ -1,13 +1,13 @@
 import json
+import os
 
 import allure
 import pytest
 from frostfs_testlib import reporter
 from frostfs_testlib.cli import FrostfsCli
 from frostfs_testlib.resources.cli import CLI_DEFAULT_TIMEOUT
-from frostfs_testlib.resources.wellknown_acl import EACL_PUBLIC_READ_WRITE
-from frostfs_testlib.steps.cli.container import create_container, delete_container
-from frostfs_testlib.steps.cli.object import delete_object, get_object, get_object_nodes, put_object
+from frostfs_testlib.shell.interfaces import Shell
+from frostfs_testlib.steps.cli.object import get_object, get_object_nodes, put_object
 from frostfs_testlib.storage.cluster import Cluster, ClusterNode, StorageNode
 from frostfs_testlib.storage.controllers import ClusterStateController, ShardsWatcher
 from frostfs_testlib.storage.controllers.state_managers.config_state_manager import ConfigStateManager
@@ -17,64 +17,86 @@ from frostfs_testlib.testing import parallel, wait_for_success
 from frostfs_testlib.testing.cluster_test_base import ClusterTestBase
 from frostfs_testlib.utils.file_utils import generate_file
 
+from ...helpers.container_request import PUBLIC_WITH_POLICY, requires_container
 
+
+def set_shard_rw_mode(node: ClusterNode):
+    watcher = ShardsWatcher(node)
+    shards = watcher.get_shards()
+    for shard in shards:
+        watcher.set_shard_mode(shard["shard_id"], mode="read-write")
+    watcher.await_for_all_shards_status(status="read-write")
+
+
+@pytest.fixture()
+@allure.title("Revert all shards mode")
+def revert_all_shards_mode(cluster: Cluster) -> None:
+    yield
+    parallel(set_shard_rw_mode, cluster.cluster_nodes)
+
+
+@pytest.fixture()
+def object_id(client_shell: Shell, cluster: Cluster, container: str, default_wallet: WalletInfo, max_object_size: int) -> str:
+    with reporter.step("Create container, and put object"):
+        file = generate_file(round(max_object_size * 0.8))
+        oid = put_object(default_wallet, file, container, client_shell, cluster.default_rpc_endpoint)
+    return oid
+
+
+@pytest.fixture()
+def node_with_object(cluster: Cluster, container: str, object_id: str) -> ClusterNode:
+    with reporter.step("Search node with object"):
+        nodes = get_object_nodes(cluster, container, object_id, cluster.cluster_nodes[0])
+
+    return nodes[0]
+
+
+@pytest.fixture()
+@wait_for_success(180, 30, title="Search object in system")
+def object_path_on_node(object_id: str, container: str, node_with_object: ClusterNode) -> str:
+    oid_path = f"{object_id[0]}/{object_id[1]}/{object_id[2]}/{object_id[3]}"
+    object_path = None
+
+    with reporter.step("Search object file"):
+        node_shell = node_with_object.storage_node.host.get_shell()
+        data_path = node_with_object.storage_node.get_data_directory()
+        all_datas = node_shell.exec(f"ls -la {data_path}/data | awk '{{ print $9 }}'").stdout.strip()
+        for data_dir in all_datas.replace(".", "").strip().split("\n"):
+            check_dir = node_shell.exec(f" [ -d {data_path}/data/{data_dir}/data/{oid_path} ] && echo 1 || echo 0").stdout
+            if "1" in check_dir:
+                object_path = f"{data_path}/data/{data_dir}/data/{oid_path}"
+                object_name = f"{object_id[4:]}.{container}"
+                break
+
+    assert object_path is not None, f"{object_id} object not found in directory - {data_path}/data"
+    return os.path.join(object_path, object_name)
+
+
+@pytest.fixture()
+def erroneous_object_id(object_id: str, object_path_on_node: str, node_with_object: ClusterNode):
+    with reporter.step("Block read file"):
+        node_with_object.host.get_shell().exec(f"chmod a-r {object_path_on_node}")
+
+    yield object_id
+
+    with reporter.step("Restore file access"):
