self = <test_subscription.TestSubscriptionEnforcement object at 0x7fb1ef9665d0> @pytest.mark.serial def test_models_endpoint_exempt_from_rate_limiting(self): """ Test that /v1/models endpoint remains accessible when token quota is exhausted. This verifies that users can discover model capabilities even when they've used all their inference tokens. The /v1/models endpoint is a discovery/metadata endpoint that does not consume tokens and should remain accessible. Ref: https://issues.redhat.com/browse/RHOAIENG-46770 Test steps: 1. Create subscription with very low token limit (15 tokens) 2. Exhaust the limit with inference requests (5 requests × 3 tokens = 15) 3. Verify inference requests get 429 (rate limited) 4. Verify /v1/models endpoint still returns 200 (not rate limited) """ # Use unconfigured model to isolate this test model_ref = UNCONFIGURED_MODEL_REF model_path = UNCONFIGURED_MODEL_PATH # Create unique subscription and auth policy names auth_policy_name = "e2e-models-exempt-test-auth" subscription_name = "e2e-models-exempt-test-subscription" # Very low limit for fast, deterministic test # With 3 token limit and max_tokens=1, we're guaranteed to exhaust quota within 5 requests # (even if each request uses exactly 1 token: 5 requests > 3 token limit) token_limit = 3 window = "1m" try: # 1. Create auth policy allowing system:authenticated _create_test_auth_policy( name=auth_policy_name, model_refs=[model_ref], groups=["system:authenticated"] ) _wait_for_maas_auth_policy_phase(auth_policy_name, require_auth_policies=False) # 2. Create subscription with low token limit _create_test_subscription( name=subscription_name, model_refs=[model_ref], groups=["system:authenticated"], token_limit=token_limit, window=window ) _wait_for_subscription_inference_ready( subscription_name, model_ref, model_namespace=MODEL_NAMESPACE, ) # 3. Create API key for this subscription oc_token = _get_cluster_token() api_key = _create_api_key( oc_token, name=f"e2e-models-exempt-{uuid.uuid4().hex[:8]}", subscription=subscription_name, ) # 4. Exhaust the token limit # With 3 token limit and 5 requests, we're guaranteed to hit the limit # (each successful request consumes ≥1 token, so 5 requests > 3 token limit) max_requests = 5 success_count = 0 rate_limited = False log.info(f"Exhausting token quota: sending up to {max_requests} requests") for i in range(max_requests): r = _inference(api_key, path=model_path) request_num = i + 1 log.info(f"Request {request_num}: status {r.status_code}") if r.status_code == 200: success_count += 1 elif r.status_code == 429: log.info(f"Rate limit hit after {success_count} successful requests") rate_limited = True break else: # Unexpected status during exhaustion log.warning(f"Unexpected status during quota exhaustion: {r.status_code}") # Verify we hit rate limit (otherwise test setup is broken) > assert rate_limited, \ f"Expected to hit rate limit within {max_requests} requests with {token_limit} token limit, " \ f"but got {success_count} successful requests without hitting limit" E AssertionError: Expected to hit rate limit within 5 requests with 3 token limit, but got 5 successful requests without hitting limit E assert False test/maas-e2e/test/e2e/tests/test_subscription.py:808: AssertionError/workspace/source/test/maas-e2e/test/e2e/tests/test_subscription.py:941: no Kuadrant WasmPlugin for gateway maas-default-gateway/workspace/source/test/maas-e2e/test/e2e/tests/test_subscription.py:1728: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/maas-e2e/test/e2e/tests/test_tenant.py:401: default payload-processing is praxis-extproc; MaasTenantConfig.spec.payloadProcessing.resources is MaaS IPP-only/workspace/source/test/maas-e2e/test/e2e/tests/test_tenant_namespace_discovery.py:359: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=trueself = <test_multi_tenant_maas_api.TestPerTenantMaaSAPI object at 0x7fb1ef8642d0> dual_listener_tenant_case = {'suffix': '139d26', 'tenant_ns': 'ai-tenant-e2e-authcfg-http-139d26', 'tenant_label_name': 'e2e-authcfg-http-139d26', 'gateway_name': 'e2e-authcfg-http-139d26', ...