self = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7f4c425178e0> api_keys_base_url = 'https://maas.apps.40c20930-21fc-49b7-8894-31c4622d6a09.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Imw2eFdlbllGTlptU1Z5UXFfODBFSjV2bU12TXloQ1hTSk5JdHVmUF9ENHcifQ.e...6WLPQOZ1emeI4qzHty2uwMDwOMzz3ZwAap-x_bhGz__w29HTO-_VjDQ1tLITGc-ydKWeZwBbMTIo5hlow', 'Content-Type': 'application/json'} def test_search_without_subscription_returns_all(self, api_keys_base_url: str, headers: dict): """Search without subscription filter returns keys across all subscriptions.""" key_ids = [] try: # Create keys with explicit subscription binding for i in range(2): r = requests.post( api_keys_base_url, headers=headers, json={"name": f"e2e-nofilter-{i}", "subscription": SIMULATOR_SUBSCRIPTION}, timeout=TIMEOUT, verify=TLS_VERIFY, ) > assert r.status_code in (200, 201), f"Failed to create key: {r.text}" E AssertionError: Failed to create key: E assert 403 in (200, 201) E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:1576: AssertionError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_negative_security.TestHeaderSpoofing object at 0x7f4c42115310> def test_injected_identity_headers_ignored(self): """Client injects X-MaaS-Username/Group/Key-Id — platform ignores them. Validates that Authorino strips attacker-controlled identity headers. The request should succeed (200) using the real key-derived identity, proving the spoofed headers had no effect on authorization. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:83: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6Imw2eFdlbllGTlptU1Z5UXFfODBFSjV2bU12TXloQ1hTSk5JdHVmUF9ENHcifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...C8qwUEG4T9tBpl0TTcvRIGkvujfb2e_Ox4iwe6WLPQOZ1emeI4qzHty2uwMDwOMzz3ZwAap-x_bhGz__w29HTO-_VjDQ1tLITGc-ydKWeZwBbMTIo5hlow' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:290: RuntimeErrorself = <test_negative_security.TestHeaderSpoofing object at 0x7f4c42115a90> def test_duplicate_subscription_headers_ignored(self): """Client sends multiple X-MaaS-Subscription headers — API key binding wins. For API key requests, the subscription is fixed at mint time. Duplicate or conflicting X-MaaS-Subscription headers must not override the key-derived subscription. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:110: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6Imw2eFdlbllGTlptU1Z5UXFfODBFSjV2bU12TXloQ1hTSk5JdHVmUF9ENHcifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...C8qwUEG4T9tBpl0TTcvRIGkvujfb2e_Ox4iwe6WLPQOZ1emeI4qzHty2uwMDwOMzz3ZwAap-x_bhGz__w29HTO-_VjDQ1tLITGc-ydKWeZwBbMTIo5hlow' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:290: RuntimeError/workspace/source/test/e2e/tests/test_negative_security.py:200: Could not create short-lived key: 403self = <test_negative_security.TestCrossModelAccess object at 0x7f4c425e0430> def test_key_cannot_access_model_outside_subscription(self): """Key for model A cannot infer on model B outside its subscription. Uses the pre-deployed unconfigured model (a model with no subscription granting access to it) to test cross-model access denial. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:234: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6Imw2eFdlbllGTlptU1Z5UXFfODBFSjV2bU12TXloQ1hTSk5JdHVmUF9ENHcifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...C8qwUEG4T9tBpl0TTcvRIGkvujfb2e_Ox4iwe6WLPQOZ1emeI4qzHty2uwMDwOMzz3ZwAap-x_bhGz__w29HTO-_VjDQ1tLITGc-ydKWeZwBbMTIo5hlow' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:290: RuntimeError/workspace/source/test/e2e/tests/test_subscription.py:1054: gateway-only mode: per-model AuthPolicy is not createdgateway_url = 'https://maas.apps.40c20930-21fc-49b7-8894-31c4622d6a09.prod.konfluxeaas.com' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Imw2eFdlbllGTlptU1Z5UXFfODBFSjV2bU12TXloQ1hTSk5JdHVmUF9ENHcifQ.e...6WLPQOZ1emeI4qzHty2uwMDwOMzz3ZwAap-x_bhGz__w29HTO-_VjDQ1tLITGc-ydKWeZwBbMTIo5hlow', 'Content-Type': 'application/json'} api_keys_base_url = 'https://maas.apps.40c20930-21fc-49b7-8894-31c4622d6a09.prod.konfluxeaas.com/maas-api/v1/api-keys' @pytest.fixture(scope="module") def external_models_setup(gateway_url, headers, api_keys_base_url): """ Create a single ExternalModel CR, MaaSModelRef, AuthPolicy, and Subscription pointing to an external endpoint. Cleanup after tests. """ log.info(f"Setting up external model test fixture (endpoint: {EXTERNAL_ENDPOINT})...") # Create a dummy secret (ExternalModel requires credentialRef). # The apikey-injection plugin's secret