<?xml version="1.0" encoding="utf-8"?><testsuites name="pytest tests"><testsuite name="pytest" errors="0" failures="1" skipped="12" tests="85" time="1330.959" timestamp="2026-10-30T04:11:15.389348+00:00" hostname="maas-group-test-rh2wl-e2e-maas-openshift-pod"><testcase classname="tests.test_aitenant_lifecycle.TestAITenantRevocationOperandsSerial" name="test_aitenant_delete_completes_after_cleanup_serviceaccount_removed" time="37.501" /><testcase classname="tests.test_api_keys.TestAPIKeySubscriptionPhases" name="test_create_key_for_pending_subscription" time="34.448" /><testcase classname="tests.test_api_keys.TestAPIKeySubscriptionPhases" name="test_reject_key_for_unreconciled_subscription" time="16.228" /><testcase classname="tests.test_crd_watch_resilience.TestDynamicCRDWatch" name="test_controller_stable_without_kserve_crd" time="0.000"><skipped type="pytest.skip" message="requires a disposable cluster: deletes the cluster-scoped KServe CRD; set E2E_RUN_CRD_WATCH_RESILIENCE=true to opt in">/workspace/source/test/e2e/tests/test_crd_watch_resilience.py:224: requires a disposable cluster: deletes the cluster-scoped KServe CRD; set E2E_RUN_CRD_WATCH_RESILIENCE=true to opt in</skipped></testcase><testcase classname="tests.test_crd_watch_resilience.TestDynamicCRDWatch" name="test_dynamic_watch_fires_exactly_once_on_crd_install" time="0.000"><skipped type="pytest.skip" message="requires a disposable cluster: deletes the cluster-scoped KServe CRD; set E2E_RUN_CRD_WATCH_RESILIENCE=true to opt in">/workspace/source/test/e2e/tests/test_crd_watch_resilience.py:262: requires a disposable cluster: deletes the cluster-scoped KServe CRD; set E2E_RUN_CRD_WATCH_RESILIENCE=true to opt in</skipped></testcase><testcase classname="tests.test_crd_watch_resilience.TestDynamicCRDWatch" name="test_static_watch_registered_when_crd_present_at_startup" time="0.000"><skipped type="pytest.skip" message="requires a disposable cluster: deletes the cluster-scoped KServe CRD; set E2E_RUN_CRD_WATCH_RESILIENCE=true to opt in">/workspace/source/test/e2e/tests/test_crd_watch_resilience.py:312: requires a disposable cluster: deletes the cluster-scoped KServe CRD; set E2E_RUN_CRD_WATCH_RESILIENCE=true to opt in</skipped></testcase><testcase classname="tests.test_echo_large_io.TestEchoFidelity" name="test_response_mirrors_prompt" time="12.547" /><testcase classname="tests.test_echo_large_io.TestEchoFidelity" name="test_max_tokens_does_not_truncate" time="0.119" /><testcase classname="tests.test_echo_large_io.TestLargeIO" name="test_large_prompt_round_trips_unmodified" time="0.210" /><testcase classname="tests.test_echo_large_io.TestLargeIO" name="test_response_size_tracks_prompt_size" time="0.282" /><testcase classname="tests.test_echo_large_io.TestCredentialLeak" name="test_api_key_not_echoed_in_response" time="0.110" /><testcase classname="tests.test_echo_large_io.TestCredentialLeak" name="test_canary_in_prompt_is_not_leaked_to_headers" time="11.071" /><testcase classname="tests.test_embedding_inference.TestEmbeddingDefaultDeny" name="test_embedding_default_deny_403" time="0.300" /><testcase classname="tests.test_embedding_inference.TestEmbeddingPathRouting" name="test_embedding_path_based_200" time="6.021" /><testcase classname="tests.test_embedding_inference.TestEmbeddingPathRouting" name="test_embedding_bbr_llmisvc_200" time="0.357" /><testcase classname="tests.test_embedding_inference.TestEmbeddingGovernance" name="test_embedding_trlp_429" time="17.838" /><testcase classname="tests.test_embedding_inference.TestEmbeddingGovernance" name="test_embedding_with_governance_200" time="27.100" /><testcase classname="tests.test_inference_priority.TestInferencePriority" name="test_objective_created_and_status_ready" time="49.291" /><testcase classname="tests.test_inference_priority.TestInferencePriority" name="test_priority_update_propagates" time="0.664" /><testcase classname="tests.test_inference_priority.TestInferencePriority" name="test_manual_edit_is_reverted" time="0.526" /><testcase classname="tests.test_inference_priority.TestInferencePriority" name="test_gateway_authpolicy_sets_flow_control_headers" time="0.207" /><testcase classname="tests.test_inference_priority.TestInferencePriority" name="test_inference_with_spoofed_headers_succeeds" time="0.224" /><testcase classname="tests.test_inference_priority.TestInferencePriority" name="test_clearing_priority_deletes_objective" time="1.017" /><testcase classname="tests.test_inference_priority.TestInferencePriority" name="test_subscription_delete_removes_objective" time="13.224" /><testcase classname="tests.test_inference_priority.TestInferencePriorityWithoutScheduler" name="test_model_without_pool_is_not_applicable" time="13.396" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_single_subscription_auto_select" time="78.177" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_explicit_subscription_header" time="1.362" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_models_filtered_by_subscription" time="1.374" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_different_modelrefs_same_model_id" time="47.975" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_empty_model_list" time="14.259" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_central_models_endpoint_exempt_from_rate_limiting" time="19.293"><failure message="AssertionError: Expected quota exhaustion within 5 requests at 3 tokens/minute; 5 requests succeeded&#10;assert False">self = &lt;test_models_endpoint.TestModelsEndpoint object at 0x7f60e3db1bd0&gt;

