self = <test_model_identity_conflict.TestModelIdentityConflictDetection object at 0x7f61bfbd0640> def test_colliding_model_names_flagged_then_resolved(self): suffix = uuid.uuid4().hex[:8] shared_model_name = f"test/e2e-identity-conflict-{suffix}" llmis_a = f"e2e-conflict-a-{suffix}" llmis_b = f"e2e-conflict-b-{suffix}" ref_a, ref_b = llmis_a, llmis_b try: # A single model with no siblings must be reported unique. _create_llmis(llmis_a, MODEL_NAMESPACE, DEFAULT_GATEWAY_NAME, GATEWAY_NAMESPACE, model_name=shared_model_name) _create_maas_model_ref(ref_a, MODEL_NAMESPACE, llmis_a) obj_a = wait_for_status_condition( "maasmodelref", ref_a, MODEL_NAMESPACE, condition_type=CONDITION, expected_status="True", timeout=120, ) assert (obj_a.get("status") or {}).get("resolvedModelAlias"), ( f"expected {ref_a} to have a resolvedModelAlias once the LLMIS exists" ) # A second MaaSModelRef whose LLMIS declares the SAME spec.model.name # introduces a collision — this mirrors the reported production bug. _create_llmis(llmis_b, MODEL_NAMESPACE, DEFAULT_GATEWAY_NAME, GATEWAY_NAMESPACE, model_name=shared_model_name) _create_maas_model_ref(ref_b, MODEL_NAMESPACE, llmis_b) obj_a = wait_for_status_condition( "maasmodelref", ref_a, MODEL_NAMESPACE, condition_type=CONDITION, expected_status="False", timeout=120, ) obj_b = wait_for_status_condition( "maasmodelref", ref_b, MODEL_NAMESPACE, condition_type=CONDITION, expected_status="False", timeout=120, ) cond_a = _condition(obj_a, CONDITION) cond_b = _condition(obj_b, CONDITION) assert ref_b in cond_a["message"], f"expected {ref_a}'s condition to name {ref_b}: {cond_a['message']!r}" assert ref_a in cond_b["message"], f"expected {ref_b}'s condition to name {ref_a}: {cond_b['message']!r}" events_a = _events_for(ref_a, MODEL_NAMESPACE, "ModelNameConflict") events_b = _events_for(ref_b, MODEL_NAMESPACE, "ModelNameConflict") > assert events_a or events_b, ( "expected a Warning ModelNameConflict event on at least one of the " f"colliding MaaSModelRefs ({ref_a}, {ref_b})" ) E AssertionError: expected a Warning ModelNameConflict event on at least one of the colliding MaaSModelRefs (e2e-conflict-a-ec6a8395, e2e-conflict-b-ec6a8395) E assert ([] or []) test/e2e/tests/test_model_identity_conflict.py:110: AssertionError/workspace/source/test/e2e/tests/test_namespace_scoping.py:214: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:247: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:287: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:324: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:382: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:456: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_tenant_discovery.py:136: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery.py:212: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.self = <test_tenant_auto_resolve.TestTenantAutoResolve object at 0x7fa3b29e60d0> def test_auto_resolve_populates_resolved_tenant_ref(self): """When tenantRef is omitted, resolvedTenantRef is populated from the gateway.""" case = new_named_tenant_case("e2e-autores") model_name = f"autores-model-{case['suffix']}" try: bootstrap_aitenant_tenant(case) _create_llmis(model_name, case["tenant_ns"], case["gateway_name"], GATEWAY_NAMESPACE) wait_for_httproute_accepted( f"{model_name}-kserve-route", case["tenant_ns"], case["gateway_name"], timeout=180, ) _create_maas_model_ref_with_tenant(model_name, case["tenant_ns"], model_name) > obj = _wait_for_maasmodelref_status( model_name, case["tenant_ns"], lambda s: s.get("resolvedTenantRef") == case["tenant_label_name"], timeout=120, ) test/e2e/tests/test_tenant_auto_resolve.py:103: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/tests/test_tenant_auto_resolve.py:80: in _wait_for_maasmodelref_status return wait_for_json("maasmodelref", name, namespace, predicate=_pred, timeout=timeout, interval=interval) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ kind = 'maasmodelref', name = 'autores-model-293166' namespace = 'ai-tenant-e2e-autores-293166' def wait_for_json( kind: str, name: str, namespace: Optional[str] = None, *, predicate=None, timeout: