self = <test_namespace_scoping.TestMaaSControllerWatchNamespace object at 0x7f85ec8606d0> def test_authpolicy_and_subscription_in_maas_subscription_namespace(self): """MaaSAuthPolicy and MaaSSubscription in MaaS subscription namespace should be reconciled and should appear in the AuthPolicy and TRLP annotations for the model.""" ns = _ns() try: _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSAuthPolicy", "metadata": {"name": "e2e-watched-auth", "namespace": ns}, "spec": { "modelRefs": [{"name": MODEL_REF, "namespace": MODEL_NAMESPACE}], "subjects": {"groups": [{"name": "system:authenticated"}]}, }, }) _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSSubscription", "metadata": {"name": "e2e-watched-sub", "namespace": ns}, "spec": { "owner": {"groups": [{"name": "system:authenticated"}]}, "modelRefs": [{"name": MODEL_REF, "namespace": MODEL_NAMESPACE, "tokenRateLimits": [{"limit": 1, "window": "1m"}]}], }, }) _wait_reconcile(15) auth_name = f"maas-auth-{MODEL_REF}" auth_policies = [x.strip() for x in (_get_cr_annotation("authpolicy", auth_name, MODEL_NAMESPACE, "maas.opendatahub.io/auth-policies") or "").split(",") if x.strip()] > assert "e2e-watched-auth" in auth_policies, ( f"AuthPolicy {auth_name} not found or MaaSAuthPolicy e2e-watched-auth not reconciled" ) E AssertionError: AuthPolicy maas-auth-facebook-opt-125m-simulated not found or MaaSAuthPolicy e2e-watched-auth not reconciled E assert 'e2e-watched-auth' in ['models-as-a-service/e2e-watched-auth', 'models-as-a-service/simulator-access'] test/e2e/tests/test_namespace_scoping.py:277: AssertionErrorself = <test_namespace_scoping.TestModelRef object at 0x7f85ec8603a0> def test_auth_policy_model_ref(self): """ Create a new namespace and two MaaSModelRefs: MODEL_REF in the new namespace, and another name in MODEL_NAMESPACE. Create MaaSAuthPolicy referencing MODEL_REF in MODEL_NAMESPACE. Verify it is reconciled into MODEL_REF's AuthPolicy in MODEL_NAMESPACE, and the other two models' AuthPolicies do not exist. """ other_ns = f"e2e-modelref-{uuid.uuid4().hex[:6]}" other_model_ref = f"e2e-other-model-{uuid.uuid4().hex[:6]}" policy_name = f"e2e-auth-ref-{uuid.uuid4().hex[:6]}" ns = _ns() _create_namespace(other_ns) try: # Create ExternalModel CRs in both namespaces _create_external_model("test-backend", other_ns) _create_external_model("test-backend", MODEL_NAMESPACE) # MaaSModelRef in the new namespace with same name as MODEL_REF _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSModelRef", "metadata": {"name": MODEL_REF, "namespace": other_ns}, "spec": {"modelRef": {"kind": "ExternalModel", "name": "test-backend"}}, }) # MaaSModelRef in MODEL_NAMESPACE with a different name (not referenced by policy) _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSModelRef", "metadata": {"name": other_model_ref, "namespace": MODEL_NAMESPACE}, "spec": {"modelRef": {"kind": "ExternalModel", "name": "test-backend"}}, }) # MaaSAuthPolicy referencing only MODEL_REF in MODEL_NAMESPACE _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSAuthPolicy", "metadata": {"name": policy_name, "namespace": ns}, "spec": { "modelRefs": [{"name": MODEL_REF, "namespace": MODEL_NAMESPACE}], "subjects": {"groups": [{"name": "system:authenticated"}]}, }, }) _wait_reconcile(15) auth_name = f"maas-auth-{MODEL_REF}" auth_name_other = f"maas-auth-{other_model_ref}" # Verify: policy is reconciled into MODEL_REF's AuthPolicy in MODEL_NAMESPACE auth_policies_reconciled = [x.strip() for