self = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7f5913cc3f10> api_keys_base_url = 'https://maas.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IlFJMS1vZXVuQVBWQmRseTZtN1VFcTc3bEdiSXVsOENFVHZEaXhCNFY5ZkUifQ.e...Yxo5eutR8xM_HRB5VxC5KK9195aYwk8n8t1bePe8g_foxEaf65Uj2SsuVoGBaAWUm2KlpVNitXexKbudQ', 'Content-Type': 'application/json'} def test_search_filters_by_subscription(self, api_keys_base_url: str, headers: dict): """Search with subscription filter returns only keys bound to that subscription.""" sub_a = f"e2e-filter-sub-a-{os.urandom(4).hex()}" sub_b = f"e2e-filter-sub-b-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-filter-sa-{os.urandom(4).hex()}" key_ids_a = [] key_ids_b = [] try: # Create one SA authorized for both subscriptions so that # exclusion in search results is attributable to the subscription # filter, not user-scoping. oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} > _create_test_auth_policy(f"{sub_a}-auth", MODEL_REF, users=[sa_user]) test/e2e/tests/test_api_keys.py:1505: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/tests/test_helper.py:511: in _create_test_auth_policy _apply_cr({ test/e2e/tests/test_helper.py:279: in _apply_cr subprocess.run(["oc", "apply", "-f", "-"], input=json.dumps(cr_dict), capture_output=True, text=True, check=True) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ input = '{"apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSAuthPolicy", "metadata": {"name": "e2e-filter-sub-a-14dc7...ed", "namespace": "llm"}], "subjects": {"users": ["system:serviceaccount:llm:e2e-filter-sa-a3c22e59"], "groups": []}}}' capture_output = True, timeout = None, check = True popenargs = (['oc', 'apply', '-f', '-'],) kwargs = {'stderr': -1, 'stdin': -1, 'stdout': -1, 'text': True} process = <Popen: returncode: 1 args: ['oc', 'apply', '-f', '-']>, stdout = '' stderr = 'Error from server (InternalError): error when creating "STDIN": Internal error occurred: failed calling webhook "vmaa...atahub-io-v1alpha1-maasauthpolicy?timeout=10s": no endpoints available for service "maas-controller-webhook-service"\n' retcode = 1 def run(*popenargs, input=None, capture_output=False, timeout=None, check=False, **kwargs): """Run command with arguments and return a CompletedProcess instance. The returned instance will have attributes args, returncode, stdout and stderr. By default, stdout and stderr are not captured, and those attributes will be None. Pass stdout=PIPE and/or stderr=PIPE in order to capture them. If check is True and the exit code was non-zero, it raises a CalledProcessError. The CalledProcessError object will have the return code in the returncode attribute, and output & stderr attributes if those streams were captured. If timeout is given, and the process takes too long, a TimeoutExpired exception will be raised. There is an optional argument "input", allowing you to pass bytes or a string to the subprocess's stdin. If you use this argument you may not also use the Popen constructor's "stdin" argument, as it will be used internally. By default, all communication is in bytes, and therefore any "input" should be bytes, and the stdout and stderr will be bytes. If in text mode, any "input" should be a string, and stdout and stderr will be strings decoded according to locale encoding, or by "encoding" if set. Text mode is triggered by setting any of text, encoding, errors or universal_newlines. The other arguments are the same as for the Popen constructor. """ if input is not None: if kwargs.get('stdin') is not None: raise ValueError('stdin and input arguments may not both be used.') kwargs['stdin'] = PIPE if capture_output: if kwargs.get('stdout') is not None or kwargs.get('stderr') is not None: raise ValueError('stdout and stderr arguments may not be used ' 'with capture_output.') kwargs['stdout'] = PIPE kwargs['stderr'] = PIPE with Popen(*popenargs, **kwargs) as process: try: stdout, stderr = process.communicate(input, timeout=timeout) except TimeoutExpired as exc: process.kill() if _mswindows: # Windows accumulates the output in a single blocking # read() call run on child threads, with the timeout # being done in a join() on those threads. communicate() # _after_ kill() is required to collect that and add it # to the exception. exc.stdout, exc.stderr = process.communicate() else: # POSIX _communicate already populated the output so # far into the TimeoutExpired exception. process.wait() raise except: # Including KeyboardInterrupt, communicate handled that. process.kill() # We don't call process.wait() as .__exit__ does that for us. raise retcode = process.poll() if check and retcode: > raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) E subprocess.CalledProcessError: Command '['oc', 'apply', '-f', '-']' returned non-zero exit status 1. /usr/lib64/python3.9/subprocess.py:528: CalledProcessError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_subscription.py:1056: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:186: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:358: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_gateway_scoped_authpolicy.py:170: gateway-default-auth not present (maas-gateway-auth is active); scoping is validated by unit tests/workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:158: OIDC_TOKEN_TENANT_A and OIDC_TOKEN_TENANT_B are required for per-tenant OIDC validationmaas_api_internal_url = 'https://maas-api.opendatahub.svc.cluster.local:8443' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IlFJMS1vZXVuQVBWQmRseTZtN1VFcTc3bEdiSXVsOENFVHZEaXhCNFY5ZkUifQ.e...Yxo5eutR8xM_HRB5VxC5KK9195aYwk8n8t1bePe8g_foxEaf65Uj2SsuVoGBaAWUm2KlpVNitXexKbudQ', 'Content-Type': 'application/json'} gateway_host = 'maas.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com' def test_tenant_discovery_gateway_matches_deployment(maas_api_internal_url: str, headers: dict, gateway_host: str): """ Verify the gateway URL returned by /v1/tenants matches the actual gateway host being used by the E2E tests. This is a regression test for the original problem: Dashboard assuming cluster domain instead of using the actual gateway hostname. """ url = maas_api_internal_url + "/v1/tenants" namespace = os.environ.get("MAAS_NAMESPACE", "opendatahub") status_code, body = _kubectl_curl(url, headers=headers, namespace=namespace) assert status_code == 200, f"Expected 200, got {status_code}" data = json.loads(body) tenant = data["tenants"][0] gateway = tenant["gateway"] # The external URL should contain the gateway_host external_url = gateway["externalUrl"] log.info(f"[tenant] Gateway external URL: {external_url}") log.info(f"[tenant] E2E gateway host: {gateway_host}") # Extract hostname from externalUrl and compare with gateway_host > assert gateway_host in external_url, \ f"Gateway external URL '{external_url}' doesn't contain E2E gateway host '{gateway_host}'" E AssertionError: Gateway external URL 'https://maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local' doesn't contain E2E gateway host 'maas.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com' E assert 'maas.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com' in 'https://maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local' test/e2e/tests/test_tenant_discovery.py:206: AssertionError/workspace/source/test/e2e/tests/test_external_oidc.py:238: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:249: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:263: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:276: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:289: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:321: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:365: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:381: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:391: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:414: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:422: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:427: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:440: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:487: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:523: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:588: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:619: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:645: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:689: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:713: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:766: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:814: EXTERNAL_OIDC is not true