/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_subscription.py:1056: gateway-only mode: per-model AuthPolicy is not createdself = <test_models_endpoint.TestModelsEndpoint object at 0x7fdb3f2aac40> def test_different_modelrefs_same_model_id(self): """ Test 7: Different modelRefs serving same model ID return separate entries. Uses two DIFFERENT MaaSModelRefs (each listed ONCE) that both serve the SAME model ID: - MODEL_REF (facebook-opt-125m-simulated) → serves "facebook/opt-125m" - PREMIUM_MODEL_REF (premium-simulated-simulated-premium) → serves "facebook/opt-125m" The API deduplicates by (model ID, URL). Since these are different backend services with different URLs, they return as 2 separate entries even though they serve the same model ID. Each entry shows the same model ID but different URL and subscription. """ log.info("Test 7: Different modelRefs same ID should deduplicate (INTENDED behavior)") sa_name = "e2e-models-diff-refs-sa" sa_ns = "default" maas_ns = _ns() subscription_name = "e2e-diff-refs-subscription" auth_policy_name = "e2e-diff-refs-auth" api_key = None try: # Create SA sa_token = _create_sa_token(sa_name, namespace=sa_ns) sa_user = _sa_to_user(sa_name, namespace=sa_ns) # Create auth policy with both modelRefs log.info(f"Creating auth policy with {MODEL_REF} and {PREMIUM_MODEL_REF}") auth_policy_cr = { "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSAuthPolicy", "metadata": { "name": auth_policy_name, "namespace": maas_ns, }, "spec": { "modelRefs": [ {"name": MODEL_REF, "namespace": MODEL_NAMESPACE}, {"name": PREMIUM_MODEL_REF, "namespace": MODEL_NAMESPACE}, ], "subjects": { "users": [sa_user], "groups": [], }, }, } subprocess.run( ["oc", "apply", "-f", "-"], input=json.dumps(auth_policy_cr), text=True, check=True, ) # Create subscription with both modelRefs (each listed ONCE) log.info(f"Creating subscription with {MODEL_REF} and {PREMIUM_MODEL_REF}") subscription_cr = { "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSSubscription", "metadata": { "name": subscription_name, "namespace": maas_ns, }, "spec": { "owner": { "users": [sa_user], "groups": [], }, "modelRefs": [ { "name": MODEL_REF, "namespace": MODEL_NAMESPACE, "tokenRateLimits": [{"limit": 100, "window": "1m"}], }, { "name": PREMIUM_MODEL_REF, "namespace": MODEL_NAMESPACE, "tokenRateLimits": [{"limit": 200, "window": "1m"}], }, ], }, } subprocess.run( ["oc", "apply", "-f", "-"], input=json.dumps(subscription_cr), text=True, check=True, ) # Wait for subscription to reconcile before creating API key _wait_for_maas_subscription_phase(subscription_name, namespace=maas_ns) # Create API key bound to our test subscription api_key = _create_api_key(sa_token, name="e2e-diff-refs-test-key", subscription=subscription_name) _wait_reconcile() # Query /v1/models log.info(f"Querying /v1/models with subscription: {subscription_name}") r = _get_models_with_gateway_retry( headers={ "Authorization": f"Bearer {api_key}", "x-maas-subscription": subscription_name, }, ) assert r.status_code == 200, f"Expected 200, got {r.status_code}: {r.text}" data = r.json() models = data.get("data") or [] assert isinstance(models, list), "Models should be a list" # Get model IDs from response model_ids = [m["id"] for m in models] unique_ids = set(model_ids) log.info(f"#x1F4CA API Response: {len(models)} total model(s), {len(unique_ids)} unique ID(s)") log.info(f" Model IDs: {model_ids}") log.info(f" Unique IDs: {unique_ids}") log.info(" Subscription had: 2 different modelRefs both serving 'facebook/opt-125m'") # Both modelRefs serve the same model ID assert len(unique_ids) == 1, \ f"Expected only 1 unique model ID (both modelRefs serve {MODEL_NAME}), got {len(unique_ids)}: {unique_ids}" # Verify it's the expected model ID expected_id = MODEL_NAME assert expected_id in unique_ids, \ f"Expected to find '{expected_id}', but got {unique_ids}" # INTENDED BEHAVIOR: Should return 2 entries (deduplication by model ID + URL) # Different backend services (different URLs) return separate entries even with same model ID > assert len(models) == 2, \ f"Expected 2 entries (different URLs), got {len(models)}: {model_ids}" E AssertionError: Expected 2 entries (different URLs), got 1: ['facebook/opt-125m'] E assert 1 == 2 E + where 1 = len([{'created': 1783211705, 'id': 'facebook/opt-125m', 'kind': 'LLMInferenceService', 'modelDetails': {'description': 'A simulated OPT-125M model for free-tier testing', 'displayName': 'Facebook OPT 125M (Simulated)'}, ...