+        node_with_object.host.get_shell().exec(f"chmod +r {object_path_on_node}")
+
+
+@pytest.fixture()
+def change_config_storage(cluster_state_controller: ClusterStateController):
+    with reporter.step("Change threshold error shards"):
+        cluster_state_controller.manager(ConfigStateManager).set_on_all_nodes(
+            service_type=StorageNode, values={"storage:shard_ro_error_threshold": "5"}
+        )
+    yield
+    with reporter.step("Restore threshold error shards"):
+        cluster_state_controller.manager(ConfigStateManager).revert_all()
+
+
+@pytest.mark.nightly
 @pytest.mark.shard
 class TestControlShard(ClusterTestBase):
-    @staticmethod
-    @wait_for_success(180, 30)
-    def get_object_path_and_name_file(oid: str, cid: str, node: ClusterNode) -> tuple[str, str]:
-        oid_path = f"{oid[0]}/{oid[1]}/{oid[2]}/{oid[3]}"
-        object_path = None
-
-        with reporter.step("Search object file"):
-            node_shell = node.storage_node.host.get_shell()
-            data_path = node.storage_node.get_data_directory()
-            all_datas = node_shell.exec(f"ls -la {data_path}/data | awk '{{ print $9 }}'").stdout.strip()
-            for data_dir in all_datas.replace(".", "").strip().split("\n"):
-                check_dir = node_shell.exec(f" [ -d {data_path}/data/{data_dir}/data/{oid_path} ] && echo 1 || echo 0").stdout
-                if "1" in check_dir:
-                    object_path = f"{data_path}/data/{data_dir}/data/{oid_path}"
-                    object_name = f"{oid[4:]}.{cid}"
-                    break
-
-        assert object_path is not None, f"{oid} object not found in directory - {data_path}/data"
-        return object_path, object_name
-
-    def set_shard_rw_mode(self, node: ClusterNode):
-        watcher = ShardsWatcher(node)
-        shards = watcher.get_shards()
-        for shard in shards:
-            watcher.set_shard_mode(shard["shard_id"], mode="read-write")
-        watcher.await_for_all_shards_status(status="read-write")
-
-    @pytest.fixture()
-    @allure.title("Revert all shards mode")
-    def revert_all_shards_mode(self) -> None:
-        yield
-        parallel(self.set_shard_rw_mode, self.cluster.cluster_nodes)
-
-    @pytest.fixture()
-    def oid_cid_node(self, default_wallet: WalletInfo, max_object_size: int) -> tuple[str, str, ClusterNode]:
-        with reporter.step("Create container, and put object"):
-            cid = create_container(
-                wallet=default_wallet,
-                shell=self.shell,
-                endpoint=self.cluster.default_rpc_endpoint,
-                rule="REP 1 CBF 1",
-                basic_acl=EACL_PUBLIC_READ_WRITE,
-            )
-            file = generate_file(round(max_object_size * 0.8))
-            oid = put_object(wallet=default_wallet, path=file, cid=cid, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint)
-        with reporter.step("Search node with object"):
-            nodes = get_object_nodes(cluster=self.cluster, cid=cid, oid=oid, alive_node=self.cluster.cluster_nodes[0])
-
-        yield oid, cid, nodes[0]
-
-        object_path, object_name = self.get_object_path_and_name_file(oid, cid, nodes[0])
-        nodes[0].host.get_shell().exec(f"chmod +r {object_path}/{object_name}")
-        delete_object(wallet=default_wallet, cid=cid, oid=oid, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint)
-        delete_container(wallet=default_wallet, cid=cid, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint)
-
     @staticmethod
     def get_shards_from_cli(node: StorageNode) -> list[Shard]:
         wallet_path = node.get_remote_wallet_path()
@@ -93,16 +115,6 @@ class TestControlShard(ClusterTestBase):
         )
         return [Shard.from_object(shard) for shard in json.loads(result.stdout.split(">", 1)[1])]
 
