/workspace/source/test/e2e/tests/test_namespace_scoping.py:214: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:247: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:287: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:324: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:382: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:456: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_tenant_discovery.py:79: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery.py:155: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_external_oidc.py:252: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:263: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:277: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:290: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:303: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:335: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:379: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:395: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:405: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:428: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:436: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:441: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:454: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:501: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:537: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:602: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:633: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:659: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:690: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:750: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:786: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:824: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:872: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:961: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1013: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1049: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1103: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1142: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:189: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:355: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:93: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:141: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:228: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.self = <test_api_keys.TestAPIKeyAuthorization object at 0x7f4897fc9af0> api_keys_base_url = 'https://e2e-worker-w0-d36b91.apps.4c13e614-fab5-49e3-95bc-c074d30ae41e.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...BrEJxIA6DoEE1AX5KOhgzmiQ49Xsj3eXjtOvIxjTgi_4-OKRhcdV2bREooICyapz19PvE7_fmBMmdF6pQ', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...cbV31BTdeVolwolsl_vL4iYwiqX8OnCP_BgwaPdy4DX32Josu7iH4XqxgVw7T4wC6PzK-M623ioR5sE0g', 'Content-Type': 'application/json'} def test_admin_manage_other_users_keys(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Test 4: Admin can manage other user's keys - list and revoke.""" if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") # Create key as regular user r_create = requests.post(api_keys_base_url, headers=headers, json={"name": "regular-user-key"}, timeout=30, verify=TLS_VERIFY) assert r_create.status_code in (200, 201) user_key_id = r_create.json()["id"] # Get username r_get = requests.get(f"{api_keys_base_url}/{user_key_id}", headers=headers, timeout=30, verify=TLS_VERIFY) username = r_get.json().get("username") or r_get.json().get("owner") assert username print(f"[admin] User '{username}' created key {user_key_id}") # Admin lists keys filtered by username using search endpoint r_admin = requests.post( f"{api_keys_base_url}/search", headers=admin_headers, json={ "filters": {"username": username, "status": ["active"]}, "sort": {"by": "created_at", "order": "desc"}, "pagination": {"limit": 50, "offset": 0} }, timeout=30, verify=TLS_VERIFY ) > assert r_admin.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:317: AssertionErrorself = <test_api_keys.TestAPIKeyBulkOperations object at 0x7f489c06bca0> api_keys_base_url = 'https://e2e-worker-w0-d36b91.apps.4c13e614-fab5-49e3-95bc-c074d30ae41e.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...BrEJxIA6DoEE1AX5KOhgzmiQ49Xsj3eXjtOvIxjTgi_4-OKRhcdV2bREooICyapz19PvE7_fmBMmdF6pQ', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...cbV31BTdeVolwolsl_vL4iYwiqX8OnCP_BgwaPdy4DX32Josu7iH4XqxgVw7T4wC6PzK-M623ioR5sE0g', 'Content-Type': 'application/json'} def test_bulk_revoke_admin_can_revoke_any_user(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Test 10: Bulk revoke - admin can bulk revoke any user's keys.""" if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") # Create a key as regular user r = requests.post(api_keys_base_url, headers=headers, json={"name": "admin-bulk-revoke-test"}, timeout=30, verify=TLS_VERIFY) assert r.status_code in (200, 201) key_id = r.json()["id"] # Get username r_get = requests.get(f"{api_keys_base_url}/{key_id}", headers=headers, timeout=30, verify=TLS_VERIFY) username = r_get.json().get("username") or r_get.json().get("owner") assert username # Admin bulk revokes user's keys r_bulk = requests.post( f"{api_keys_base_url}/bulk-revoke", headers=admin_headers, json={"username": username}, timeout=30, verify=TLS_VERIFY ) > assert r_bulk.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:425: AssertionErrorself = <test_api_keys.TestAPIKeyBulkOperations object at 0x7f489c06b6d0> api_keys_base_url = 'https://e2e-worker-w0-d36b91.apps.4c13e614-fab5-49e3-95bc-c074d30ae41e.