}]) test/e2e/tests/test_models_endpoint.py:856: AssertionErrorself = <Response [403]>, kwargs = {} def json(self, **kwargs): r"""Decodes the JSON response body (if any) as a Python object. This may return a dictionary, list, etc. depending on what is in the response. :param \*\*kwargs: Optional arguments that ``json.loads`` takes. :raises requests.exceptions.JSONDecodeError: If the response body does not contain valid json. """ if not self.encoding and self.content and len(self.content) > 3: # No encoding set. JSON RFC 4627 section 3 states we should expect # UTF-8, -16 or -32. Detect which one to use; If the detection or # decoding fails, fall back to `self.text` (using charset_normalizer to make # a best guess). encoding = guess_json_utf(self.content) if encoding is not None: try: return complexjson.loads(self.content.decode(encoding), **kwargs) except UnicodeDecodeError: # Wrong UTF codec detected; usually because it's not UTF-8 # but some other 8-bit codec. This is an RFC violation, # and the server didn't bother to tell us what codec *was* # used. pass except JSONDecodeError as e: raise RequestsJSONDecodeError(e.msg, e.doc, e.pos) try: > return complexjson.loads(self.text, **kwargs) test/e2e/.venv/lib64/python3.9/site-packages/requests/models.py:976: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ /usr/lib64/python3.9/json/__init__.py:346: in loads return _default_decoder.decode(s) /usr/lib64/python3.9/json/decoder.py:337: in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = <json.decoder.JSONDecoder object at 0x7fdb40bb5760>, s = '', idx = 0 def raw_decode(self, s, idx=0): """Decode a JSON document from ``s`` (a ``str`` beginning with a JSON document) and return a 2-tuple of the Python representation and the index in ``s`` where the document ended. This can be used to decode a JSON document from a string that may have extraneous data at the end. """ try: obj, end = self.scan_once(s, idx) except StopIteration as err: > raise JSONDecodeError("Expecting value", s, err.value) from None E json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) /usr/lib64/python3.9/json/decoder.py:355: JSONDecodeError During handling of the above exception, another exception occurred: self = <test_models_endpoint.TestModelsEndpoint object at 0x7fdb3f6adc40> def test_api_key_with_deleted_subscription_403(self): """ Test: API key bound to a subscription that was deleted after key creation. This tests an edge case where an API key was minted with a subscription, but that subscription is later deleted. The gateway injects X-MaaS-Subscription from the key, but the subscription no longer exists. Expected: HTTP 403 with error type: permission_error """ ns = _ns() auth_policy_name = "e2e-api-key-deleted-sub-auth" subscription_name = "e2e-api-key-deleted-sub" sa_name = "e2e-api-key-deleted-sub-sa" api_key = None try: # Create service account and token oc_token = _create_sa_token(sa_name, namespace=ns) sa_user = _sa_to_user(sa_name, namespace=ns) # Create test resources _create_test_auth_policy(auth_policy_name, MODEL_REF, users=[sa_user]) _create_test_subscription(subscription_name, MODEL_REF, users=[sa_user]) # Wait for subscription to reconcile before creating API key _wait_for_maas_subscription_phase(subscription_name, namespace=ns) # Create API key bound to subscription api_key = _create_api_key(oc_token, name=f"{sa_name}-key", subscription=subscription_name) _wait_reconcile() # Delete the subscription (simulating deletion after key creation) log.info(f"Deleting subscription {subscription_name} after API key creation") _delete_cr("maassubscription", subscription_name, namespace=ns) _wait_reconcile() # Query with API key (gateway injects deleted subscription name) log.info("Querying /v1/models with API key bound to deleted subscription") r = _request_with_gateway_retry( requests.get, f"{_maas_api_url()}/v1/models", headers={ "Authorization": f"Bearer {api_key}", }, ) # Should return 403 because subscription doesn't exist assert r.status_code == 403, \ f"Expected 403 for API key with deleted subscription, got {r.status_code}: {r.text}" > data = r.json() test/e2e/tests/test_models_endpoint.py:1489: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = <Response [403]>, kwargs = {} def json(self, **kwargs): r"""Decodes the JSON response body (if any) as a Python object. This may return a dictionary, list, etc. depending on what is in the response. :param \*\*kwargs: Optional arguments that ``json.loads`` takes. :raises requests.exceptions.JSONDecodeError: If the response body does not contain valid json. """ if not self.encoding and self.content and len(self.content) > 3: # No encoding set. JSON RFC 4627 section 3 states we should expect # UTF-8, -16 or -32. Detect which one to use; If the detection or # decoding fails, fall back to `self.text` (using charset_normalizer to make # a best guess). encoding = guess_json_utf(self.content) if encoding is not None: try: return complexjson.loads(self.content.decode(encoding), **kwargs) except UnicodeDecodeError: # Wrong UTF codec detected; usually because it's not UTF-8 # but some other 8-bit codec. This is an RFC violation, # and the server didn't bother to tell us what codec *was* # used. pass except JSONDecodeError as e: raise RequestsJSONDecodeError(e.msg, e.doc, e.pos) try: return complexjson.loads(self.text, **kwargs) except JSONDecodeError as e: # Catch JSON-related errors and raise as requests.JSONDecodeError # This aliases json.JSONDecodeError and simplejson.JSONDecodeError > raise RequestsJSONDecodeError(e.msg, e.doc, e.pos) E requests.exceptions.JSONDecodeError: Expecting value: line 1 column 1 (char 0) test/e2e/.venv/lib64/python3.9/site-packages/requests/models.py:980: JSONDecodeError/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:186: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:358: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=trueself = <test_tenant_model_inference.TestTenantModelInference object at 0x7fdb3f25da00> def test_tenant_deletion_prevents_key_reuse_on_recreation(self): """Tenant deletion revokes keys - orphaned keys don't work if tenant is recreated. Security test (RHOAIENG-72792): When a tenant is deleted and recreated with the same name, old API keys from the deleted tenant should not grant access. Steps: 1. Create AITenant 2. Create API key 3. Delete AITenant 4. Recreate AITenant with same name 5. Verify old API key does not work """ require_aitenant_crd() case = new_named_tenant_case("e2e-reuse") orphaned_key = None try: # Step 1: Create AITenant bootstrap_aitenant_tenant(case) model_name = f"test-model-{case['suffix']}" _create_llmis(model_name, case["tenant_ns"], case["gateway_name"], GATEWAY_NAMESPACE) wait_for_httproute_accepted( f"{model_name}-kserve-route", case["tenant_ns"], case["gateway_name"], timeout=180 ) _create_maas_model_ref(model_name, case["tenant_ns"], model_name) apply_maas_subscription( f"{model_name}-sub", case["tenant_ns"], model_ref=model_name, model_namespace=case["tenant_ns"] ) apply_maas_auth_policy( f"{model_name}-auth", case["tenant_ns"], model_ref=model_name, model_namespace=case["tenant_ns"] ) wait_for_status_phase("maasmodelref", model_name, case["tenant_ns"], expected_phase="Ready", timeout=180) # Step 2: Create API key gateway_url = _get_tenant_gateway_url(case["gateway_name"]) oc_token = _get_cluster_token() r = requests.post( f"{gateway_url}/maas-api/v1/api-keys", headers={"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"}, json={"name": "e2e-orphaned-key", "subscription": f"{model_name}-sub"}, timeout=45, verify=TLS_VERIFY, ) assert r.status_code in (200, 201), f"Failed to create key: {r.status_code}" orphaned_key = r.json()["key"] # Verify key works BEFORE deletion validate_url = f"{gateway_url}/maas-api/v1/api-keys/validate" r = requests.post(validate_url, headers={"X-API-Key": orphaned_key}, timeout=45, verify=TLS_VERIFY) > assert r.status_code == 200, f"Key should work before deletion, but got {r.status_code}" E AssertionError: Key should work before deletion, but got 401 E assert 401 == 200 E + where 401 = <Response [401]>.status_code test/e2e/tests/test_tenant_model_inference.py:334: AssertionError/workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:158: OIDC_TOKEN_TENANT_A and OIDC_TOKEN_TENANT_B are required for per-tenant OIDC validationself = <test_subscription_deletion_revokes_keys.TestSubscriptionDeletionRevokesKeys object at 0x7fdb3f2ac850> api_keys_base_url = 'https://maas.apps.28088c15-3a47-4083-9daf-8b9c018590ea.