/workspace/source/test/e2e/tests/test_subscription.py:1040: gateway-only mode: per-model AuthPolicy is not createdself = <test_models_endpoint.TestModelsEndpoint object at 0x7f07053cc5b0> def test_central_models_endpoint_exempt_from_rate_limiting(self): """ Test that the central /v1/models endpoint remains accessible when token quota is exhausted. This test validates the end-to-end flow: 1. User exhausts token quota with inference requests (gets 429) 2. Central /v1/models endpoint is exempt at gateway level (gateway-default-deny TRLP) 3. Central endpoint calls model-specific /v1/models endpoints for discovery 4. Model-specific endpoints are also exempt (per-route TRLP fix) 5. Central endpoint successfully aggregates and returns model list This ensures the entire discovery chain works when quota is exhausted. Ref: https://issues.redhat.com/browse/RHOAIENG-46770 """ # Use unconfigured model to isolate this test model_ref = UNCONFIGURED_MODEL_REF model_path = UNCONFIGURED_MODEL_PATH # Create unique subscription and auth policy names auth_policy_name = "e2e-central-models-exempt-auth" subscription_name = "e2e-central-models-exempt-sub" # Very low limit for fast, deterministic test # With 3 token limit and max_tokens=1, we're guaranteed to exhaust quota within 5 requests # (each successful request consumes ≥1 token, so 5 requests > 3 token limit) token_limit = 3 window = "1m" max_tokens = 1 sa_name = f"e2e-central-models-exempt-sa-{uuid.uuid4().hex[:6]}" try: # 1. Create auth policy allowing system:authenticated log.info(f"Creating auth policy for {model_ref}") _create_test_auth_policy( name=auth_policy_name, model_refs=[model_ref], groups=["system:authenticated"] ) _wait_reconcile() _wait_for_maas_auth_policy_phase(auth_policy_name, timeout=90) # 2. Create subscription with low token limit log.info(f"Creating subscription with {token_limit} token limit") _create_test_subscription( name=subscription_name, model_refs=[model_ref], groups=["system:authenticated"], token_limit=token_limit, window=window ) _wait_reconcile() _wait_for_maas_subscription_phase(subscription_name, timeout=90) # Wait for TRLP to be created and enforced _wait_for_token_rate_limit_policy(model_ref, model_namespace=MODEL_NAMESPACE, timeout=90) # 3. Create API key for this subscription. # Use SA token to avoid environment-specific user-token 401s. oc_token = _create_sa_token(sa_name, namespace=_ns()) > api_key = _create_api_key( oc_token, name=f"e2e-central-exempt-{uuid.uuid4().hex[:8]}", subscription=subscription_name, ) test/e2e/tests/test_models_endpoint.py:2172: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InlSSUQtOFZKNTE3SW1DblRiODlwcVFBYkRkeTcyVjUtZlRUX3VxcTRDOFEifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...dQ0FbMqLHaXywm_JI9eQPpS2CZqG6LTGM6cJ7GIunW1M1HKU00JJXZurCaUrb2RDm057QyZS7wKRu5Rx8bSKmtW82nUgxIrhyQKMY_XsdJHul8jz9ZAddA' name = 'e2e-central-exempt-e24828ab' subscription = 'e2e-central-models-exempt-sub' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 500 Internal Server Error. test/e2e/tests/test_helper.py:247: RuntimeError/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_external_oidc.py:426: OIDC_USERNAME_NO_ACCESS and OIDC_PASSWORD_NO_ACCESS not configured