int = 180, interval: int = 5, ) -> dict: deadline = time.time() + timeout last_obj = None while time.time() < deadline: obj = get_json_or_none(kind, name, namespace) if obj is not None: last_obj = obj if predicate is None or predicate(obj): return obj time.sleep(interval) > raise AssertionError( f"{kind}/{name} in {namespace or '<cluster>'} did not satisfy condition. Last object: {last_obj}" ) E AssertionError: maasmodelref/autores-model-293166 in ai-tenant-e2e-autores-293166 did not satisfy condition. Last object: {'apiVersion': 'maas.opendatahub.io/v1alpha1', 'kind': 'MaaSModelRef', 'metadata': {'annotations': {'kubectl.kubernetes.io/last-applied-configuration': '{"apiVersion":"maas.opendatahub.io/v1alpha1","kind":"MaaSModelRef","metadata":{"annotations":{},"name":"autores-model-293166","namespace":"ai-tenant-e2e-autores-293166"},"spec":{"modelRef":{"kind":"LLMInferenceService","name":"autores-model-293166"}}}\n'}, 'creationTimestamp': '2026-09-08T16:31:31Z', 'finalizers': ['maas.opendatahub.io/model-cleanup'], 'generation': 1, 'name': 'autores-model-293166', 'namespace': 'ai-tenant-e2e-autores-293166', 'resourceVersion': '32912', 'uid': '0a0ee44f-e38b-47b7-908f-3d5f13190e86'}, 'spec': {'modelRef': {'kind': 'LLMInferenceService', 'name': 'autores-model-293166'}}, 'status': {'conditions': [{'lastTransitionTime': '2026-09-08T16:31:31Z', 'message': 'No active subscription and auth policy pairing found', 'observedGeneration': 1, 'reason': 'NoPairingFound', 'status': 'False', 'type': 'GovernanceAttached'}, {'lastTransitionTime': '2026-09-08T16:32:00Z', 'message': 'Backend is healthy', 'observedGeneration': 1, 'reason': 'RuntimeHealthy', 'status': 'True', 'type': 'RuntimeReady'}, {'lastTransitionTime': '2026-09-08T16:31:31Z', 'message': 'No other MaaSModelRef in this namespace resolves to the same model identity', 'observedGeneration': 1, 'reason': 'UniqueIdentity', 'status': 'True', 'type': 'ModelIdentityUnique'}, {'lastTransitionTime': '2026-09-08T16:31:31Z', 'message': 'Awaiting governance pairing', 'observedGeneration': 1, 'reason': 'BackendNotReady', 'status': 'False', 'type': 'Ready'}], 'httpRouteGatewayName': 'e2e-autores-293166', 'httpRouteGatewayNamespace': 'openshift-ingress', 'httpRouteName': 'autores-model-293166-kserve-route', 'httpRouteNamespace': 'ai-tenant-e2e-autores-293166', 'phase': 'Pending', 'resolvedModelAlias': 'publishers/ai-tenant-e2e-autores-293166/models/facebook/opt-125m'}} test/e2e/tests/multitenancy_helpers.py:229: AssertionErrorself = <test_external_models.TestLegacyExternalModelMigration object at 0x7ff3a0573670> def test_migration_sets_legacy_status_and_removes_networking(self): name = f"e2e-legacy-migration-{uuid.uuid4().hex[:8]}" secret_name = f"{name}-api-key" legacy_kind = "externalmodels.maas.opendatahub.io" legacy_resource_name = f"maas-{name}" expected_message = f"Model migrated to inference.opendatahub.io ExternalModel: {name}" deadline = time.monotonic() + 180 try: _apply_cr({ "apiVersion": "v1", "kind": "Secret", "metadata": {"name": secret_name, "namespace": MODEL_NAMESPACE}, "type": "Opaque", "stringData": {"api-key": "e2e-test-key"}, }) # Seed one legacy networking child so this test proves teardown ran, # even if IPP migrates the model before the legacy reconciler has # time to create the full networking set. _apply_cr({ "apiVersion": "v1", "kind": "Service", "metadata": {"name": legacy_resource_name, "namespace": MODEL_NAMESPACE}, "spec": { "type": "ExternalName", "externalName": EXTERNAL_ENDPOINT, "ports": [{"name": "https", "port": 443}], }, }) _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "ExternalModel", "metadata": {"name": name, "namespace": MODEL_NAMESPACE}, "spec": { "provider": "openai", "targetModel": TARGET_MODEL, "endpoint": EXTERNAL_ENDPOINT, "credentialRef": {"name": secret_name}, }, }) legacy = None inference = None while time.monotonic() < deadline: legacy = _get_cr(legacy_kind, name, MODEL_NAMESPACE) inference = _get_cr(EXTERNAL_MODEL_KIND, name, MODEL_NAMESPACE) if ( legacy and legacy.get("status", {}).get("phase") == "Migrated" and inference and