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IkkwejNiRW1PVlpnb3VPUWZXa21DeW83SW5LaTZjTTJwc2RMRzhiTGsxcWMifQ.e...0Z-7f9-OdiEwgCSh4bs4FF38tH3ODNnzsdjVb_F2hhSoxaePYLIMnwf_ebtL6E1jtggR-cf2AxG9jULbA', 'Content-Type': 'application/json'} def test_subscription_deletion_revokes_keys(self, api_keys_base_url: str, headers: dict): """When a MaaSSubscription is deleted, keys bound to it are revoked.""" sub_a_name = "e2e-revoke-sub-a" sub_b_name = "e2e-revoke-sub-b" key_ids_a, key_ids_b, keys_a, keys_b = [], [], [], [] try: # Create two subscriptions for sub_name in [sub_a_name, sub_b_name]: > _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSSubscription", "metadata": {"name": sub_name, "namespace": MODEL_NAMESPACE}, "spec": { "owner": {"groups": [{"name": "system:authenticated"}]}, "modelRefs": [], # No model refs needed - just testing key revocation }, }) test/e2e/tests/test_subscription_deletion_revokes_keys.py:40: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/tests/test_helper.py:279: in _apply_cr subprocess.run(["oc", "apply", "-f", "-"], input=json.dumps(cr_dict), capture_output=True, text=True, check=True) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ input = '{"apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSSubscription", "metadata": {"name": "e2e-revoke-sub-a", "namespace": "llm"}, "spec": {"owner": {"groups": [{"name": "system:authenticated"}]}, "modelRefs": []}}' capture_output = True, timeout = None, check = True popenargs = (['oc', 'apply', '-f', '-'],) kwargs = {'stderr': -1, 'stdin': -1, 'stdout': -1, 'text': True} process = <Popen: returncode: 1 args: ['oc', 'apply', '-f', '-']>, stdout = '' stderr = 'The MaaSSubscription "e2e-revoke-sub-a" is invalid: spec.modelRefs: Invalid value: 0: spec.modelRefs in body should have at least 1 items\n' retcode = 1 def run(*popenargs, input=None, capture_output=False, timeout=None, check=False, **kwargs): """Run command with arguments and return a CompletedProcess instance. The returned instance will have attributes args, returncode, stdout and stderr. By default, stdout and stderr are not captured, and those attributes will be None. Pass stdout=PIPE and/or stderr=PIPE in order to capture them. If check is True and the exit code was non-zero, it raises a CalledProcessError. The CalledProcessError object will have the return code in the returncode attribute, and output & stderr attributes if those streams were captured. If timeout is given, and the process takes too long, a TimeoutExpired exception will be raised. There is an optional argument "input", allowing you to pass bytes or a string to the subprocess's stdin. If you use this argument you may not also use the Popen constructor's "stdin" argument, as it will be used internally. By default, all communication is in bytes, and therefore any "input" should be bytes, and the stdout and stderr will be bytes. If in text mode, any "input" should be a string, and stdout and stderr will be strings decoded according to locale encoding, or by "encoding" if set. Text mode is triggered by setting any of text, encoding, errors or universal_newlines. The other arguments are the same as for the Popen constructor. """ if input is not None: if kwargs.get('stdin') is not None: raise ValueError('stdin and input arguments may not both be used.') kwargs['stdin'] = PIPE if capture_output: if kwargs.get('stdout') is not None or kwargs.get('stderr') is not None: raise ValueError('stdout and stderr arguments may not be used ' 'with capture_output.') kwargs['stdout'] = PIPE kwargs['stderr'] = PIPE with Popen(*popenargs, **kwargs) as process: try: stdout, stderr = process.communicate(input, timeout=timeout) except TimeoutExpired as exc: process.kill() if _mswindows: # Windows accumulates the output in a single blocking # read() call run on child threads, with the timeout # being done in a join() on those threads. communicate() # _after_ kill() is required to collect that and add it # to the exception. exc.stdout, exc.stderr = process.communicate() else: # POSIX _communicate already populated the output so # far into the TimeoutExpired exception. process.wait() raise except: # Including KeyboardInterrupt, communicate handled that. process.kill() # We don't call process.wait() as .