/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_subscription.py:1055: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:186: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:352: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_gateway_scoped_authpolicy.py:183: gateway-default-auth not present (maas-gateway-auth is active); scoping is validated by unit testsself = <test_gateway_scoped_authpolicy.TestEnforcementGapAfterAuthPolicyChange object at 0x7fa34b1aeb20> def test_controller_holds_pending_while_unenforced(self): """With Kuadrant down, MaaSAuthPolicy must NOT reach Active after a gateway AuthPolicy spec change. Steps: 1. Establish baseline: auth policy Active, gateway Enforced 2. Scale Kuadrant down (freeze enforcement) 3. Create a second MaaSAuthPolicy (changes aggregated allowlist → spec update) 4. Wait for maas-controller to reconcile 5. Check MaaSAuthPolicy phase — should be Pending (not Active) 6. Scale Kuadrant back up, wait for enforcement 7. Verify MaaSAuthPolicy reaches Active and API key creation succeeds """ ns = _ns() suffix = uuid.uuid4().hex[:8] auth_name_1 = f"e2e-enforce-gap-auth1-{suffix}" auth_name_2 = f"e2e-enforce-gap-auth2-{suffix}" sub_name = f"e2e-enforce-gap-sub-{suffix}" sa_name = f"e2e-enforce-gap-sa-{suffix}" try: # Step 1: Establish baseline with first auth policy. oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) _create_test_auth_policy(auth_name_1, MODEL_REF, users=[sa_user]) _create_test_subscription(sub_name, MODEL_REF, users=[sa_user]) _wait_for_maas_auth_policy_phase(auth_name_1, timeout=120, require_enforced=True) _wait_for_gateway_auth_enforced() log.info("Step 1: Baseline established — auth Active, gateway Enforced") # Step 2: Scale Kuadrant down to freeze enforcement. log.info("Step 2: Scaling Kuadrant down to freeze enforcement...") _scale_kuadrant_controller_down() # Step 3: Create a second MaaSAuthPolicy with a different group. # This changes the aggregated model allowlist, which changes the gateway # AuthPolicy spec. The maas-controller will update the spec, but Kuadrant # (now down) cannot re-process it → observedGeneration lags → not enforced. log.info("Step 3: Creating second MaaSAuthPolicy to trigger spec change...") unique_group = f"e2e-trigger-group-{suffix}" _create_test_auth_policy(auth_name_2, MODEL_REF, groups=[unique_group]) # Step 4: Wait for maas-controller to reconcile. # The controller updates the gateway AuthPolicy, then checks enforcement. # With Kuadrant down, observedGeneration won't catch up → Enforced stale. _wait_reconcile(seconds=15) # Step 5: Check MaaSAuthPolicy phase. # Check both policies — both should be affected by the enforcement gate. cr1 = _get_cr("maasauthpolicy", auth_name_1, namespace=ns) cr2 = _get_cr("maasauthpolicy", auth_name_2, namespace=ns) phase1 = (cr1 or {}).get("status", {}).get("phase", "unknown") phase2 = (cr2 or {}).get("status", {}).get("phase", "unknown") log.info("Step 5: MaaSAuthPolicy phases: %s=%s, %s=%s", auth_name_1, phase1, auth_name_2, phase2) if phase2 == "Pending": log.info("Controller correctly holding MaaSAuthPolicy in Pending " "while gateway AuthPolicy is not enforced") elif phase2 == "Active": log.warning("MaaSAuthPolicy is Active despite gateway not being enforced " "— controller is NOT checking enforcement (pre-fix behavior)") # Step 6: Scale Kuadrant back up and wait for enforcement. log.info("Step 6: Scaling Kuadrant back up...") _scale_kuadrant_controller_up() _wait_for_gateway_auth_enforced(timeout=180) _wait_for_maas_auth_policy_phase( auth_name_1, "Active", timeout=120, require_enforced=True ) log.info("Step 6: Enforcement restored") # Step 7: Verify API key creation succeeds. api_key = _create_api_key(oc_token, name=f"post-gap-{suffix}", subscription=sub_name) assert api_key and api_key.startswith("sk-"), ( f"Expected valid API key after enforcement restored, got: " f"{api_key[:20] if api_key else None}" ) log.info("Step 7: API key creation succeeded after enforcement restored") # Final assertion: the second auth policy (the one that triggered the # spec change) should have been held in Pending while Kuadrant was down. > assert phase2 == "Pending", ( f"RHOAIENG-79568: MaaSAuthPolicy '{auth_name_2}' was '{phase2}' while " f"gateway AuthPolicy was NOT enforced (Kuadrant was down). " f"With the enforcement-check fix, the controller should hold Pending " f"until Enforced=True." ) E AssertionError: RHOAIENG-79568: MaaSAuthPolicy 'e2e-enforce-gap-auth2-c5555715' was 'Active' while gateway AuthPolicy was NOT enforced (Kuadrant was down). With the enforcement-check fix, the controller should hold Pending until Enforced=True. E assert 'Active' == 'Pending' E E - Pending E + Active test/e2e/tests/test_gateway_scoped_authpolicy.py:310: AssertionError/workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:212: Per-tenant OIDC tokens unavailable — set OIDC_TOKEN_URL (tenant-a) and OIDC_TOKEN_URL_TENANT_B (tenant-b), or OIDC_TOKEN_TENANT_A / OIDC_TOKEN_TENANT_B/workspace/source/test/e2e/tests/test_tenant_discovery.py:134: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery.py:210: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:131: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:179: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:266: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_external_oidc.py:249: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:260: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:274: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:287: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:300: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:332: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:376: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:392: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:402: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:425: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:433: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:438: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:451: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:498: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:534: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:599: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:630: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:656: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:687: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:747: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:771: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:824: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:872: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:926: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:978: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1014: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1068: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1107: EXTERNAL_OIDC not enabled