<?xml version="1.0" encoding="utf-8"?><testsuites name="pytest tests"><testsuite name="pytest" errors="1" failures="0" skipped="3" tests="85" time="1154.222" timestamp="2026-11-04T02:27:16.458204+00:00" hostname="maas-group-test-2zvjg-e2e-maas-openshift-pod"><testcase classname="tests.test_aitenant_lifecycle.TestAITenantLifecycle" name="test_default_aitenant_bootstraps_maas_tenant_config_without_gateway_mutation" time="2.268" /><testcase classname="tests.test_aitenant_lifecycle.TestAITenantLifecycle" name="test_aitenant_rejected_outside_ai_tenants_namespace" time="8.225" /><testcase classname="tests.test_api_keys.TestAPIKeyCRUD" name="test_list_api_keys" time="169.486" /><testcase classname="tests.test_api_keys.TestAPIKeyModelInference" name="test_invalid_api_key_rejected" time="0.272" /><testcase classname="tests.test_authpolicy_generation_stability.TestAuthPolicyGenerationStability" name="test_generation_does_not_increase_during_quiet_window" time="62.622" /><testcase classname="tests.test_api_keys.TestAPIKeyCRUD" name="test_create_api_key" time="212.981" /><testcase classname="tests.test_api_keys.TestAPIKeyModelInference" name="test_api_key_model_access_success" time="0.681" /><testcase classname="tests.test_config_tenant.TestConfigAnchorPresence" name="test_cluster_config_default_exists" time="0.589" /><testcase classname="tests.test_config_tenant.TestConfigAnchorPresence" name="test_cluster_config_not_terminating" time="0.208" /><testcase classname="tests.test_config_tenant.TestConfigTenantOwnership" name="test_default_aitenant_lists_config_owner_reference" time="0.157" /><testcase classname="tests.test_config_tenant.TestConfigTenantOwnership" name="test_tenant_config_lists_config_owner_reference" time="0.175" /><testcase classname="tests.test_config_tenant.TestConfigTenantOwnership" name="test_maas_controller_deployment_does_not_list_config_owner_reference" time="0.171" /><testcase classname="tests.test_gateway_filter_chain_praxis.TestGatewayFilterChainPraxis" name="test_no_listener_rejected" time="5.618" /><testcase classname="tests.test_gateway_filter_chain_praxis.TestGatewayFilterChainPraxis" name="test_payload_processing_precedes_router" time="0.001" /><testcase classname="tests.test_gateway_scoped_authpolicy.TestGatewayAuthPolicyStructure" name="test_gateway_auth_policy_contract" time="0.492" /><testcase classname="tests.test_api_keys.TestAPIKeyCRUD" name="test_revoke_api_key" time="223.796" /><testcase classname="tests.test_api_keys.TestAPIKeyAuthorization" name="test_non_admin_cannot_access_other_users_keys" time="215.933" /><testcase classname="tests.test_api_keys.TestAPIKeyModelInference" name="test_no_auth_header_rejected" time="0.246" /><testcase classname="tests.test_negative_security.TestAPIKeyManagementIsolation" name="test_api_key_cannot_mint_another_api_key" time="1.099" /><testcase classname="tests.test_api_keys.TestEphemeralKeyCleanup" name="test_cronjob_exists_and_configured" time="0.498" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[group-only]" time="1.818" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[username-only]" time="1.795" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[keyname-only]" time="1.759" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[identity-envelope]" time="1.773" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[admin-scope]" time="1.793" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_injected_identity_headers_rejected_on_inference" time="0.783" /><testcase classname="tests.test_negative_security.TestExpiredKeyRejection" name="test_expired_key_rejected_at_gateway" time="5.561" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_duplicate_subscription_headers_ignored" time="9.085" /><testcase classname="tests.test_authpolicy_generation_stability.TestAuthPolicyGenerationStability" name="test_no_rapid_resource_version_changes" time="60.520" /><testcase classname="tests.test_negative_security.TestCrossModelAccess" name="test_key_cannot_access_model_outside_subscription" time="0.778" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_internal_endpoint_not_routable[api-keys-cleanup]" time="0.351" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_internal_endpoint_not_routable[api-keys-validate]" time="0.373" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_health_endpoint_accessible" time="0.218" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_v1_models_via_maas_api_prefix" time="0.499" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_networkpolicy_exists" time="0.164" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_pod_selector_covers_both_processors" time="0.175" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_ingress_uses_istio_managed_label" time="0.155" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_egress_allows_otlp_to_monitoring_namespace" time="0.325"><skipped type="pytest.skip" message="AIGC praxis NetworkPolicy does not include OTLP 4317 egress (MaaS Go IPP bundle only)">/workspace/source/test/e2e/tests/test_networkpolicy.py:119: AIGC praxis NetworkPolicy does not include OTLP 4317 egress (MaaS Go IPP bundle only)</skipped></testcase><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_ingress_does_not_hardcode_single_gateway" time="0.155" /><testcase classname="tests.test_networkpolicy.TestMaaSAuthorinoNetworkPolicy" name="test_rhcl_authorino_namespace_is_allowed" time="0.146" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingConnectivity" name="test_maas_gateway_pod_exists" time="0.222" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingConnectivity" name="test_maas_gateway_has_istio_managed_label" time="0.217" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingConnectivity" name="test_payload_processing_pods_running" time="0.189" /><testcase