__exit__ does that for us. raise retcode = process.poll() if check and retcode: > raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) E subprocess.CalledProcessError: Command '['oc', 'apply', '-f', '-']' returned non-zero exit status 1. /usr/lib64/python3.9/subprocess.py:528: CalledProcessErrorself = <test_subscription_deletion_revokes_keys.TestSubscriptionDeletionRevokesKeys object at 0x7fdb3f2accd0> def test_subscription_deletion_with_no_keys(self): """Deleting a subscription with no API keys should succeed.""" sub_name = "e2e-revoke-nokeys" try: > _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSSubscription", "metadata": {"name": sub_name, "namespace": MODEL_NAMESPACE}, "spec": { "owner": {"groups": [{"name": "system:authenticated"}]}, "modelRefs": [], # No model refs needed - just testing deletion }, }) test/e2e/tests/test_subscription_deletion_revokes_keys.py:119: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/tests/test_helper.py:279: in _apply_cr subprocess.run(["oc", "apply", "-f", "-"], input=json.dumps(cr_dict), capture_output=True, text=True, check=True) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ input = '{"apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSSubscription", "metadata": {"name": "e2e-revoke-nokeys", "namespace": "llm"}, "spec": {"owner": {"groups": [{"name": "system:authenticated"}]}, "modelRefs": []}}' capture_output = True, timeout = None, check = True popenargs = (['oc', 'apply', '-f', '-'],) kwargs = {'stderr': -1, 'stdin': -1, 'stdout': -1, 'text': True} process = <Popen: returncode: 1 args: ['oc', 'apply', '-f', '-']>, stdout = '' stderr = 'The MaaSSubscription "e2e-revoke-nokeys" is invalid: spec.modelRefs: Invalid value: 0: spec.modelRefs in body should have at least 1 items\n' retcode = 1 def run(*popenargs, input=None, capture_output=False, timeout=None, check=False, **kwargs): """Run command with arguments and return a CompletedProcess instance. The returned instance will have attributes args, returncode, stdout and stderr. By default, stdout and stderr are not captured, and those attributes will be None. Pass stdout=PIPE and/or stderr=PIPE in order to capture them. If check is True and the exit code was non-zero, it raises a CalledProcessError. The CalledProcessError object will have the return code in the returncode attribute, and output & stderr attributes if those streams were captured. If timeout is given, and the process takes too long, a TimeoutExpired exception will be raised. There is an optional argument "input", allowing you to pass bytes or a string to the subprocess's stdin. If you use this argument you may not also use the Popen constructor's "stdin" argument, as it will be used internally. By default, all communication is in bytes, and therefore any "input" should be bytes, and the stdout and stderr will be bytes. If in text mode, any "input" should be a string, and stdout and stderr will be strings decoded according to locale encoding, or by "encoding" if set. Text mode is triggered by setting any of text, encoding, errors or universal_newlines. The other arguments are the same as for the Popen constructor. """ if input is not None: if kwargs.get('stdin') is not None: raise ValueError('stdin and input arguments may not both be used.') kwargs['stdin'] = PIPE if capture_output: if kwargs.get('stdout') is not None or kwargs.get('stderr') is not None: raise ValueError('stdout and stderr arguments may not be used ' 'with capture_output.') kwargs['stdout'] = PIPE kwargs['stderr'] = PIPE with Popen(*popenargs, **kwargs) as process: try: stdout, stderr = process.communicate(input, timeout=timeout) except TimeoutExpired as exc: process.kill() if _mswindows: # Windows accumulates the output in a single blocking # read() call run on child threads, with the timeout # being done in a join() on those threads. communicate() # _after_ kill() is required to collect that and add it # to the exception. exc.stdout, exc.stderr = process.communicate() else: # POSIX _communicate already populated the output so # far into the TimeoutExpired exception. process.wait() raise except: # Including KeyboardInterrupt, communicate handled that. process.kill() # We don't call process.wait() as .__exit__ does that for us. raise retcode = process.poll() if check and retcode: > raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) E subprocess.CalledProcessError: Command '['oc', 'apply', '-f', '-']' returned non-zero exit status 1. /usr/lib64/python3.9/subprocess.py:528: CalledProcessError