self = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7fd3c2de27f0> api_keys_base_url = 'https://maas.apps.e655d51f-ed59-47cb-ae04-4f3d71bcb5ed.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6InRRckY5bnRRMTE2azlZdk96Y1cxVXhiVTNMbGF4MnJZcjNoUHhqUVd3VVkifQ.e...kji2qUWxC_Qx5qEddD1oU3BklpxVxHfVHvXZ4KtFyYVqAwzhiVMf6UVgI8lBNsY5vVknQ9Sr2NDkoGr5w', 'Content-Type': 'application/json'} def test_search_without_subscription_returns_all(self, api_keys_base_url: str, headers: dict): """Search without subscription filter returns keys across all subscriptions.""" key_ids = [] try: # Create keys with explicit subscription binding for i in range(2): r = requests.post( api_keys_base_url, headers=headers, json={"name": f"e2e-nofilter-{i}", "subscription": SIMULATOR_SUBSCRIPTION}, timeout=TIMEOUT, verify=TLS_VERIFY, ) > assert r.status_code in (200, 201), f"Failed to create key: {r.text}" E AssertionError: Failed to create key: E assert 403 in (200, 201) E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:1576: AssertionError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_negative_security.TestHeaderSpoofing object at 0x7fd3c2f3b040> def test_injected_identity_headers_ignored(self): """Client injects X-MaaS-Username/Group/Key-Id — platform ignores them. Validates that Authorino strips attacker-controlled identity headers. The request should succeed (200) using the real key-derived identity, proving the spoofed headers had no effect on authorization. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:83: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InRRckY5bnRRMTE2azlZdk96Y1cxVXhiVTNMbGF4MnJZcjNoUHhqUVd3VVkifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...76HC9wZ5eW7KrO8sOMMaS5gxM4gClW1DeWV-Xkji2qUWxC_Qx5qEddD1oU3BklpxVxHfVHvXZ4KtFyYVqAwzhiVMf6UVgI8lBNsY5vVknQ9Sr2NDkoGr5w' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:290: RuntimeErrorself = <test_negative_security.TestHeaderSpoofing object at 0x7fd3c2f3b490> def test_duplicate_subscription_headers_ignored(self): """Client sends multiple X-MaaS-Subscription headers — API key binding wins. For API key requests, the subscription is fixed at mint time. Duplicate or conflicting X-MaaS-Subscription headers must not override the key-derived subscription. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:110: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InRRckY5bnRRMTE2azlZdk96Y1cxVXhiVTNMbGF4MnJZcjNoUHhqUVd3VVkifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...76HC9wZ5eW7KrO8sOMMaS5gxM4gClW1DeWV-Xkji2qUWxC_Qx5qEddD1oU3BklpxVxHfVHvXZ4KtFyYVqAwzhiVMf6UVgI8lBNsY5vVknQ9Sr2NDkoGr5w' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:290: RuntimeError/workspace/source/test/e2e/tests/test_negative_security.py:200: Could not create short-lived key: 403self = <test_negative_security.TestCrossModelAccess object at 0x7fd3c2f3b130> def test_key_cannot_access_model_outside_subscription(self): """Key for model A cannot infer on model B outside its subscription. Uses the pre-deployed unconfigured model (a model with no subscription granting access to it) to test cross-model access denial. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:234: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InRRckY5bnRRMTE2azlZdk96Y1cxVXhiVTNMbGF4MnJZcjNoUHhqUVd3VVkifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...76HC9wZ5eW7KrO8sOMMaS5gxM4gClW1DeWV-Xkji2qUWxC_Qx5qEddD1oU3BklpxVxHfVHvXZ4KtFyYVqAwzhiVMf6UVgI8lBNsY5vVknQ9Sr2NDkoGr5w' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:290: RuntimeError/workspace/source/test/e2e/tests/test_subscription.py:1054: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_external_models.py:219: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_external_models.py:224: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_external_models.py:229: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_external_models.py:240: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_external_models.py:253: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_external_models.py:269: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_external_models.py:298: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_external_models.py:351: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_external_models.py:394: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_external_models.py:409: External endpoint httpbin.org is not reachable (disconnected environment?)/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:186: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:353: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_gateway_scoped_authpolicy.py:170: gateway-default-auth not present (maas-gateway-auth is active); scoping is validated by unit tests/workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:209: Per-tenant OIDC tokens unavailable — set OIDC_TOKEN_URL (tenant-a) and OIDC_TOKEN_URL_TENANT_B (tenant-b), or OIDC_TOKEN_TENANT_A / OIDC_TOKEN_TENANT_Bself = <test_tenant_subscription_isolation.TestTenantSubscriptionIsolation object at 0x7fd3c2df1850> tenant_subscriptions = {'auth_policy': 'e2e-sub-iso-auth-77aa57', 'shared': 'e2e-shared-sub-77aa57', 'tenant_a': {'base_url': 'https://e2e-sh...est-model-08eb3e', 'model_namespace': 'ai-tenant-e2e-shared-a-08eb3e', ...}, 'tenant_a_only': 'e2e-a-only-77aa57', ...} def test_subscription_list_scoped_to_tenant(self, tenant_subscriptions): """4.1: Subscription list contains current tenant subscriptions and excludes the other tenant.""" tenant_a = tenant_subscriptions["tenant_a"] tenant_b = tenant_subscriptions["tenant_b"] > key_a = _create_key_for_subscription(tenant_a, tenant_subscriptions["tenant_a_only"]) test/e2e/tests/test_tenant_subscription_isolation.py:161: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ tenant = {'base_url': 'https://e2e-shared-a-08eb3e.apps.e655d51f-ed59-47cb-ae04-4f3d71bcb5ed.prod.konfluxeaas.com/maas-api', 'g... 'e2e-shared-a-08eb3e', 'model_name': 'sub-test-model-08eb3e', 'model_namespace': 'ai-tenant-e2e-shared-a-08eb3e', ...} subscription = 'e2e-a-only-77aa57' def _create_key_for_subscription(tenant: dict[str, str], subscription: str) -> str: response = create_api_key_at( tenant["base_url"], _get_cluster_token(), f"e2e-sub-iso-{uuid.uuid4().hex[:6]}", subscription=subscription, ) > assert response.status_code in (200, 201), ( f"create API key for {tenant['name']} failed: {response_summary(response)}" ) E AssertionError: create API key for e2e-shared-a-08eb3e failed: status=500 body={"error":"Exception thrown while generating token","exceptionCode":"AUTH_FAILURE","refId":"001"} E assert 500 in (200, 201) E + where 500 = <Response [500]>.status_code test/e2e/tests/test_tenant_subscription_isolation.py:148: AssertionError