self = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7f314a6395e0> api_keys_base_url = 'https://maas.apps.5ba43653-1a6c-45e9-912a-095e14a45353.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImhiWHBVNWFINmJWQ25OVENFOG8zQlh6Uy11UjNiUXpVUUM3QnM3ZjNnejAifQ.e...-xsXUQEdvHHOV2wvDRClv1jx56-5rag4KNXIDkdV1cBcP4gr_L4WEIruMllVLOpawfrU7Yms-TahNLpog', 'Content-Type': 'application/json'} def test_search_without_subscription_returns_all(self, api_keys_base_url: str, headers: dict): """Search without subscription filter returns keys across all subscriptions.""" key_ids = [] try: # Create keys with explicit subscription binding for i in range(2): r = requests.post( api_keys_base_url, headers=headers, json={"name": f"e2e-nofilter-{i}", "subscription": SIMULATOR_SUBSCRIPTION}, timeout=TIMEOUT, verify=TLS_VERIFY, ) > assert r.status_code in (200, 201), f"Failed to create key: {r.text}" E AssertionError: Failed to create key: E assert 403 in (200, 201) E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:1576: AssertionError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_negative_security.TestHeaderSpoofing object at 0x7f314a676e20> def test_injected_identity_headers_ignored(self): """Client injects X-MaaS-Username/Group/Key-Id — platform ignores them. Validates that Authorino strips attacker-controlled identity headers. The request should succeed (200) using the real key-derived identity, proving the spoofed headers had no effect on authorization. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:83: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6ImhiWHBVNWFINmJWQ25OVENFOG8zQlh6Uy11UjNiUXpVUUM3QnM3ZjNnejAifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...DkTgGAc65LmTfMxgqTBUjJJk1foLkNHVU2eli-xsXUQEdvHHOV2wvDRClv1jx56-5rag4KNXIDkdV1cBcP4gr_L4WEIruMllVLOpawfrU7Yms-TahNLpog' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:276: RuntimeErrorself = <test_negative_security.TestHeaderSpoofing object at 0x7f314a676e50> def test_duplicate_subscription_headers_ignored(self): """Client sends multiple X-MaaS-Subscription headers — API key binding wins. For API key requests, the subscription is fixed at mint time. Duplicate or conflicting X-MaaS-Subscription headers must not override the key-derived subscription. """ api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) # Use http.client to send genuinely duplicate X-MaaS-Subscription headers. # The requests library uses a dict for headers, so it cannot send two # headers with the same name — the second value overwrites the first. gateway = _gateway_url() parsed = urlparse(gateway) path = f"{MODEL_PATH}/v1/completions" body = json.dumps({"model": MODEL_NAME, "prompt": "Hello", "max_tokens": 3}) if parsed.scheme == "https": ctx = ssl.create_default_context() if not TLS_VERIFY: ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE conn = http.client.HTTPSConnection( parsed.hostname, parsed.port or 443, timeout=TIMEOUT, context=ctx, ) else: conn = http.client.HTTPConnection( parsed.hostname, parsed.port or 80, timeout=TIMEOUT, ) # Two separate X-MaaS-Subscription header lines headers = [ ("Authorization", f"Bearer {api_key}"), ("Content-Type", "application/json"), ("X-MaaS-Subscription", SIMULATOR_SUBSCRIPTION), ("X-MaaS-Subscription", "nonexistent-fake-sub"), ] conn.putrequest("POST", path) for key, value in headers: conn.putheader(key, value) conn.putheader("Content-Length", str(len(body))) conn.endheaders(body.encode()) resp = conn.getresponse() status = resp.status resp_body = resp.read().decode(errors="replace") conn.close() # API key binding wins — request succeeds with key-derived subscription. log.info("Duplicate X-MaaS-Subscription headers -> %s", status) > assert status == 200, ( f"Expected 200 (API key subscription binding wins over duplicate headers), " f"got {status}: {resp_body[:500]}" ) E AssertionError: Expected 200 (API key subscription binding wins over duplicate headers), got 403: E assert 403 == 200 test/e2e/tests/test_negative_security.py:152: AssertionError/workspace/source/test/e2e/tests/test_subscription.py:1056: gateway-only mode: per-model AuthPolicy is not createdself = <test_subscription.TestE2ESubscriptionFlow object at 0x7f314a6c9f10> def test_e2e_group_based_subscription_but_no_auth_gets_403(self): """ E2E test: Group-based subscription, but user's group not in auth policy (failure case). """ ns = _ns() auth_policy_name = "e2e-test-group-no-auth" subscription_name = "e2e-test-group-sub-only" sa_name = "e2e-sa-group-sub-only" # Use namespace-specific group for subscription test_group = f"system:serviceaccounts:{ns}" try: # Create service account and get OC token for maas-api oc_token = _create_sa_token(sa_name, namespace=ns) # Create auth policy with a group the SA is NOT in _create_test_auth_policy(auth_policy_name, PREMIUM_MODEL_REF, groups=["nonexistent-group-xyz"]) # Create subscription with group the SA IS in _create_test_subscription(subscription_name, PREMIUM_MODEL_REF, groups=[test_group]) > _wait_for_maas_auth_policy_phase(auth_policy_name, namespace=ns, timeout=120, require_auth_policies=False) test/e2e/tests/test_subscription.py:1712: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ name = 'e2e-test-group-no-auth', expected_phase = 'Active' namespace = 'models-as-a-service', timeout = 120, require_auth_policies = False require_enforced = True def _wait_for_maas_auth_policy_phase(name, expected_phase="Active", namespace=None, timeout=60, require_auth_policies=False, require_enforced=True): """Wait for MaaSAuthPolicy to reach a specific phase. Args: name: Name of the MaaSAuthPolicy expected_phase: Phase to wait for (default: "Active") namespace: Namespace (defaults to _ns()) timeout: Maximum wait time in seconds (default: 60) require_auth_policies: If True, requires authPolicies to be populated (default: False). Keep False for gateway-only AuthPolicy reconciliation. require_enforced: If True, requires all authPolicies to have ready=True (default: True). Only applies when require_auth_policies is True. Returns: The auth policy CR dict when the expected phase is reached Raises: TimeoutError: If MaaSAuthPolicy doesn't reach expected phase within timeout """ namespace = namespace or _ns() deadline = time.time() + timeout log.info(f"Waiting for MaaSAuthPolicy {name} to reach phase '{expected_phase}' (timeout: {timeout}s)...") while time.time() < deadline: cr = _get_cr("maasauthpolicy", name, namespace) if cr: status = cr.get("status", {}) phase = status.get("phase") auth_policies = status.get("authPolicies", []) if phase == expected_phase: # No auth policies required — phase match is sufficient if not require_auth_policies: log.info(f"MaaSAuthPolicy {name} reached phase '{expected_phase}'") return cr # Auth policies required — check they exist if len(auth_policies) > 0: if require_enforced: all_enforced = all( ap.get("ready") is True for ap in auth_policies ) if all_enforced: log.info(f"MaaSAuthPolicy {name} reached phase '{expected_phase}' and all enforced") return cr else: log.info(f"MaaSAuthPolicy {name} reached phase '{expected_phase}' with {len(auth_policies)} auth policy status(es)") return cr log.debug(f"MaaSAuthPolicy {name}: phase={phase}, authPolicies={len(auth_policies)}") time.sleep(2) # Timeout - return current state for debugging cr = _get_cr("maasauthpolicy", name, namespace) status = cr.get("status", {}) if cr else {} > raise TimeoutError( f"MaaSAuthPolicy {name} did not reach phase '{expected_phase}' within {timeout}s " f"(current: phase={status.get('phase')}, authPolicies={len(status.get('authPolicies', []))})" ) E TimeoutError: MaaSAuthPolicy e2e-test-group-no-auth did not reach phase 'Active' within 120s (current: phase=Failed, authPolicies=0) test/e2e/tests/test_helper.py:903: TimeoutError/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:186: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:353: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_gateway_scoped_authpolicy.py:170: gateway-default-auth not present (maas-gateway-auth is active); scoping is validated by unit tests/workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:209: Per-tenant OIDC tokens unavailable — set OIDC_TOKEN_URL (tenant-a) and OIDC_TOKEN_URL_TENANT_B (tenant-b), or OIDC_TOKEN_TENANT_A / OIDC_TOKEN_TENANT_B/workspace/source/test/e2e/tests/test_tenant_discovery.py:134: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery.py:210: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:131: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:179: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:266: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_external_oidc.py:249: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:260: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:274: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:287: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:300: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:332: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:376: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:392: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:402: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:425: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:433: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:438: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:451: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:498: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:534: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:599: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:630: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:656: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:687: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:747: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:771: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:824: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:872: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:926: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:978: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1014: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1068: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1107: EXTERNAL_OIDC not enabled