self = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7fcdd6a5de50> api_keys_base_url = 'https://maas.apps.19e24e39-6041-4c02-bb5e-0b357f8366e2.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6InBXZ1hCeko1RVo0OEF5WHdsdjVPNHBUMEcxMnpxbXVEZGQxbkZKa1BseUUifQ.e...yZ679ykYEL6GXEBCm2cov83y3Mi7C2TUO6NwconTnTwn0WzNHcFgqSiMeHcXBkfc4pCEhwupHuaVAPpFw', 'Content-Type': 'application/json'} def test_search_without_subscription_returns_all(self, api_keys_base_url: str, headers: dict): """Search without subscription filter returns keys across all subscriptions.""" key_ids = [] try: # Create keys with explicit subscription binding for i in range(2): r = requests.post( api_keys_base_url, headers=headers, json={"name": f"e2e-nofilter-{i}", "subscription": SIMULATOR_SUBSCRIPTION}, timeout=TIMEOUT, verify=TLS_VERIFY, ) > assert r.status_code in (200, 201), f"Failed to create key: {r.text}" E AssertionError: Failed to create key: E assert 403 in (200, 201) E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:1591: AssertionError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_negative_security.TestHeaderSpoofing object at 0x7fcdd6b57370> def test_injected_identity_headers_ignored(self): """Client injects X-MaaS-Username/Group/Key-Id — platform ignores them. Validates that Authorino strips attacker-controlled identity headers. The request should succeed (200) using the real key-derived identity, proving the spoofed headers had no effect on authorization. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:83: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InBXZ1hCeko1RVo0OEF5WHdsdjVPNHBUMEcxMnpxbXVEZGQxbkZKa1BseUUifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...EODUoqfHqKBzj6oH7n5UxcXi0dLZm6_1D6WoryZ679ykYEL6GXEBCm2cov83y3Mi7C2TUO6NwconTnTwn0WzNHcFgqSiMeHcXBkfc4pCEhwupHuaVAPpFw' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:276: RuntimeErrorself = <test_negative_security.TestHeaderSpoofing object at 0x7fcdd6b57610> def test_duplicate_subscription_headers_ignored(self): """Client sends multiple X-MaaS-Subscription headers — API key binding wins. For API key requests, the subscription is fixed at mint time. Duplicate or conflicting X-MaaS-Subscription headers must not override the key-derived subscription. """ api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) # Use http.client to send genuinely duplicate X-MaaS-Subscription headers. # The requests library uses a dict for headers, so it cannot send two # headers with the same name — the second value overwrites the first. gateway = _gateway_url() parsed = urlparse(gateway) path = f"{MODEL_PATH}/v1/completions" body = json.dumps({"model": MODEL_NAME, "prompt": "Hello", "max_tokens": 3}) if parsed.scheme == "https": ctx = ssl.create_default_context() if not TLS_VERIFY: ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE conn = http.client.HTTPSConnection( parsed.hostname, parsed.port or 443, timeout=TIMEOUT, context=ctx, ) else: conn = http.client.HTTPConnection( parsed.hostname, parsed.port or 80, timeout=TIMEOUT, ) # Two separate X-MaaS-Subscription header lines headers = [ ("Authorization", f"Bearer {api_key}"), ("Content-Type", "application/json"), ("X-MaaS-Subscription", SIMULATOR_SUBSCRIPTION), ("X-MaaS-Subscription", "nonexistent-fake-sub"), ] conn.putrequest("POST", path) for key, value in headers: conn.putheader(key, value) conn.putheader("Content-Length", str(len(body))) conn.endheaders(body.encode()) resp = conn.getresponse() status = resp.status resp_body = resp.read().decode(errors="replace") conn.close() # API key binding wins — request succeeds with key-derived subscription. log.info("Duplicate X-MaaS-Subscription headers -> %s", status) > assert status == 200, ( f"Expected 200 (API key subscription binding wins over duplicate headers), " f"got {status}: {resp_body[:500]}" ) E AssertionError: Expected 200 (API key subscription binding wins over duplicate headers), got 403: E assert 403 == 200 test/e2e/tests/test_negative_security.py:152: AssertionError/workspace/source/test/e2e/tests/test_subscription.py:1056: gateway-only mode: per-model AuthPolicy is not createdself = <test_subscription.TestDegradedSubscriptionFiltering object at 0x7fcdd66257c0> def test_failed_subscription_blocks_inference(self): """ Test: Failed subscription blocks inference via OPA rule. Setup: 1. Create subscription with valid model (starts Active) 2. Create API key 3. Manually patch subscription to Failed phase 4. Verify inference is rejected by OPA (403) Note: We use manual patching because naturally creating a Failed subscription requires only invalid models, which don't have routes (404 before OPA runs). """ ns = _ns() subscription_name = "e2e-failed-sub-inf" auth_name = "e2e-failed-sub-inf-auth" sa_name = "e2e-failed-sub-inf-sa" try: oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) # Create auth policy for valid model _create_test_auth_policy(auth_name, MODEL_REF, users=[sa_user]) # Create subscription with valid model (will be Active) _create_test_subscription(subscription_name, MODEL_REF, users=[sa_user]) _wait_reconcile(seconds=10) # Verify it starts as Active cr = _get_cr("maassubscription", subscription_name, namespace=ns) phase = cr.get("status", {}).get("phase") log.info(f"Initial phase: {phase}") assert phase == "Active", f"Expected Active initially, got {phase}" # Create API key while Active api_key = _create_api_key( oc_token, name="failed-sub-test", subscription=subscription_name ) # Verify inference works while Active log.info("Testing inference while Active...") r = _inference(api_key, path=MODEL_PATH, model_name=MODEL_NAME) assert r.status_code == 200, f"Expected 200 while Active, got {r.status_code}: {r.text[:200]}" log.info("✅ Inference works with Active subscription") # Manually patch subscription to Failed phase import subprocess import json from datetime import datetime log.info("Manually patching subscription to Failed phase...") patch_data = { "status": { "phase": "Failed", "conditions": [ { "type": "Ready", "status": "False", "reason": "Failed", "message": "Subscription failed", "lastTransitionTime": datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ") } ], "modelRefStatuses": [ { "name": MODEL_REF, "namespace": MODEL_NAMESPACE, "ready": False, "reason": "ReconcileFailed", "message": "Model failed" } ] } } cmd = [ "kubectl", "patch", "maassubscription", subscription_name, "-n", ns, "--type=merge", "--subresource=status", "-p", json.dumps(patch_data) ] result = subprocess.run(cmd, capture_output=True, text=True) assert result.returncode == 0, f"Failed to patch to Failed phase: {result.stderr}" # Verify phase is Failed cr = _get_cr("maassubscription", subscription_name, namespace=ns) phase = cr.get("status", {}).get("phase") > assert phase == "Failed", f"Expected Failed phase after patch, got {phase}" E AssertionError: Expected Failed phase after patch, got Active E assert 'Active' == 'Failed' E E - Failed E + Active test/e2e/tests/test_subscription.py:2357: AssertionErrorself = <test_tenant.TestTenantLifecycle object at 0x7fcdd667f550> def test_tenant_ready_and_phase_healthy(self): st = _wait_tenant_ready() > assert st is not None, "Tenant Ready did not become True in time." E AssertionError: Tenant Ready did not become True in time. E assert None is not None test/e2e/tests/test_tenant.py:115: AssertionError