inference.get("status", {}).get("httpRouteName") ): break time.sleep(2) assert inference is not None, "IPP did not create the inference ExternalModel" assert inference.get("status", {}).get("httpRouteName"), ( "Migrated inference ExternalModel did not publish status.httpRouteName" ) assert legacy is not None, "Legacy ExternalModel was unexpectedly removed" > assert legacy.get("status", {}).get("phase") == "Migrated" E assert None == 'Migrated' E + where None = <built-in method get of dict object at 0x7ff3a06f7b40>('phase') E + where <built-in method get of dict object at 0x7ff3a06f7b40> = {}.get E + where {} = <built-in method get of dict object at 0x7ff3a02d64c0>('status', {}) E + where <built-in method get of dict object at 0x7ff3a02d64c0> = {'apiVersion': 'maas.opendatahub.io/v1alpha1', 'kind': 'ExternalModel', 'metadata': {'annotations': {'kubectl.kubernetes.io/last-applied-configuration': '{"apiVersion":"maas.opendatahub.io/v1alpha1","kind":"ExternalModel","metadata":{"annotations":{},"name":"e2e-legacy-migration-b7b533f3","namespace":"llm"},"spec":{"credentialRef":{"name":"e2e-legacy-migration-b7b533f3-api-key"},"endpoint":"httpbingo.org","provider":"openai","targetModel":"gpt-3.5-turbo"}}\n'}, 'creationTimestamp': '2026-09-08T16:29:45Z', 'generation': 1, 'name': 'e2e-legacy-migration-b7b533f3', ...}, 'spec': {'credentialRef': {'name': 'e2e-legacy-migration-b7b533f3-api-key'}, 'endpoint': 'httpbingo.org', 'provider': 'openai', 'targetModel': 'gpt-3.5-turbo'}}.get test/e2e/tests/test_external_models.py:496: AssertionErrorself = <test_negative_security.TestInternalEndpointIsolation object at 0x7fd93026ec40> path = '/internal/v1/subscriptions/select' body = {'groups': ['system:authenticated'], 'username': 'test'} @pytest.mark.parametrize( "path,body", [ ( "/internal/v1/subscriptions/select", {"groups": ["system:authenticated"], "username": "test"}, ), ("/internal/v1/api-keys/cleanup", {}), ("/internal/v1/api-keys/validate", {"key": "sk-oai-test-fake-key"}), ], ids=["subscriptions-select", "api-keys-cleanup", "api-keys-validate"], ) def test_internal_endpoint_not_routable(self, path, body): """POST /maas-api/internal/* through gateway must not reach the handler. Sends an authenticated request to each internal endpoint via the gateway. With the HTTPRoute scoped to /maas-api/v1, these paths have no matching route and the gateway returns a non-success status (typically 404). The response must not contain handler output. """ _wait_for_gateway_auth_enforced() oc_token = _get_cluster_token() url = f"{_maas_api_url()}{path}" headers = { "Authorization": f"Bearer {oc_token}", "Content-Type": "application/json", } r = requests.post( url, headers=headers, json=body, timeout=TIMEOUT, verify=TLS_VERIFY, ) log.info( "Internal endpoint %s -> %s body_bytes=%d", path, r.status_code, len(r.content), ) > assert r.status_code == 404, ( f"Internal endpoint {path} must not be routable through gateway " f"(expected 404, got {r.status_code}). " f"A 2xx means the handler is exposed; a 401/403 means the path is " f"routed but auth-blocked — both indicate a routing defect. " f"Response: {r.text[:300]}" ) E AssertionError: Internal endpoint /internal/v1/subscriptions/select must not be routable through gateway (expected 404, got 200). A 2xx means the handler is exposed; a 401/403 means the path is routed but auth-blocked — both indicate a routing defect. Response: {"accessAllowed":false,"phase":"","ready":false,"error":"multiple_subscriptions","message":"user has access to multiple subscriptions, must specify subscription using X-MaaS-Subscription header"} E assert 200 == 404 E + where 200 = <Response [200]>.status_code test/e2e/tests/test_negative_security.py:705: AssertionErrorself = <test_negative_security.TestInternalEndpointIsolation object at 0x7fd93026edf0> path = '/internal/v1/api-keys/cleanup', body = {} @pytest.mark.parametrize( "path,body", [ ( "/internal/v1/subscriptions/select", {"groups": ["system:authenticated"], "username": "test"}, ), ("/internal/v1/api-keys/cleanup", {}), ("/internal/v1/api-keys/validate", {"key": "sk-oai-test-fake-key"}), ], ids=["subscriptions-select", "api-keys-cleanup", "api-keys-validate"], ) def