} @pytest.mark.nightly @pytest.mark.serial def test_dual_listeners_keep_one_authconfig_per_route_rule(self, dual_listener_tenant_case): """One stable Authorino AuthConfig per rule when both listeners attach the route.""" case = dual_listener_tenant_case gateway = wait_for_json( "gateway", case["gateway_name"], GATEWAY_NAMESPACE, predicate=lambda obj: {"http", "https"} <= _gateway_listener_names_with_routes(obj), timeout=180, ) listeners = { listener.get("name"): listener for listener in (gateway.get("spec") or {}).get("listeners") or [] } assert {"http", "https"} <= set(listeners), ( f"{case['gateway_name']} must have both HTTP and HTTPS listeners, got {listeners!r}" ) assert listeners["http"].get("protocol") == "HTTP" and listeners["http"].get("port") == 80 assert listeners["https"].get("protocol") == "HTTPS" and listeners["https"].get("port") == 443 assert listeners["http"].get("hostname") == listeners["https"].get("hostname"), ( f"Test setup must use a shared hostname across listeners: {listeners!r}" ) route_name = _tenant_api_names(case)["httproute"] route = wait_for_json( "httproute", route_name, INFRA_NAMESPACE, predicate=lambda obj: _route_accepted_by_gateway(obj, case["gateway_name"]), timeout=180, ) authconfigs_by_rule = _wait_for_stable_route_authconfigs(route) rules = (route.get("spec") or {}).get("rules") or [] expected_rules = {f"rule-{index}" for index in range(1, len(rules) + 1)} assert set(authconfigs_by_rule) == expected_rules > assert all( len(observations) == 1 and observations[0][2] for observations in authconfigs_by_rule.values() ), ( f"Expected exactly one Ready and Available non-deleting Authorino " f"AuthConfig per rule for " f"{INFRA_NAMESPACE}/{route_name}; got {authconfigs_by_rule!r}" ) E AssertionError: Expected exactly one Ready and Available non-deleting Authorino AuthConfig per rule for odh-ai-gateway-infra/maas-api-route-e2e-authcfg-http-139d26; got {'rule-1': [('05174a65c5c9d17cda1ac584999675f76375aaaf03b8f5878a725e76203c4480', 'ca39b5c6-ce01-4bbc-9a9b-8883d548cb1c', True), ('1117f052588207562e49b0badaeef07749fecb80da5652f55c5afa3a7846f422', 'dc61591a-8f8e-4a87-bf2e-522c610f7f2d', True)], 'rule-4': [('07475fd7fa1d326caeb958df0bf8fa6ab921f3bc1b1f1a74cfac0e1e73af5468', '6ecf82ee-a1e8-4a70-8284-26afbca3cb53', True), ('cfcdbeebf598ca16ac02b36caffbaeaa4044b0cae54afc58415f0c8e36dac714', '541b4d54-ab54-4971-8b37-561ce603c02e', True)], 'rule-2': [('31766e8556303de0958339338de4503fbec064cb36f3de5d7a4bffafd3825a6a', '9e2c82f7-1b06-4022-abc3-a3cdd280100f', True), ('50efc30232886834a8ff604c9a5eccc13c7af2a3deb0f9198cb0af460b63a485', '8169d48a-54ba-432d-b2d3-2cbf05b2c588', True)], 'rule-6': [('3cd2128681a19cbe22c658db57760d77b2a2234561a5cd1a1442cd58cb8bef3f', '04913548-315f-4c1d-b479-5b3d7ef60b6b', True), ('b86cefbe95431f5d7dee5406fa3a51e28e67ef27d2b9040c80d8862780f8803e', '36aa5ec5-ffef-45bc-8ebb-9638719c81e6', True)], 'rule-5': [('5be3daec7889fa647ba2e26a6ab83714627fb4f30fa99c2d52e389e496f015f7', '2bb06e06-134e-4c50-bb8a-e5f95dfcc1db', True), ('ec97e8e27fb13f94a1a3d36a4ef1fc11891ade1cf0a7f04ceaffbfa54648d59f', 'ad2cd7fa-8d06-4f84-88aa-0c50f57c76d9', True)], 'rule-3': [('61f7f7a98db105987bc9e5d04695af01a0012890134f09dc13ee5b59f66d98d2', 'b08a2d3d-207c-4e14-9ee7-3867411cd4c5', True), ('692ff1feb575e3d49eed2bbdbb6887de57db51b47585e924e152848f7070a42a', 'c9d2419c-cff3-4138-9de2-6e99e17ec2f9', True)]} E assert False E + where False = all(<generator object TestPerTenantMaaSAPI.test_dual_listeners_keep_one_authconfig_per_route_rule.<locals>.<genexpr> at 0x7fb1efa96b20>) test/maas-e2e/test/e2e/tests/test_multi_tenant_maas_api.py:381: AssertionError