/workspace/source/test/maas-e2e/test/e2e/tests/test_api_keys.py:1429: Cannot find maas-api pod in odh-ai-gateway-infra: error: error executing jsonpath "{.items[0].metadata.name}": Error executing template: array index out of bounds: index 0, length 0. Printing more information for debugging the template: template was: {.items[0].metadata.name} object given to jsonpath engine was: map[string]interface {}{"apiVersion":"v1", "items":[]interface {}{}, "kind":"List", "metadata":map[string]interface {}{"resourceVersion":""}}/workspace/source/test/maas-e2e/test/e2e/tests/test_namespace_scoping.py:214: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/maas-e2e/test/e2e/tests/test_namespace_scoping.py:247: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/maas-e2e/test/e2e/tests/test_namespace_scoping.py:287: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/maas-e2e/test/e2e/tests/test_namespace_scoping.py:324: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/maas-e2e/test/e2e/tests/test_namespace_scoping.py:382: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/maas-e2e/test/e2e/tests/test_namespace_scoping.py:456: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_models_endpoint.TestModelsEndpoint object at 0x7f2b25f26410> def test_api_key_with_deleted_subscription_403(self): """ Test: API key bound to a subscription that was deleted after key creation. This tests an edge case where an API key was minted with a subscription, but that subscription is later deleted. The gateway injects X-MaaS-Subscription from the key, but the subscription no longer exists. Expected: HTTP 403. The gateway may reject the revoked key before the request reaches maas-api, in which case the response body is empty. """ ns = _ns() auth_policy_name = "e2e-api-key-deleted-sub-auth" subscription_name = "e2e-api-key-deleted-sub" sa_name = "e2e-api-key-deleted-sub-sa" api_key = None try: # Create service account and token oc_token = _create_sa_token(sa_name, namespace=ns) sa_user = _sa_to_user(sa_name, namespace=ns) # Create test resources _create_test_auth_policy(auth_policy_name, MODEL_REF, users=[sa_user]) _create_test_subscription(subscription_name, MODEL_REF, users=[sa_user]) # Wait for subscription to reconcile before creating API key _wait_for_subscription_discovery_ready(subscription_name, namespace=ns) # Create API key bound to subscription api_key = _create_api_key(oc_token, name=f"{sa_name}-key", subscription=subscription_name) _wait_for_maas_auth_policy_phase(auth_policy_name, require_enforced=False) # Delete the subscription (simulating deletion after key creation) log.info(f"Deleting subscription {subscription_name} after API key creation") _delete_cr("maassubscription", subscription_name, namespace=ns) _wait_for_cr_absent("maassubscription", subscription_name, namespace=ns) # Query with API key (gateway injects deleted subscription name) log.info("Querying /v1/models with API key bound to deleted subscription") r = _request_with_gateway_retry( requests.get, f"{_maas_api_url()}/v1/models", headers={ "Authorization": f"Bearer {api_key}", }, ) # Should return 403 because subscription doesn't exist > assert r.status_code == 403, \ f"Expected 403 for API key with deleted subscription, got {r.status_code}: {r.text}" E AssertionError: Expected 403 for API key with deleted subscription, got 500: Internal Server Error. E E assert 500 == 403 E + where 500 = <Response [500]>.status_code test/maas-e2e/test/e2e/tests/test_models_endpoint.py:1643: AssertionErrormodel_v1 = 'https://maas.apps.330416457e2a532a0aba.prod.konflux-ocp-ci.dev/llm/facebook-opt-125m-simulated/v1' api_key_headers = {'Authorization': 'Bearer sk-oai-1EYlq3L8noh8WJeIM_AZyugXDpXrWQPIvKjxOoOaYFXPL3C40lTrzJawi9U8', 'Content-Type': 'application/json'} def test_chat_completions_streaming_sse(model_v1: str, api_key_headers: dict): """ Given a governed model and valid API key with stream=true, the client receives multiple SSE data chunks, each JSON-parseable, and the stream ends with data: [DONE]. """ with chat( "Say 'hello' in one word.", model_v1, api_key_headers, SERVED_MODEL_NAME, stream=True, max_tokens=16, ) as streamed: > events = assert_openai_sse_chat_stream(streamed) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ test/maas-e2e/test/e2e/tests/test_smoke.py:135: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ response = <Response [500]> def assert_openai_sse_chat_stream(response: requests.Response) -> list[str]: """ Given a streaming chat/completions Response (stream=True), assert OpenAI-style SSE: HTTP 200, text/event-stream, multiple parseable data: JSON chunks, and data: [DONE]. Returns non-empty event lines (including the terminal [DONE] line). """ > assert response.status_code == 200, ( f"expected streaming HTTP 200, got {response.status_code}: {(response.text or '')[:500]}" ) E AssertionError: expected streaming HTTP 200, got 500: Internal Server Error. E E assert 500 == 200 E + where 500 = <Response [500]>.status_code test/maas-e2e/test/e2e/tests/test_helper.py:1297: AssertionErrormodel_v1 = 'https://maas.apps.330416457e2a532a0aba.prod.konflux-ocp-ci.dev/llm/facebook-opt-125m-simulated/v1' api_key_headers = {'Authorization': 'Bearer sk-oai-1EYlq3L8noh8WJeIM_AZyugXDpXrWQPIvKjxOoOaYFXPL3C40lTrzJawi9U8', 'Content-Type': 'application/json'} model_name = 'facebook-opt-125m-simulated' def test_legacy_completions_optionally(model_v1: str, api_key_headers: dict, model_name: str): """ Compatibility: /completions (legacy). 200 or 404 both OK. Uses API key for authentication (required for inference after JWT removal). """ r = completions("Say hello in one word.", model_v1, api_key_headers, model_name=model_name) msg = f"[legacy] POST /completions -> {r.status_code}" log.info(msg) print(msg) > assert r.status_code in (200, 404), f"unexpected {r.status_code}: {r.text[:500]}" E AssertionError: unexpected 500: Internal Server Error. E E assert 500 in (200, 404) E + where 500 = <Response [500]>.status_code test/maas-e2e/test/e2e/tests/test_smoke.py:150: AssertionErrormaas_api_base_url = 'https://maas.apps.330416457e2a532a0aba.prod.konflux-ocp-ci.dev/maas-api' def test_tokens_endpoint_replaced_by_api_keys(maas_api_base_url: str): """ Verify /v1/tokens endpoint has been replaced by the API key system. The endpoint may return 401 (auth required), 404 (removed), or 405 (method not allowed). Any of these indicates the old token minting is no longer available. """ url = f"{maas_api_base_url}/v1/tokens" r = requests.post(url, json={"expiration": "1m"}, timeout=20, verify=TLS_VERIFY) msg = f"[token] POST {url} (no auth) -> {r.status_code}" log.info(msg) print(msg) # 401/404/405 all indicate the old token minting endpoint is gone/protected > assert r.status_code in (401, 404, 405), f"Expected 401/404/405 (endpoint replaced), got {r.status_code}: {r.text[:400]}" E AssertionError: Expected 401/404/405 (endpoint replaced), got 500: Internal Server Error. E E assert 500 in (401, 404, 405) E + where 500 = <Response [500]>.status_code test/maas-e2e/test/e2e/tests/test_smoke.py:50: AssertionError/workspace/source/test/maas-e2e/test/e2e/tests/test_tenant_discovery.py:79: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/maas-e2e/test/e2e/tests/test_tenant_discovery.py:155: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/maas-e2e/test/e2e/tests/test_tenant_namespace_discovery.py:190: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploymodel_v1 = 'https://maas.apps.330416457e2a532a0aba.prod.konflux-ocp-ci.dev/llm/facebook-opt-125m-simulated/v1' api_key_headers = {'Authorization': 'Bearer sk-oai-mkpw1lIOanVJ89IF_YSXuCI1bEn0xG63impI82xo2ECInoU9eEJqJDw6dOKs', 'Content-Type': 'application/json'} def test_chat_completions_gateway_alive(model_v1: str, api_key_headers: dict): """ Given a governed model and valid API key, a non-streaming request returns HTTP 200 with non-whitespace assistant content. """ r = requests.post( f"{model_v1}/chat/completions", headers=api_key_headers, json={ # MODEL_NAME selects the MaaS route; the body must use the ID the # simulator serves (E2E_MODEL_NAME), which may be different. "model": SERVED_MODEL_NAME, "messages": [{"role": "user", "content": "Say 'hello' in one word."}], "max_tokens": 16, "stream": False, }, timeout=30, verify=TLS_VERIFY, ) msg = f"[chat] POST /chat/completions -> {r.status_code}" log.info(msg) print(msg) > assert r.status_code == 200, f"expected 200, got {r.status_code}: {r.text[:500]}" E AssertionError: expected 200, got 500: Internal Server Error. E E assert 500 == 200 E + where 500 = <Response [500]>.status_code test/maas-e2e/test/e2e/tests/test_smoke.py:108: AssertionError