store only watches Secrets carrying # this label; without it credential lookups silently fail with a 500 at # request time (masked by tests that only assert non-401/403). _apply_cr({ "apiVersion": "v1", "kind": "Secret", "metadata": { "name": f"{EXTERNAL_MODEL_NAME}-api-key", "namespace": MODEL_NAMESPACE, "labels": {"inference.llm-d.ai/ipp-managed": "true"}, }, "type": "Opaque", "stringData": {"api-key": "e2e-test-key"}, }) # Create ExternalProvider CR (inference.opendatahub.io — canonical) > _apply_cr({ "apiVersion": "inference.opendatahub.io/v1alpha1", "kind": "ExternalProvider", "metadata": {"name": EXTERNAL_PROVIDER_NAME, "namespace": MODEL_NAMESPACE}, "spec": { "provider": "openai", "endpoint": EXTERNAL_ENDPOINT, "auth": { "type": "simple", "secretRef": {"name": f"{EXTERNAL_MODEL_NAME}-api-key"}, }, }, }) test/e2e/tests/test_external_models.py:135: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/tests/test_helper.py:322: in _apply_cr subprocess.run(["oc", "apply", "-f", "-"], input=json.dumps(cr_dict), capture_output=True, text=True, check=True) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ input = '{"apiVersion": "inference.opendatahub.io/v1alpha1", "kind": "ExternalProvider", "metadata": {"name": "e2e-external-pr...penai", "endpoint": "httpbingo.org", "auth": {"type": "simple", "secretRef": {"name": "e2e-external-model-api-key"}}}}' capture_output = True, timeout = None, check = True popenargs = (['oc', 'apply', '-f', '-'],) kwargs = {'stderr': -1, 'stdin': -1, 'stdout': -1, 'text': True} process = <Popen: returncode: 1 args: ['oc', 'apply', '-f', '-']>, stdout = '' stderr = 'The ExternalProvider "e2e-external-provider" is invalid: spec.auth.type: Unsupported value: "simple": supported values: "apikey", "sigv4", "oauth2"\n' retcode = 1 def run(*popenargs, input=None, capture_output=False, timeout=None, check=False, **kwargs): """Run command with arguments and return a CompletedProcess instance. The returned instance will have attributes args, returncode, stdout and stderr. By default, stdout and stderr are not captured, and those attributes will be None. Pass stdout=PIPE and/or stderr=PIPE in order to capture them. If check is True and the exit code was non-zero, it raises a CalledProcessError. The CalledProcessError object will have the return code in the returncode attribute, and output & stderr attributes if those streams were captured. If timeout is given, and the process takes too long, a TimeoutExpired exception will be raised. There is an optional argument "input", allowing you to pass bytes or a string to the subprocess's stdin. If you use this argument you may not also use the Popen constructor's "stdin" argument, as it will be used internally. By default, all communication is in bytes, and therefore any "input" should be bytes, and the stdout and stderr will be bytes. If in text mode, any "input" should be a string, and stdout and stderr will be strings decoded according to locale encoding, or by "encoding" if set. Text mode is triggered by setting any of text, encoding, errors or universal_newlines. The other arguments are the same as for the Popen constructor. """ if input is not None: if kwargs.get('stdin') is not None: raise ValueError('stdin and input arguments may not both be used.') kwargs['stdin'] = PIPE if capture_output: if kwargs.get('stdout') is not None or kwargs.get('stderr') is not None: raise ValueError('stdout and stderr arguments may not be used ' 'with capture_output.') kwargs['stdout'] = PIPE kwargs['stderr'] = PIPE with Popen(*popenargs, **kwargs) as process: try: stdout, stderr = process.communicate(input, timeout=timeout) except TimeoutExpired as exc: process.kill() if _mswindows: # Windows accumulates the output in a single blocking # read() call run on child threads, with the timeout # being done in a join() on those threads. communicate() # _after_ kill() is required to collect that and add it # to the exception. exc.stdout, exc.stderr = process.communicate() else: # POSIX _communicate already populated the output so # far into the TimeoutExpired exception. process.wait() raise except: # Including KeyboardInterrupt, communicate handled that. process.kill() # We don't call process.wait() as .__exit__ does that for us. raise retcode = process.poll() if check and retcode: > raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) E subprocess.CalledProcessError: Command '['oc', 'apply', '-f', '-']' returned non-zero exit status 1. /usr/lib64/python3.9/subprocess.py:528: CalledProcessError