-    @pytest.fixture()
-    def change_config_storage(self, cluster_state_controller: ClusterStateController):
-        with reporter.step("Change threshold error shards"):
-            cluster_state_controller.manager(ConfigStateManager).set_on_all_nodes(
-                service_type=StorageNode, values={"storage:shard_ro_error_threshold": "5"}
-            )
-        yield
-        with reporter.step("Restore threshold error shards"):
-            cluster_state_controller.manager(ConfigStateManager).revert_all()
-
     @allure.title("All shards are available")
     def test_control_shard(self, cluster: Cluster):
         for storage_node in cluster.storage_nodes:
@@ -113,31 +125,25 @@ class TestControlShard(ClusterTestBase):
 
     @allure.title("Shard become read-only when errors exceeds threshold")
     @pytest.mark.failover
+    @requires_container(PUBLIC_WITH_POLICY("REP 1 CBF 1", short_name="REP 1"))
     def test_shard_errors(
         self,
         default_wallet: WalletInfo,
-        oid_cid_node: tuple[str, str, ClusterNode],
+        container: str,
+        node_with_object: ClusterNode,
+        erroneous_object_id: str,
+        object_path_on_node: str,
         change_config_storage: None,
         revert_all_shards_mode: None,
     ):
-        oid, cid, node = oid_cid_node
-        with reporter.step("Search object in system."):
-            object_path, object_name = self.get_object_path_and_name_file(*oid_cid_node)
-        with reporter.step("Block read file"):
-            node.host.get_shell().exec(f"chmod a-r {object_path}/{object_name}")
         with reporter.step("Get object, expect 6 errors"):
             for _ in range(6):
                 with pytest.raises(RuntimeError):
-                    get_object(
-                        wallet=default_wallet,
-                        cid=cid,
-                        oid=oid,
-                        shell=self.shell,
-                        endpoint=node.storage_node.get_rpc_endpoint(),
-                    )
+                    get_object(default_wallet, container, erroneous_object_id, self.shell, node_with_object.storage_node.get_rpc_endpoint())
+
         with reporter.step("Check shard status"):
-            for shard in ShardsWatcher(node).get_shards():
-                if shard["blobstor"][1]["path"] in object_path:
-                    with reporter.step(f"Shard - {shard['shard_id']} to {node.host_ip}, mode - {shard['mode']}"):
+            for shard in ShardsWatcher(node_with_object).get_shards():
+                if shard["blobstor"][1]["path"] in object_path_on_node:
+                    with reporter.step(f"Shard {shard['shard_id']} should be in read-only mode"):
                         assert shard["mode"] == "read-only"
                         break

pytest_tests/testsuites/special/test_frostfs_logs.py

@@ -31,7 +31,17 @@ class TestLogs:
         if not os.path.exists(logs_dir):
             os.makedirs(logs_dir)
 
-        issues_regex = r"\bpanic\b|\boom\b|too many|insufficient funds|insufficient amount of gas|cannot assign requested address|\bunable to process\b"
+        regexes = [
+            r"\bpanic\b",
+            r"\boom\b",
+            r"too many",
+            r"insufficient funds",
+            r"insufficient amount of gas",
+            r"cannot assign requested address",
+            r"\bunable to process\b",
+            r"\bmaximum number of subscriptions is reached\b",
+        ]
+        issues_regex = "|".join(regexes)
         exclude_filter = r"too many requests"
         log_level_priority = "3"  # will include 0-3 priority logs (0: emergency 1: alerts 2: critical 3: errors)
 

requirements.txt

@@ -1,8 +1,7 @@
 allure-pytest==2.13.2
 allure-python-commons==2.13.2
 base58==2.1.0
-boto3==1.16.33
-botocore==1.19.33
+boto3==1.35.30
 configobj==5.0.6
 neo-mamba==1.0.0
 pexpect==4.8.0