/workspace/source/test/e2e/tests/test_api_keys.py:930: CronJob maas-api-key-cleanup not found in opendatahub: Error from server (NotFound): cronjobs.batch "maas-api-key-cleanup" not found/workspace/source/test/e2e/tests/test_api_keys.py:977: NetworkPolicy maas-api-cleanup-restrict not found in opendatahub: Error from server (NotFound): networkpolicies.networking.k8s.io "maas-api-cleanup-restrict" not found/workspace/source/test/e2e/tests/test_api_keys.py:1096: Cannot find maas-api pod in opendatahub: error: error executing jsonpath "{.items[0].metadata.name}": Error executing template: array index out of bounds: index 0, length 0. Printing more information for debugging the template: template was: {.items[0].metadata.name} object given to jsonpath engine was: map[string]interface {}{"apiVersion":"v1", "items":[]interface {}{}, "kind":"List", "metadata":map[string]interface {}{"resourceVersion":""}}self = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7f85d9e8b070> api_keys_base_url = 'https://maas.apps.8603da6d-0186-4073-9563-481d7ae742a7.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImV3QlVJVjQyWXY5U0dvSVlqYml5ZElXejhpaUFzdkJsOC1iUnBHNGlYVGMifQ.e...sOprI6m2x9Gd8BO-pdPEZqETcY3kNT-GxKzPdzzA-JjYL_432ZfwaZlBEgQT9C5Po1zG-sD0HMBQvDINw', 'Content-Type': 'application/json'} def test_search_filters_by_subscription(self, api_keys_base_url: str, headers: dict): """Search with subscription filter returns only keys bound to that subscription.""" sub_a = f"e2e-filter-sub-a-{os.urandom(4).hex()}" sub_b = f"e2e-filter-sub-b-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-filter-sa-{os.urandom(4).hex()}" key_ids_a = [] key_ids_b = [] try: # Create one SA authorized for both subscriptions so that # exclusion in search results is attributable to the subscription # filter, not user-scoping. oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} > _create_test_auth_policy(f"{sub_a}-auth", MODEL_REF, users=[sa_user]) test/e2e/tests/test_api_keys.py:1505: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/tests/test_helper.py:511: in _create_test_auth_policy _apply_cr({ test/e2e/tests/test_helper.py:279: in _apply_cr subprocess.run(["oc", "apply", "-f", "-"], input=json.dumps(cr_dict), capture_output=True, text=True, check=True) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ input = '{"apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSAuthPolicy", "metadata": {"name": "e2e-filter-sub-a-77bc2...ed", "namespace": "llm"}], "subjects": {"users": ["system:serviceaccount:llm:e2e-filter-sa-d67b9ff6"], "groups": []}}}' capture_output = True, timeout = None, check = True popenargs = (['oc', 'apply', '-f', '-'],) kwargs = {'stderr': -1, 'stdin': -1, 'stdout': -1, 'text': True} process = <Popen: returncode: 1 args: ['oc', 'apply', '-f', '-']>, stdout = '' stderr = 'Error from server (InternalError): error when creating "STDIN": Internal error occurred: failed calling webhook "vmaa...atahub-io-v1alpha1-maasauthpolicy?timeout=10s": no endpoints available for service "maas-controller-webhook-service"\n' retcode = 1 def run(*popenargs, input=None, capture_output=False, timeout=None, check=False, **kwargs): """Run command with arguments and return a CompletedProcess instance. The returned instance will have attributes args, returncode, stdout and stderr. By default, stdout and stderr are not captured, and those attributes will be None. Pass stdout=PIPE and/or stderr=PIPE in order to capture them. If check is True and the exit code was non-zero, it raises a CalledProcessError. The CalledProcessError object will have the return code in the returncode attribute, and output & stderr attributes if those streams were captured. If timeout is given, and the process takes too long, a TimeoutExpired exception will be raised. There is an optional argument "input", allowing you to pass bytes or a string to the subprocess's stdin. If you use this argument you may not also use the Popen constructor's "stdin" argument, as it will be used internally. By default, all communication is in bytes, and therefore any "input" should be bytes, and the stdout and stderr will be bytes. If in text mode, any "input" should be a string, and stdout and stderr will be strings decoded according to locale encoding, or by "encoding" if set. Text mode is triggered by setting any of text, encoding, errors or universal_newlines. The other arguments are the same as for the Popen constructor. """ if input is not None: if kwargs.get('stdin') is not None: raise ValueError('stdin and input arguments may not both be used.') kwargs['stdin'] = PIPE if capture_output: if kwargs.get('stdout') is not None or kwargs.get('stderr') is not None: raise ValueError('stdout and stderr arguments may not be used ' 'with capture_output.') kwargs['stdout'] = PIPE kwargs['stderr'] = PIPE with Popen(*popenargs, **kwargs) as process: try: stdout, stderr = process.communicate(input, timeout=timeout) except TimeoutExpired as exc: process.kill() if _mswindows: # Windows accumulates the output in a single blocking # read() call run on child threads, with the timeout # being done in a join() on those threads. communicate() # _after_ kill() is required to collect that and add it # to the exception. exc.stdout, exc.stderr = process.communicate() else: # POSIX _communicate already populated the output so # far into the TimeoutExpired exception. process.wait() raise except: # Including KeyboardInterrupt, communicate handled that. process.kill() # We don't call process.wait() as .