/workspace/source/test/e2e/tests/test_namespace_scoping.py:214: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:247: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:287: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:324: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:382: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:456: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_tenant_discovery.py:79: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery.py:155: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_external_oidc.py:252: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:263: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:277: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:290: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:303: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:335: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:379: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:395: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:405: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:428: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:436: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:441: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:454: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:501: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:537: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:602: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:633: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:659: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:690: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:750: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:786: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:824: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:872: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:961: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1013: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1049: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1103: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1142: EXTERNAL_OIDC not enabledself = <test_api_keys.TestAPIKeyBulkOperations object at 0x7f4bb69e8130> api_keys_base_url = 'https://maas.apps.71a08356-106f-429f-9f74-6d47d693c02d.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImpFQmVLOWZPVVBKdmxTaUVwM1VEd1RwRUJjX2xKdDBfZVFjRlpDa2dlZTAifQ.e...2LrQ2m_ehot1Ozy4jeRL-oLl_qtICzI5ju8m46mmr-RTNjm9yhOHVVMnW9ZMMEjOexg9C4xDIZPJ8zksg', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImpFQmVLOWZPVVBKdmxTaUVwM1VEd1RwRUJjX2xKdDBfZVFjRlpDa2dlZTAifQ.e...4zFNsOJWYpIYrZhaA8w1eLW7MnngJ3u-FJi5c14TVfQhD682vIHDn5MXseFk4a4iJf27-xhaiZsxTExPQ', 'Content-Type': 'application/json'} def test_bulk_revoke_combined_user_and_subscription(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Admin can revoke keys for a specific user within a specific subscription. Negative control: a second user's keys in the same subscription must remain active. """ if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") sub_name = f"e2e-combo-sub-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-combo-sa-{os.urandom(4).hex()}" sa2_name = f"e2e-combo-sa2-{os.urandom(4).hex()}" key_ids = [] key_ids_user2 = [] try: oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} oc_token2 = _create_sa_token(sa2_name, namespace=MODEL_NAMESPACE) sa_user2 = _sa_to_user(sa2_name, namespace=MODEL_NAMESPACE) sa2_headers = {"Authorization": f"Bearer {oc_token2}", "Content-Type": "application/json"} _create_test_auth_policy(f"{sub_name}-auth", MODEL_REF, users=[sa_user, sa_user2]) _create_test_subscription(sub_name, MODEL_REF, users=[sa_user, sa_user2]) _wait_for_maas_subscription_phase(sub_name, namespace=ns) for i in range(2): r = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa_headers, json={"name": f"combined-{i}", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r.status_code in (200, 201) key_ids.append(r.json()["id"]) r_u2 = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa2_headers, json={"name": "user2-key", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r_u2.status_code in (200, 201) key_ids_user2.append(r_u2.json()["id"]) r_get = requests.get(f"{api_keys_base_url}/{key_ids[0]}", headers=sa_headers, timeout=30, verify=TLS_VERIFY) username = r_get.json().get("username") or r_get.json().get("owner") > assert username E assert None test/e2e/tests/test_api_keys.py:549: AssertionErrorself = <test_api_keys.TestAPIKeyExpiration object at 0x7f4bb69f1760> api_keys_base_url = 'https://maas.apps.71a08356-106f-429f-9f74-6d47d693c02d.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImpFQmVLOWZPVVBKdmxTaUVwM1VEd1RwRUJjX2xKdDBfZVFjRlpDa2dlZTAifQ.e...2LrQ2m_ehot1Ozy4jeRL-oLl_qtICzI5ju8m46mmr-RTNjm9yhOHVVMnW9ZMMEjOexg9C4xDIZPJ8zksg', 'Content-Type': 'application/json'} max_expiration_days = 90 def test_create_key_exceeds_expiration_limit(self, api_keys_base_url: str, headers: dict, max_expiration_days: int): """Test: Creating API key with expiration exceeding the limit should fail.""" # Request expiration exceeding the limit (e.g., 2x the limit) exceeds_days = max_expiration_days * 2 expires_in_hours = exceeds_days * 24 r = requests.post( api_keys_base_url, headers=headers, json={ "name": "test-exceeds-limit", "description": f"Test key with {exceeds_days} days expiration (exceeds {max_expiration_days} day limit)", "expiresIn": f"{expires_in_hours}h" }, timeout=30, verify=TLS_VERIFY, ) > assert r.status_code == 400, f"Expected 400 for exceeding limit, got {r.status_code}: {r.text}" E AssertionError: Expected 400 for exceeding limit, got 401: {"error":{"message":"Request must be authenticated via the MaaS gateway","type":"authentication_error"}} E assert 401 == 400 E + where 401 = <Response [401]>.status_code test/e2e/tests/test_api_keys.py:680: AssertionError/workspace/source/test/e2e/tests/test_subscription.py:1069: gateway-only mode: per-model AuthPolicy is not createdself = <test_subscription_list_endpoints.TestListSubscriptions object at 0x7f4bb63021f0> def test_subscription_includes_model_refs(self): """Subscriptions include model_refs with name and rate limit info.""" sa_name = "e2e-list-subs-refs-sa" sa_ns = "default" maas_ns = _ns() subscription_name = "e2e-list-subs-refs-sub" try: sa_token = _create_sa_token(sa_name, namespace=sa_ns) sa_user = _sa_to_user(sa_name, namespace=sa_ns) _create_test_subscription( subscription_name, MODEL_REF, users=[sa_user], token_limit=500, window="1h", ) api_key = _create_api_key(sa_token, name=f"{sa_name}-key") _wait_for_maas_subscription_phase(subscription_name, namespace=maas_ns) url = f"{_maas_api_url()}/v1/subscriptions" r = requests.get( url, headers={"Authorization": f"Bearer {api_key}"}, timeout=TIMEOUT, verify=TLS_VERIFY, ) > assert r.status_code == 200 E assert 500 == 200 E + where 500 = <Response [500]>.status_code test/e2e/tests/test_subscription_list_endpoints.py:172: AssertionError/workspace/source/test/e2e/tests/test_gateway_scoped_authpolicy.py:212: gateway-default-auth not present (maas-gateway-auth is active); scoping is validated by unit tests/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:189: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:355: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:93: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:141: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:228: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:215: Per-tenant OIDC tokens unavailable — set OIDC_TOKEN_URL (tenant-a) and OIDC_TOKEN_URL_TENANT_B (tenant-b), or OIDC_TOKEN_TENANT_A / OIDC_TOKEN_TENANT_B