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...BrEJxIA6DoEE1AX5KOhgzmiQ49Xsj3eXjtOvIxjTgi_4-OKRhcdV2bREooICyapz19PvE7_fmBMmdF6pQ', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...cbV31BTdeVolwolsl_vL4iYwiqX8OnCP_BgwaPdy4DX32Josu7iH4XqxgVw7T4wC6PzK-M623ioR5sE0g', 'Content-Type': 'application/json'} def test_bulk_revoke_by_subscription(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Admin can bulk revoke all keys bound to a subscription.""" if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") sub_name = f"e2e-bulk-sub-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-bulk-sa-{os.urandom(4).hex()}" key_ids = [] try: oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} _create_test_auth_policy(f"{sub_name}-auth", MODEL_REF, users=[sa_user]) _create_test_subscription(sub_name, MODEL_REF, users=[sa_user]) _wait_for_maas_subscription_phase(sub_name, namespace=ns) for i in range(3): r = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa_headers, json={"name": f"sub-bulk-{i}", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r.status_code in (200, 201), f"Failed to create key: {r.text}" key_ids.append(r.json()["id"]) r_bulk = requests.post( f"{api_keys_base_url}/bulk-revoke", headers=admin_headers, json={"subscription": sub_name}, timeout=30, verify=TLS_VERIFY, ) > assert r_bulk.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:465: AssertionErrorself = <test_api_keys.TestAPIKeyBulkOperations object at 0x7f4897fe8790> api_keys_base_url = 'https://e2e-worker-w0-d36b91.apps.4c13e614-fab5-49e3-95bc-c074d30ae41e.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...BrEJxIA6DoEE1AX5KOhgzmiQ49Xsj3eXjtOvIxjTgi_4-OKRhcdV2bREooICyapz19PvE7_fmBMmdF6pQ', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...cbV31BTdeVolwolsl_vL4iYwiqX8OnCP_BgwaPdy4DX32Josu7iH4XqxgVw7T4wC6PzK-M623ioR5sE0g', 'Content-Type': 'application/json'} def test_bulk_revoke_dry_run_by_subscription(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Admin dry-run by subscription returns correct key count.""" if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") sub_name = f"e2e-dry-sub-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-dry-sa-{os.urandom(4).hex()}" key_ids = [] try: oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} _create_test_auth_policy(f"{sub_name}-auth", MODEL_REF, users=[sa_user]) _create_test_subscription(sub_name, MODEL_REF, users=[sa_user]) _wait_for_maas_subscription_phase(sub_name, namespace=ns) for i in range(2): r = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa_headers, json={"name": f"dry-sub-{i}", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r.status_code in (200, 201) key_ids.append(r.json()["id"]) r_dry = requests.post( f"{api_keys_base_url}/bulk-revoke", headers=admin_headers, json={"subscription": sub_name, "dryRun": True}, timeout=30, verify=TLS_VERIFY, ) > assert r_dry.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:574: AssertionErrorself = <test_api_keys.TestAPIKeyBulkOperations object at 0x7f4897fe8760> api_keys_base_url = 'https://e2e-worker-w0-d36b91.apps.4c13e614-fab5-49e3-95bc-c074d30ae41e.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...BrEJxIA6DoEE1AX5KOhgzmiQ49Xsj3eXjtOvIxjTgi_4-OKRhcdV2bREooICyapz19PvE7_fmBMmdF6pQ', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5Fam53bVdIVXRMdHBWamlVMDJfZnZNRnpiQ0RDbTVqbVhzandjNVROLWsifQ.e...cbV31BTdeVolwolsl_vL4iYwiqX8OnCP_BgwaPdy4DX32Josu7iH4XqxgVw7T4wC6PzK-M623ioR5sE0g', 'Content-Type': 'application/json'} def test_bulk_revoke_combined_user_and_subscription(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Admin can revoke keys for a specific user within a specific subscription. Negative control: a second user's keys in the same subscription must remain active. """ if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") sub_name = f"e2e-combo-sub-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-combo-sa-{os.urandom(4).hex()}" sa2_name = f"e2e-combo-sa2-{os.urandom(4).hex()}" key_ids = [] key_ids_user2 = [] try: oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} oc_token2 = _create_sa_token(sa2_name, namespace=MODEL_NAMESPACE) sa_user2 = _sa_to_user(sa2_name, namespace=MODEL_NAMESPACE) sa2_headers = {"Authorization": f"Bearer {oc_token2}", "Content-Type": "application/json"} _create_test_auth_policy(f"{sub_name}-auth", MODEL_REF, users=[sa_user, sa_user2]) _create_test_subscription(sub_name, MODEL_REF, users=[sa_user, sa_user2]) _wait_for_maas_subscription_phase(sub_name, namespace=ns) for i in range(2): r = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa_headers, json={"name": f"combined-{i}", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r.status_code in (200, 201) key_ids.append(r.json()["id"]) r_u2 = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa2_headers, json={"name": "user2-key", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r_u2.status_code in (200, 201) key_ids_user2.append(r_u2.json()["id"]) r_get = requests.get(f"{api_keys_base_url}/{key_ids[0]}", headers=sa_headers, timeout=30, verify=TLS_VERIFY) username = r_get.json().get("username") or r_get.json().get("owner") assert username r_bulk = requests.post( f"{api_keys_base_url}/bulk-revoke", headers=admin_headers, json={"username": username, "subscription": sub_name}, timeout=30, verify=TLS_VERIFY, ) > assert r_bulk.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:651: AssertionError/workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:215: Per-tenant OIDC tokens unavailable — set OIDC_TOKEN_URL (tenant-a) and OIDC_TOKEN_URL_TENANT_B (tenant-b), or OIDC_TOKEN_TENANT_A / OIDC_TOKEN_TENANT_B/workspace/source/test/e2e/tests/test_gateway_scoped_authpolicy.py:219: legacy gateway-default-auth is scoped to the shared default gateway