x in (_get_cr_annotation("authpolicy", auth_name, MODEL_NAMESPACE, "maas.opendatahub.io/auth-policies") or "").split(",") if x.strip()] > assert policy_name in auth_policies_reconciled, ( f"MaaSAuthPolicy {policy_name} should be in AuthPolicy {auth_name} in {MODEL_NAMESPACE}, got: {auth_policies_reconciled}" ) E AssertionError: MaaSAuthPolicy e2e-auth-ref-a67a35 should be in AuthPolicy maas-auth-facebook-opt-125m-simulated in llm, got: ['models-as-a-service/e2e-auth-ref-a67a35', 'models-as-a-service/simulator-access'] E assert 'e2e-auth-ref-a67a35' in ['models-as-a-service/e2e-auth-ref-a67a35', 'models-as-a-service/simulator-access'] test/e2e/tests/test_namespace_scoping.py:389: AssertionErrorself = <test_namespace_scoping.TestModelRef object at 0x7f85ec8600a0> def test_subscription_model_ref(self): """ Create a new namespace and two MaaSModelRefs: MODEL_REF in the new namespace, and another name in MODEL_NAMESPACE. Create MaaSSubscription referencing MODEL_REF in MODEL_NAMESPACE. Verify it is reconciled into MODEL_REF's TRLP in MODEL_NAMESPACE, and the other two models' TRLPs do not exist. """ other_ns = f"e2e-modelref-{uuid.uuid4().hex[:6]}" other_model_ref = f"e2e-other-model-{uuid.uuid4().hex[:6]}" sub_name = f"e2e-sub-ref-{uuid.uuid4().hex[:6]}" ns = _ns() _create_namespace(other_ns) try: # Create ExternalModel CRs in both namespaces _create_external_model("test-backend", other_ns) _create_external_model("test-backend", MODEL_NAMESPACE) # MaaSModelRef in the new namespace with same name as MODEL_REF _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSModelRef", "metadata": {"name": MODEL_REF, "namespace": other_ns}, "spec": {"modelRef": {"kind": "ExternalModel", "name": "test-backend"}}, }) # MaaSModelRef in MODEL_NAMESPACE with a different name _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSModelRef", "metadata": {"name": other_model_ref, "namespace": MODEL_NAMESPACE}, "spec": {"modelRef": {"kind": "ExternalModel", "name": "test-backend"}}, }) # MaaSSubscription referencing only MODEL_REF in MODEL_NAMESPACE _apply_cr({ "apiVersion": "maas.opendatahub.io/v1alpha1", "kind": "MaaSSubscription", "metadata": {"name": sub_name, "namespace": ns}, "spec": { "owner": {"groups": [{"name": "system:authenticated"}]}, "modelRefs": [ {"name": MODEL_REF, "namespace": MODEL_NAMESPACE, "tokenRateLimits": [{"limit": 100, "window": "1m"}]}, ], }, }) _wait_reconcile(15) trlp_name = f"maas-trlp-{MODEL_REF}" trlp_name_other = f"maas-trlp-{other_model_ref}" # Verify: subscription is reconciled into MODEL_REF's TRLP in MODEL_NAMESPACE subscriptions_in_model_ns = [x.strip() for x in (_get_cr_annotation("tokenratelimitpolicy", trlp_name, MODEL_NAMESPACE, "maas.opendatahub.io/subscriptions") or "").split(",") if x.strip()] > assert sub_name in subscriptions_in_model_ns, ( f"MaaSSubscription {sub_name} should be in TRLP {trlp_name} in {MODEL_NAMESPACE}, got: {subscriptions_in_model_ns}" ) E AssertionError: MaaSSubscription e2e-sub-ref-ea134d should be in TRLP maas-trlp-facebook-opt-125m-simulated in llm, got: ['models-as-a-service/e2e-sub-ref-ea134d', 'models-as-a-service/simulator-subscription'] E assert 'e2e-sub-ref-ea134d' in ['models-as-a-service/e2e-sub-ref-ea134d', 'models-as-a-service/simulator-subscription'] test/e2e/tests/test_namespace_scoping.py:467: AssertionError/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_external_oidc.py:420: OIDC_USERNAME_NO_ACCESS and OIDC_PASSWORD_NO_ACCESS not configured