    @pytest.mark.serial
    def test_central_models_endpoint_exempt_from_rate_limiting(self):
        """Central model discovery remains available after inference quota exhaustion."""
        model_ref = UNCONFIGURED_MODEL_REF
        model_path = UNCONFIGURED_MODEL_PATH
        suffix = uuid.uuid4().hex[:6]
        auth_policy_name = f"e2e-central-models-exempt-auth-{suffix}"
        subscription_name = f"e2e-central-models-exempt-sub-{suffix}"
        sa_name = f"e2e-central-models-exempt-sa-{suffix}"
        token_limit = 3
        max_requests = 5
    
        try:
            _create_test_auth_policy(
                name=auth_policy_name,
                model_refs=[model_ref],
                groups=["system:authenticated"],
            )
            _wait_for_maas_auth_policy_phase(auth_policy_name, timeout=90)
            _wait_for_gateway_auth_enforced()
    
            _create_test_subscription(
                name=subscription_name,
                model_refs=[model_ref],
                groups=["system:authenticated"],
                token_limit=token_limit,
                window="1m",
            )
            _wait_for_maas_subscription_phase(subscription_name, timeout=90)
            _wait_for_token_rate_limit_policy(
                model_ref,
                model_namespace=MODEL_NAMESPACE,
                timeout=180,
                subscription_name=subscription_name,
            )
            _wait_for_subscription_trlp_status(
                subscription_name,
                model=model_ref,
                expected_ready=True,
                timeout=180,
            )
            _wait_for_model_ready(model_ref, namespace=MODEL_NAMESPACE, timeout=90)
    
            sa_token = _create_sa_token(sa_name, namespace=_ns())
            api_key = _create_api_key(
                sa_token,
                name=f"e2e-central-exempt-{suffix}",
                subscription=subscription_name,
            )
    
            # Establish that discovery works before consuming the quota. This
            # keeps a setup/readiness failure distinct from an exemption failure.
            _, baseline_models = _wait_for_central_models_in_subscription(
                api_key,
                subscription_name,
            )
            log.info("Central discovery baseline: %s", baseline_models)
    
            success_count = 0
            rate_limited = False
            for request_num in range(1, max_requests + 1):
                response = _inference(api_key, path=model_path, max_tokens=1)
                log.info("Inference request %d: %d", request_num, response.status_code)
                if response.status_code == 200:
                    success_count += 1
                elif response.status_code == 429:
                    rate_limited = True
                    break
                else:
                    raise AssertionError(
                        f"Unexpected inference status {response.status_code}: "
                        f"{response.text[:500]}"
                    )
    
&gt;           assert rate_limited, (
                f"Expected quota exhaustion within {max_requests} requests at "
                f"{token_limit} tokens/minute; {success_count} requests succeeded"
            )
E           AssertionError: Expected quota exhaustion within 5 requests at 3 tokens/minute; 5 requests succeeded
E           assert False