__exit__ does that for us. raise retcode = process.poll() if check and retcode: > raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) E subprocess.CalledProcessError: Command '['oc', 'apply', '-f', '-']' returned non-zero exit status 1. /usr/lib64/python3.9/subprocess.py:528: CalledProcessError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_negative_security.TestHeaderAbuse object at 0x7f85d99a3820> def test_special_characters_in_subscription_header(self): """Injection-style characters in X-MaaS-Subscription header. Ensures the platform returns a clean 403 (subscription not found) without leaking errors, stack traces, or SQL/NoSQL injection. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:411: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6ImV3QlVJVjQyWXY5U0dvSVlqYml5ZElXejhpaUFzdkJsOC1iUnBHNGlYVGMifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...JolFZ__3NCjWpl_YAF83VfboXhBiD9-k-rz3isOprI6m2x9Gd8BO-pdPEZqETcY3kNT-GxKzPdzzA-JjYL_432ZfwaZlBEgQT9C5Po1zG-sD0HMBQvDINw' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 500 {"error":"Exception thrown while generating token","exceptionCode":"AUTH_FAILURE","refId":"001"} test/e2e/tests/test_helper.py:247: RuntimeError/workspace/source/test/e2e/tests/test_subscription.py:1056: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:186: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:358: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_gateway_scoped_authpolicy.py:170: gateway-default-auth not present (maas-gateway-auth is active); scoping is validated by unit tests/workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:158: OIDC_TOKEN_TENANT_A and OIDC_TOKEN_TENANT_B are required for per-tenant OIDC validationtenant_auth_setup = {'policy': 'e2e-auth-iso-9b5d3a', 'subscription': 'e2e-auth-iso-9b5d3a', 'tenant_a': {'base_url': 'https://e2e-shared-...me': 'auth-test-model-67755c', 'model_namespace': 'ai-tenant-e2e-shared-b-67755c', 'name': 'e2e-shared-b-67755c', ...}} @pytest.fixture def tenant_api_keys(tenant_auth_setup): oc_token = _get_cluster_token() created = {} for key_name, tenant in (("a", tenant_auth_setup["tenant_a"]), ("b", tenant_auth_setup["tenant_b"])): response = create_api_key_at( tenant["base_url"], oc_token, f"e2e-auth-iso-{key_name}-{uuid.uuid4().hex[:6]}", subscription=tenant_auth_setup["subscription"], ) > assert response.status_code in (200, 201), ( f"create key for {tenant['name']} failed: {response_summary(response)}" ) E AssertionError: create key for e2e-shared-a-37e178 failed: status=400 body={"code":"invalid_subscription","error":"Unable to resolve a subscription for this API key"} E assert 400 in (200, 201) E + where 400 = <Response [400]>.status_code test/e2e/tests/test_tenant_auth_isolation.py:108: AssertionError/workspace/source/test/e2e/tests/test_external_oidc.py:238: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:249: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:263: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:276: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:289: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:321: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:365: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:381: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:391: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:414: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:422: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:427: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:440: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:487: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:523: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:588: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:619: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:645: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:689: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:713: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:766: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:814: EXTERNAL_OIDC is not true