self = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7f73654faaf0> api_keys_base_url = 'https://maas.apps.4e817011-1626-4cef-8abf-8f4b68fcf6e4.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ikt2OE9pYnd6cTZDSEpyR1pkaFpZZWRRVGtlRzlvQmMtdkcyWkFVR090aEEifQ.e...DHpHKUxO1aa4dqeJvpUqbQDMjxGuoFJbhjUG6IYP-a8xVwjBPPXD86ORZgs4PjYfr7N3oWudJ-AYNp0Lg', 'Content-Type': 'application/json'} def test_search_filters_by_subscription(self, api_keys_base_url: str, headers: dict): """Search with subscription filter returns only keys bound to that subscription.""" sub_a = f"e2e-filter-sub-a-{os.urandom(4).hex()}" sub_b = f"e2e-filter-sub-b-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-filter-sa-{os.urandom(4).hex()}" key_ids_a = [] key_ids_b = [] try: # Create one SA authorized for both subscriptions so that # exclusion in search results is attributable to the subscription # filter, not user-scoping. oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} _create_test_auth_policy(f"{sub_a}-auth", MODEL_REF, users=[sa_user]) _create_test_subscription(sub_a, MODEL_REF, users=[sa_user]) _wait_for_maas_subscription_phase(sub_a, namespace=ns) _create_test_auth_policy(f"{sub_b}-auth", MODEL_REF, users=[sa_user]) _create_test_subscription(sub_b, MODEL_REF, users=[sa_user]) _wait_for_maas_subscription_phase(sub_b, namespace=ns) # Create 2 keys bound to sub_a for i in range(2): r = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa_headers, json={"name": f"e2e-filter-a-{i}", "subscription": sub_a}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r.status_code in (200, 201), f"Failed to create key for {sub_a}: {r.text}" key_ids_a.append(r.json()["id"]) # Create 1 key bound to sub_b r_b = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa_headers, json={"name": "e2e-filter-b-0", "subscription": sub_b}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r_b.status_code in (200, 201), f"Failed to create key for {sub_b}: {r_b.text}" key_ids_b.append(r_b.json()["id"]) # Search with subscription filter for sub_b — same principal r_search = requests.post( f"{api_keys_base_url}/search", headers=sa_headers, json={ "filters": {"status": ["active"], "subscription": sub_b}, "pagination": {"limit": 50, "offset": 0}, }, timeout=TIMEOUT, verify=TLS_VERIFY, ) > assert r_search.status_code == 200, f"Search failed: {r_search.status_code} {r_search.text}" E AssertionError: Search failed: 500 {"error":"Exception thrown while generating token","exceptionCode":"AUTH_FAILURE","refId":"001"} E assert 500 == 200 E + where 500 = <Response [500]>.status_code test/e2e/tests/test_api_keys.py:1534: AssertionErrorself = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7f73654fad90> api_keys_base_url = 'https://maas.apps.4e817011-1626-4cef-8abf-8f4b68fcf6e4.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ikt2OE9pYnd6cTZDSEpyR1pkaFpZZWRRVGtlRzlvQmMtdkcyWkFVR090aEEifQ.e...DHpHKUxO1aa4dqeJvpUqbQDMjxGuoFJbhjUG6IYP-a8xVwjBPPXD86ORZgs4PjYfr7N3oWudJ-AYNp0Lg', 'Content-Type': 'application/json'} def test_search_without_subscription_returns_all(self, api_keys_base_url: str, headers: dict): """Search without subscription filter returns keys across all subscriptions.""" key_ids = [] try: # Create keys with explicit subscription binding for i in range(2): r = requests.post( api_keys_base_url, headers=headers, json={"name": f"e2e-nofilter-{i}", "subscription": SIMULATOR_SUBSCRIPTION}, timeout=TIMEOUT, verify=TLS_VERIFY, ) > assert r.status_code in (200, 201), f"Failed to create key: {r.text}" E AssertionError: Failed to create key: E assert 403 in (200, 201) E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:1576: AssertionError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_negative_security.TestHeaderSpoofing object at 0x7f7365027ee0> def test_injected_identity_headers_ignored(self): """Client injects X-MaaS-Username/Group/Key-Id — platform ignores them. Validates that Authorino strips attacker-controlled identity headers. The request should succeed (200) using the real key-derived identity, proving the spoofed headers had no effect on authorization. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:83: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6Ikt2OE9pYnd6cTZDSEpyR1pkaFpZZWRRVGtlRzlvQmMtdkcyWkFVR090aEEifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...9m4uDSFlS3hJkdaHqPal3eBwVuSC6W4QMxpy3DHpHKUxO1aa4dqeJvpUqbQDMjxGuoFJbhjUG6IYP-a8xVwjBPPXD86ORZgs4PjYfr7N3oWudJ-AYNp0Lg' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:276: RuntimeErrorself = <test_negative_security.TestHeaderSpoofing object at 0x7f7365027d30> def test_duplicate_subscription_headers_ignored(self): """Client sends multiple X-MaaS-Subscription headers — API key binding wins. For API key requests, the subscription is fixed at mint time. Duplicate or conflicting X-MaaS-Subscription headers must not override the key-derived subscription. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:110: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6Ikt2OE9pYnd6cTZDSEpyR1pkaFpZZWRRVGtlRzlvQmMtdkcyWkFVR090aEEifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...9m4uDSFlS3hJkdaHqPal3eBwVuSC6W4QMxpy3DHpHKUxO1aa4dqeJvpUqbQDMjxGuoFJbhjUG6IYP-a8xVwjBPPXD86ORZgs4PjYfr7N3oWudJ-AYNp0Lg' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:276: RuntimeError/workspace/source/test/e2e/tests/test_negative_security.py:200: Could not create short-lived key: 403/workspace/source/test/e2e/tests/test_subscription.py:1056: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:186: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:353: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=trueself = <test_gateway_scoped_authpolicy.TestGatewayAuthPolicyStructure object at 0x7f736553a730> def test_target_ref_points_to_gateway(self): """6.1: maas-gateway-auth targetRef must be Gateway, not HTTPRoute.""" ap = get_gateway_authpolicy() assert ap is not None, ( f"{GATEWAY_AUTH_POLICY_NAME} must exist in {GATEWAY_NAMESPACE} after prow fixtures reconcile" ) target = get_gateway_authpolicy_target_ref() assert target.get("kind") == "Gateway", f"expected Gateway targetRef, got {target!r}" assert target.get("group") == "gateway.networking.k8s.io" assert target.get("name") == DEFAULT_GATEWAY_NAME target_ns = target.get("namespace") or GATEWAY_NAMESPACE assert target_ns == GATEWAY_NAMESPACE, f"expected gateway namespace {GATEWAY_NAMESPACE}, got {target_ns!r}" conditions = (ap.get("status") or {}).get("conditions") or [] accepted = [c for c in conditions if c.get("type") == "Accepted"] > assert accepted and accepted[0].get("status") == "True", ( f"{GATEWAY_AUTH_POLICY_NAME} must be Accepted, got {conditions!r}" ) E AssertionError: maas-gateway-auth must be Accepted, got [] E assert ([]) test/e2e/tests/test_gateway_scoped_authpolicy.py:67: AssertionError