self = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7fb1c0857c10> api_keys_base_url = 'https://maas.apps.eba52fc3-7652-4833-ab84-e924bb8889c1.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IkpUV0NULXVLMlZ1YnNETHRiNXJlbHFPVDhJY2NSQnc5MnowQ2VndWpEN2cifQ.e...wiIevNliGU4eznzRT4Q0qN1WuoH17E0OmwM-oeLcRzR7IFmTpHaCiq9_YLkLiQ0_A8RdaU9sH_5l86UZA', 'Content-Type': 'application/json'} def test_search_without_subscription_returns_all(self, api_keys_base_url: str, headers: dict): """Search without subscription filter returns keys across all subscriptions.""" key_ids = [] try: # Create keys with explicit subscription binding for i in range(2): r = requests.post( api_keys_base_url, headers=headers, json={"name": f"e2e-nofilter-{i}", "subscription": SIMULATOR_SUBSCRIPTION}, timeout=TIMEOUT, verify=TLS_VERIFY, ) > assert r.status_code in (200, 201), f"Failed to create key: {r.text}" E AssertionError: Failed to create key: E assert 403 in (200, 201) E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:1576: AssertionError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_negative_security.TestHeaderSpoofing object at 0x7fb1c037b8e0> def test_injected_identity_headers_ignored(self): """Client injects X-MaaS-Username/Group/Key-Id — platform ignores them. Validates that Authorino strips attacker-controlled identity headers. The request should succeed (200) using the real key-derived identity, proving the spoofed headers had no effect on authorization. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:83: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6IkpUV0NULXVLMlZ1YnNETHRiNXJlbHFPVDhJY2NSQnc5MnowQ2VndWpEN2cifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...-Ez-fseUilQvV77ucjxdFjS5c3PYKtx6lIgdFwiIevNliGU4eznzRT4Q0qN1WuoH17E0OmwM-oeLcRzR7IFmTpHaCiq9_YLkLiQ0_A8RdaU9sH_5l86UZA' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:276: RuntimeErrorself = <test_negative_security.TestHeaderSpoofing object at 0x7fb1c088f400> def test_duplicate_subscription_headers_ignored(self): """Client sends multiple X-MaaS-Subscription headers — API key binding wins. For API key requests, the subscription is fixed at mint time. Duplicate or conflicting X-MaaS-Subscription headers must not override the key-derived subscription. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:108: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6IkpUV0NULXVLMlZ1YnNETHRiNXJlbHFPVDhJY2NSQnc5MnowQ2VndWpEN2cifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...-Ez-fseUilQvV77ucjxdFjS5c3PYKtx6lIgdFwiIevNliGU4eznzRT4Q0qN1WuoH17E0OmwM-oeLcRzR7IFmTpHaCiq9_YLkLiQ0_A8RdaU9sH_5l86UZA' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:276: RuntimeError/workspace/source/test/e2e/tests/test_negative_security.py:188: Could not create short-lived key: 403self = <test_negative_security.TestCrossModelAccess object at 0x7fb1c088ffd0> def test_key_cannot_access_model_outside_subscription(self): """Key for model A cannot infer on model B outside its subscription. Uses the pre-deployed unconfigured model (a model with no subscription granting access to it) to test cross-model access denial. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:222: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6IkpUV0NULXVLMlZ1YnNETHRiNXJlbHFPVDhJY2NSQnc5MnowQ2VndWpEN2cifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...-Ez-fseUilQvV77ucjxdFjS5c3PYKtx6lIgdFwiIevNliGU4eznzRT4Q0qN1WuoH17E0OmwM-oeLcRzR7IFmTpHaCiq9_YLkLiQ0_A8RdaU9sH_5l86UZA' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:276: RuntimeError/workspace/source/test/e2e/tests/test_subscription.py:1056: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not assertedself = <test_aitenant_lifecycle.TestAITenantLifecycle object at 0x7fb1c08a0b50> def test_aitenant_delete_cleans_up_bootstrap_resources(self): case = _new_aitenant_case() try: _apply_gateway_fixture(case) _apply_aitenant(case) _assert_aitenant_bootstrap_resources(case) > _delete_aitenant(case) test/e2e/tests/test_aitenant_lifecycle.py:513: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/tests/test_aitenant_lifecycle.py:250: in _delete_aitenant _delete(AITENANT_KIND, case["aitenant_name"], AITENANT_NAMESPACE, timeout="180s") _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ kind = 'aitenant', name = 'e2e-ait-ad85eda1', namespace = 'ai-tenants' def _delete(kind, name, namespace=None, *, timeout="60s"): args = ["delete", kind, name, "--ignore-not-found", f"--timeout={timeout}"] if namespace: args.extend(["-n", namespace]) process_timeout = OC_TIMEOUT + 30 if timeout.endswith("s") and timeout[:-1].isdigit(): process_timeout = max(process_timeout, int(timeout[:-1]) + 30) result = _oc_run(args, timeout=process_timeout) if result.returncode != 0: > raise RuntimeError(f"`oc {' '.join(args)}` failed: {result.stderr.strip() or result.stdout.strip()}") E RuntimeError: `oc delete aitenant e2e-ait-ad85eda1 --ignore-not-found --timeout=180s -n ai-tenants` failed: error: timed out waiting for the condition on aitenants/e2e-ait-ad85eda1 test/e2e/tests/test_aitenant_lifecycle.py:76: RuntimeError