classname="tests.test_networkpolicy.TestMaaSGatewayFunctional" name="test_maas_api_health" time="0.194" /><testcase classname="tests.test_negative_security.TestHeaderAbuse" name="test_special_characters_in_subscription_header" time="1.683" /><testcase classname="tests.test_networkpolicy.TestMaaSGatewayFunctional" name="test_maas_api_models_reachable" time="0.344" /><testcase classname="tests.test_smoke" name="test_tokens_endpoint_replaced_by_api_keys" time="0.245" /><testcase classname="tests.test_smoke" name="test_models_catalog" time="0.309" /><testcase classname="tests.test_smoke" name="test_chat_completions_gateway_alive" time="0.633" /><testcase classname="tests.test_smoke" name="test_chat_completions_streaming_sse" time="0.279" /><testcase classname="tests.test_smoke" name="test_healthz_or_404" time="0.217" /><testcase classname="tests.test_smoke" name="test_legacy_completions_optionally" time="0.282" /><testcase classname="tests.test_subscription.TestAuthEnforcement" name="test_authorized_user_gets_200" time="7.951" /><testcase classname="tests.test_subscription.TestAuthEnforcement" name="test_invalid_token_gets_403" time="7.571" /><testcase classname="tests.test_subscription.TestAuthEnforcement" name="test_wrong_group_gets_403" time="0.571" /><testcase classname="tests.test_subscription.TestAuthEnforcement" name="test_no_auth_gets_401" time="0.211" /><testcase classname="tests.test_subscription.TestSubscriptionEnforcement" name="test_subscribed_user_gets_200" time="0.453" /><testcase classname="tests.test_api_keys.TestAPIKeyAuthorization" name="test_admin_manage_other_users_keys" time="252.230" /><testcase classname="tests.test_api_keys.TestAPIKeyModelInference" name="test_revoked_api_key_rejected" time="3.479" /><testcase classname="tests.test_tenant.TestTenantContract" name="test_status_has_phase_and_conditions" time="0.464" /><testcase classname="tests.test_tenant.TestTenantContract" name="test_spec_is_well_formed" time="0.151" /><testcase classname="tests.test_tenant.TestTenantContract" name="test_conditions_use_kubernetes_metav1_shape" time="0.148" /><testcase classname="tests.test_tenant.TestTenantNoFalseOwnership" name="test_maas_user_crs_not_owned_by_tenant" time="0.487" /><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_requires_auth" time="6.024" /><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_with_invalid_token" time="3.153" /><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_authenticated" time="0.001"><skipped type="pytest.skip" message="Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.">/workspace/source/test/e2e/tests/test_tenant_discovery.py:79: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.</skipped></testcase><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_gateway_matches_deployment" time="0.000"><skipped type="pytest.skip" message="Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.">/workspace/source/test/e2e/tests/test_tenant_discovery.py:155: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.</skipped></testcase><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_not_exposed_through_gateway" time="0.199" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_internal_endpoint_not_routable[subscriptions-select]" time="0.394" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_response_schema_and_metadata" time="120.694" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_unauthenticated_request_401" time="0.226" /><testcase classname="tests.test_subscription_list_endpoints.TestListSubscriptions" name="test_returns_accessible_subscriptions" time="143.439" /><testcase classname="tests.test_subscription_list_endpoints.TestListSubscriptions" name="test_unauthenticated_returns_401[all-subscriptions]" time="0.272" /><testcase classname="tests.test_subscription_list_endpoints.TestListSubscriptions" name="test_unauthenticated_returns_401[subscriptions-for-model]" time="157.803" /><testcase classname="tests.test_tenant.TestTenantLifecycle" name="test_tenant_ready_and_phase_healthy" time="0.467" /><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_provider_reports_ready" time="32.547" /><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_served_through_default_gateway" time="83.426" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_attachment_status_ready" time="308.075" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_one_httproute_in_model_namespace" time="207.393" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_credential_copy_delivered_to_tenant" time="295.835" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_unselected_gateway_not_serving" time="204.387" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_inference_serves_with_user_namespace_credential" time="349.722" /><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_unknown_key_rejected" time="324.210" /><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_subscription_header_reaches_provider_and_replaces_client_value" time="66.007" /><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_attached_to_default_gateway" time="460.408"><error message="failed on setup with &quot;AssertionError: Gateway never applied x-grid-geo-fencing header injection within 300s; last: expected 200 through maas-default-gateway, got 503: &#10;assert 503 == 200&#10; +  where 503 = &lt;Response [503]&gt;.status_code&quot;">self = &lt;test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs object at 0x7fe9aafdbdd0&gt;
gateway_url = 'https://maas.apps.dcf7ec273a3049c99717.prod.konflux-ocp-ci.dev'