test_internal_endpoint_not_routable(self, path, body): """POST /maas-api/internal/* through gateway must not reach the handler. Sends an authenticated request to each internal endpoint via the gateway. With the HTTPRoute scoped to /maas-api/v1, these paths have no matching route and the gateway returns a non-success status (typically 404). The response must not contain handler output. """ _wait_for_gateway_auth_enforced() oc_token = _get_cluster_token() url = f"{_maas_api_url()}{path}" headers = { "Authorization": f"Bearer {oc_token}", "Content-Type": "application/json", } r = requests.post( url, headers=headers, json=body, timeout=TIMEOUT, verify=TLS_VERIFY, ) log.info( "Internal endpoint %s -> %s body_bytes=%d", path, r.status_code, len(r.content), ) > assert r.status_code == 404, ( f"Internal endpoint {path} must not be routable through gateway " f"(expected 404, got {r.status_code}). " f"A 2xx means the handler is exposed; a 401/403 means the path is " f"routed but auth-blocked — both indicate a routing defect. " f"Response: {r.text[:300]}" ) E AssertionError: Internal endpoint /internal/v1/api-keys/cleanup must not be routable through gateway (expected 404, got 200). A 2xx means the handler is exposed; a 401/403 means the path is routed but auth-blocked — both indicate a routing defect. Response: {"deletedCount":0,"message":"Successfully deleted 0 expired ephemeral key(s)"} E assert 200 == 404 E + where 200 = <Response [200]>.status_code test/e2e/tests/test_negative_security.py:705: AssertionErrorself = <test_negative_security.TestInternalEndpointIsolation object at 0x7fd93026efd0> path = '/internal/v1/api-keys/validate', body = {'key': 'sk-oai-test-fake-key'} @pytest.mark.parametrize( "path,body", [ ( "/internal/v1/subscriptions/select", {"groups": ["system:authenticated"], "username": "test"}, ), ("/internal/v1/api-keys/cleanup", {}), ("/internal/v1/api-keys/validate", {"key": "sk-oai-test-fake-key"}), ], ids=["subscriptions-select", "api-keys-cleanup", "api-keys-validate"], ) def test_internal_endpoint_not_routable(self, path, body): """POST /maas-api/internal/* through gateway must not reach the handler. Sends an authenticated request to each internal endpoint via the gateway. With the HTTPRoute scoped to /maas-api/v1, these paths have no matching route and the gateway returns a non-success status (typically 404). The response must not contain handler output. """ _wait_for_gateway_auth_enforced() oc_token = _get_cluster_token() url = f"{_maas_api_url()}{path}" headers = { "Authorization": f"Bearer {oc_token}", "Content-Type": "application/json", } r = requests.post( url, headers=headers, json=body, timeout=TIMEOUT, verify=TLS_VERIFY, ) log.info( "Internal endpoint %s -> %s body_bytes=%d", path, r.status_code, len(r.content), ) > assert r.status_code == 404, ( f"Internal endpoint {path} must not be routable through gateway " f"(expected 404, got {r.status_code}). " f"A 2xx means the handler is exposed; a 401/403 means the path is " f"routed but auth-blocked — both indicate a routing defect. " f"Response: {r.text[:300]}" ) E AssertionError: Internal endpoint /internal/v1/api-keys/validate must not be routable through gateway (expected 404, got 200). A 2xx means the handler is exposed; a 401/403 means the path is routed but auth-blocked — both indicate a routing defect. Response: {"valid":false,"tenant":"","reason":"invalid key format"} E assert 200 == 404 E + where 200 = <Response [200]>.status_code test/e2e/tests/test_negative_security.py:705: AssertionError/workspace/source/test/e2e/tests/test_subscription.py:1069: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_external_oidc.py:252: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:263: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:277: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:290: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:303: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:335: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:379: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:395: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:405: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:428: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:436: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:441: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:454: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:501: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:537: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:602: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:633: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:659: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:690: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:750: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:786: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:824: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:872: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:961: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1013: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1049: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1103: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1142: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_gateway_scoped_authpolicy.py:212: gateway-default-auth not present (maas-gateway-auth is active); scoping is validated by unit tests/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:189: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deployself = <test_tenant_auto_resolve.TestTenantAutoResolve object at 0x7fa3b29dc070> def test_no_matching_tenant_enters_failed(self): """MaaSModelRef enters Failed state when no AITenant matches the gateway.""" case = new_named_tenant_case("e2e-noten") model_name = f"noten-model-{case['suffix']}" fixture_label = f"noten-{case['suffix']}" try: apply_gateway_fixture(case["gateway_name"], fixture_label=fixture_label) wait_for_gateway_programmed(case["gateway_name"]) from multitenancy_helpers import ensure_namespace ensure_namespace(case["tenant_ns"]) apply_gateway_access_label(case["tenant_ns"], case["gateway_name"]) _create_llmis(model_name, case["tenant_ns"], case["gateway_name"], GATEWAY_NAMESPACE) wait_for_httproute_accepted( f"{model_name}-kserve-route", case["tenant_ns"], case["gateway_name"], timeout=180, ) _create_maas_model_ref_with_tenant(model_name, case["tenant_ns"], model_name) obj = _wait_for_maasmodelref_status( model_name, case["tenant_ns"], lambda s: s.get("phase") == "Failed", timeout=120, ) status = obj.get("status", {}) assert status["phase"] == "Failed" assert status.get("resolvedTenantRef", "") == "", ( "resolvedTenantRef should be empty when no tenant matches" ) conditions = status.get("conditions") or [] messages = [c.get("message") or "" for c in conditions] > assert any("no AITenant found" in m for m in messages), ( f"Expected a condition message reporting failed tenant resolution, got: {conditions}" ) E AssertionError: Expected a condition message reporting failed tenant resolution, got: [{'lastTransitionTime': '2026-09-08T16:35:03Z', 'message': 'Failed to reconcile HTTPRoute: HTTPRoute ai-tenant-e2e-noten-7a2cf0/noten-model-7a2cf0-kserve-route does not reference gateway (expected: openshift-ingress/maas-default-gateway, found: openshift-ingress/e2e-noten-7a2cf0). The LLMInferenceService must be configured to use openshift-ingress/maas-default-gateway', 'observedGeneration': 1, 'reason': 'ReconcileFailed', 'status': 'False', 'type': 'Ready'}] E assert False E + where False = any(<generator object TestTenantAutoResolve.test_no_matching_tenant_enters_failed.<locals>.<genexpr> at 0x7fa3b28b83c0>) test/e2e/tests/test_tenant_auto_resolve.py:196: AssertionError/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:355: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:133: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:181: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:268: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:215: Per-tenant OIDC tokens unavailable — set OIDC_TOKEN_URL (tenant-a) and OIDC_TOKEN_URL_TENANT_B (tenant-b), or OIDC_TOKEN_TENANT_A / OIDC_TOKEN_TENANT_B