test/e2e/tests/test_models_endpoint.py:2316: AssertionError</failure></testcase><testcase classname="tests.test_negative_security.TestAuthPolicyRemoval" name="test_authpolicy_deletion_revokes_access" time="3.425" /><testcase classname="tests.test_praxis_extproc_restart.TestPraxisExtProcRestart" name="test_pre_processing_rollout_recovers_inference" time="13.907" /><testcase classname="tests.test_praxis_extproc_restart.TestPraxisExtProcRestart" name="test_processing_rollout_recovers_inference" time="14.111" /><testcase classname="tests.test_praxis_extproc_restart.TestPraxisExtProcRestart" name="test_both_extproc_rollout_recovers_inference" time="15.120" /><testcase classname="tests.test_praxis_extproc_secret_rotation.TestPraxisExtProcSecretRotation" name="test_in_place_secret_rotation_keeps_egress_without_extproc_restart" time="111.960" /><testcase classname="tests.test_subscription.TestSubscriptionEnforcement" name="test_auth_pass_no_subscription_gets_403" time="3.490" /><testcase classname="tests.test_subscription.TestSubscriptionEnforcement" name="test_rate_limit_exhaustion_gets_429" time="19.030" /><testcase classname="tests.test_subscription.TestSubscriptionEnforcement" name="test_models_endpoint_exempt_from_rate_limiting" time="19.902" /><testcase classname="tests.test_subscription.TestMultipleSubscriptionsPerModel" name="test_user_in_one_of_two_subscriptions_gets_200" time="10.986" /><testcase classname="tests.test_subscription.TestUnlimitedSubscription" name="test_unlimited_and_token_rate_limits_are_mutually_exclusive" time="0.664" /><testcase classname="tests.test_subscription.TestUnlimitedSubscription" name="test_unlimited_key_is_not_rate_limited" time="12.978" /><testcase classname="tests.test_subscription.TestUnlimitedSubscription" name="test_unlimited_subscriptions_share_one_wasm_limit" time="0.165"><skipped type="pytest.skip" message="no Kuadrant WasmPlugin for gateway maas-default-gateway">/workspace/source/test/e2e/tests/test_subscription.py:951: no Kuadrant WasmPlugin for gateway maas-default-gateway</skipped></testcase><testcase classname="tests.test_subscription.TestUnlimitedSubscription" name="test_unlimited_usage_is_metered" time="25.773" /><testcase classname="tests.test_subscription.TestAllUnlimitedModel" name="test_all_unlimited_model_is_not_denied" time="21.036" /><testcase classname="tests.test_subscription.TestMultipleAuthPoliciesPerModel" name="test_two_auth_policies_or_logic" time="17.071" /><testcase classname="tests.test_subscription.TestMultipleAuthPoliciesPerModel" name="test_delete_one_auth_policy_other_still_works" time="3.423" /><testcase classname="tests.test_subscription.TestCascadeDeletion" name="test_delete_subscription_rebuilds_trlp" time="13.436" /><testcase classname="tests.test_subscription.TestCascadeDeletion" name="test_trlp_persists_during_multi_subscription_deletion" time="30.750" /><testcase classname="tests.test_subscription.TestCascadeDeletion" name="test_delete_last_subscription_denies_access" time="18.647" /><testcase classname="tests.test_subscription.TestCascadeDeletion" name="test_unconfigured_model_denied_by_gateway_auth" time="0.727" /><testcase classname="tests.test_subscription.TestRateLimitIdentityGenerations" name="test_legacy_and_short_identities_coexist" time="33.388" /><testcase classname="tests.test_subscription.TestManagedAnnotation" name="test_authpolicy_managed_false_prevents_update" time="0.341"><skipped type="pytest.skip" message="gateway-only mode: per-model AuthPolicy is not created">/workspace/source/test/e2e/tests/test_subscription.py:1746: gateway-only mode: per-model AuthPolicy is not created</skipped></testcase><testcase classname="tests.test_subscription.TestManagedAnnotation" name="test_trlp_managed_false_prevents_update" time="3.148" /><testcase classname="tests.test_subscription.TestE2ESubscriptionFlow" name="test_e2e_with_access_but_no_subscription_gets_403" time="16.278" /><testcase classname="tests.test_subscription.TestE2ESubscriptionFlow" name="test_e2e_single_subscription_auto_selects" time="78.815" /><testcase classname="tests.test_subscription.TestE2ESubscriptionFlow" name="test_e2e_group_based_auth_but_no_subscription_gets_403" time="15.676" /><testcase classname="tests.test_subscription.TestStatusReporting" name="test_subscription_degraded_trlp_blocks_inference" time="101.071" /><testcase classname="tests.test_subscription.TestDegradedSubscriptionFiltering" name="test_failed_subscription_blocks_inference" time="17.531" /><testcase classname="tests.test_tenant.TestTenantLifecycle" name="test_payload_processing_deployed_with_active_tenant" time="7.367" /><testcase classname="tests.test_tenant.TestTenantLifecycle" name="test_payload_processing_and_pre_processing_resources" time="0.300"><skipped type="pytest.skip" message="default payload-processing is praxis-extproc; MaasTenantConfig.spec.payloadProcessing.resources is MaaS IPP-only">/workspace/source/test/e2e/tests/test_tenant.py:401: default payload-processing is