    @pytest.fixture(scope="class")
    def implicit_model(self, gateway_url):
        tracked: list[tuple[str, str, str]] = []
        try:
            model = _provision_model(tracked, "e2e-dft")
            attachment = _wait_implicitly_attached(model)
&gt;           api_key = _serve_in_default_tenant(tracked, model, gateway_url)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

test/e2e/tests/test_tenant_external_model_default_tenant.py:405: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test/e2e/tests/test_tenant_external_model_default_tenant.py:317: in _serve_in_default_tenant
    _wait_for_subscription_header(gateway_url, model, api_key)
test/e2e/tests/test_tenant_external_model_default_tenant.py:369: in _wait_for_subscription_header
    wait_until(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

check = &lt;function _wait_for_subscription_header.&lt;locals&gt;._check at 0x7fe9aae099e0&gt;
timeout = 300
what = 'Gateway never applied x-grid-geo-fencing header injection', interval = 5

    def wait_until(check, timeout: int, what: str, interval: int = 5):
        """Poll check() until it returns a truthy value. Assertion failures and transient
        cluster or HTTP errors count as "not yet"; the last one ends up in the timeout message."""
        deadline = time.time() + timeout
        while True:
            try:
                result = check()
                if result:
                    return result
                last = result
            except (AssertionError, subprocess.TimeoutExpired, requests.RequestException) as exc:
                last = exc
&gt;           assert time.time() &lt; deadline, f"{what} within {timeout}s; last: {last}"
                   ^^^^^^^^^^^^^^^^^^^^^^
E           AssertionError: Gateway never applied x-grid-geo-fencing header injection within 300s; last: expected 200 through maas-default-gateway, got 503: 
E           assert 503 == 200
E            +  where 503 = &lt;Response [503]&gt;.status_code

test/e2e/tests/multitenancy_helpers.py:279: AssertionError</error></testcase></testsuite></testsuites>