praxis-extproc; MaasTenantConfig.spec.payloadProcessing.resources is MaaS IPP-only</skipped></testcase><testcase classname="tests.test_tenant_external_model_compat.TestLegacyIppCoexistence" name="test_no_route_on_default_gateway" time="0.000"><skipped type="pytest.skip" message="legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable">/workspace/source/test/e2e/tests/test_tenant_external_model_compat.py:377: legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable</skipped></testcase><testcase classname="tests.test_tenant_external_model_compat.TestLegacyIppCoexistence" name="test_not_served_through_default_gateway" time="0.000"><skipped type="pytest.skip" message="legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable">/workspace/source/test/e2e/tests/test_tenant_external_model_compat.py:386: legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable</skipped></testcase><testcase classname="tests.test_tenant_external_model_compat.TestLegacyIppCoexistence" name="test_no_ipp_status_writes" time="0.000"><skipped type="pytest.skip" message="legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable">/workspace/source/test/e2e/tests/test_tenant_external_model_compat.py:401: legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable</skipped></testcase><testcase classname="tests.test_tenant_external_model_compat.TestLegacyIppCoexistence" name="test_shared_provider_ownership_stays_defined" time="0.000"><skipped type="pytest.skip" message="legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable">/workspace/source/test/e2e/tests/test_tenant_external_model_compat.py:411: legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable</skipped></testcase><testcase classname="tests.test_tenant_external_model_compat.TestLegacyIppCoexistence" name="test_agc_tenant_gateway_still_serves" time="0.000"><skipped type="pytest.skip" message="legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable">/workspace/source/test/e2e/tests/test_tenant_external_model_compat.py:425: legacy IPP coexistence E2E requires the MaaS IPP image pin containing the legacy-controller exclusion guard; set TENANT_EXTERNAL_MODEL_LEGACY_IPP_E2E=true to enable</skipped></testcase><testcase classname="tests.test_tenant_namespace_discovery.TestTenantDiscoveryDormantMode" name="test_dormant_mode_ignores_labeled_namespace" time="0.505"><skipped type="pytest.skip" message="Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true">/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:357: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true</skipped></testcase><testcase classname="tests.test_trlp_rate_grouping.TestExpectedShapeHelpers" name="test_limit_name[single-rate]" time="0.001" /><testcase classname="tests.test_trlp_rate_grouping.TestExpectedShapeHelpers" name="test_limit_name[two-rates]" time="0.001" /><testcase classname="tests.test_trlp_rate_grouping.TestExpectedShapeHelpers" name="test_limit_name[input-order-ignored]" time="0.001" /><testcase classname="tests.test_trlp_rate_grouping.TestExpectedShapeHelpers" name="test_limit_name[duplicates-collapse]" time="0.000" /><testcase classname="tests.test_trlp_rate_grouping.TestExpectedShapeHelpers" name="test_limit_name[window-not-normalized]" time="0.000" /><testcase classname="tests.test_trlp_rate_grouping.TestExpectedShapeHelpers" name="test_limit_name[sorted-as-strings]" time="0.000" /><testcase classname="tests.test_trlp_rate_grouping.TestExpectedShapeHelpers" name="test_single_member_predicate_is_unchanged" time="0.000" /><testcase classname="tests.test_trlp_rate_grouping.TestExpectedShapeHelpers" name="test_multi_member_predicate_is_sorted_or" time="0.000" /><testcase classname="tests.test_trlp_rate_grouping.TestRateGrouping" name="test_same_rate_shares_limit_not_budget" time="33.358" /><testcase classname="tests.test_trlp_rate_grouping.TestRateGrouping" name="test_users_on_same_subscription_are_independent" time="23.935" /><testcase classname="tests.test_trlp_rate_grouping.TestRateGrouping" name="test_different_rates_get_separate_limits" time="40.872" /><testcase classname="tests.test_trlp_rate_grouping.TestRateGrouping" name="test_rate_edit_moves_subscription_between_limits" time="39.424" /><testcase classname="tests.test_trlp_rate_grouping.TestRateGrouping" name="test_gateway_wasm_config_grows_by_clause_not_limit" time="148.009" /><testcase classname="tests.test_x_api_key_auth.TestXAPIKeyAuthentication" name="test_x_api_key_authenticates" time="6.204" /><testcase classname="tests.test_x_api_key_auth.TestXAPIKeyAuthentication" name="test_authorization_bearer_still_works" time="0.093" /><testcase classname="tests.test_x_api_key_auth.TestXAPIKeyAuthentication" name="test_invalid_x_api_key_rejected" time="0.064" /><testcase classname="tests.test_x_api_key_auth.TestXAPIKeyAuthentication" name="test_x_api_key_without_prefix_rejected" time="0.054" /><testcase classname="tests.test_x_api_key_auth.TestXAPIKeyAuthentication" name="test_both_headers_no_conflict" time="0.969" /></testsuite></testsuites>