/workspace/source/test/e2e/tests/test_namespace_scoping.py:214: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:247: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:287: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:324: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:382: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:456: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_tenant_discovery.py:79: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery.py:155: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_external_oidc.py:251: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:262: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:276: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:289: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:302: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:335: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:377: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:424: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:460: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:525: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:556: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:582: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:642: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:678: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:716: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:764: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:852: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:904: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:940: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:994: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:189: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deployself = <test_api_keys.TestAPIKeyExpiration object at 0x7f80d52316a0> api_keys_base_url = 'https://e2e-worker-w0-924916.apps.5402c0de-9648-40cc-8779-24a87c34e583.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjVSX0puMElUVGVpOFdVZlNXSVRTa1g1ZkgxQ0tRYlI2LTNTS2tmaHpiNk0ifQ.e...13cJNqpVOdIAwjrpaTdRKyYHt2inhJ9U_hVfehT8YGaD-Ztz0bEvm63fgzJAprqV9xXJ4auEVnHMWULQw', 'Content-Type': 'application/json'} max_expiration_days = 90 def test_expiration_policy_boundaries( self, api_keys_base_url: str, headers: dict, max_expiration_days: int, ): """Validate successful, boundary, rejected, and non-expiring key requests.""" cases = [ ("within-limit", (max_expiration_days // 2) * 24 or 24, True), ("at-limit", max_expiration_days * 24, True), ("exceeds-limit", max_expiration_days * 2 * 24, False), ("without-expiration", None, True), ("short-expiration", 1, True), ] for label, expires_in_hours, should_succeed in cases: payload = { > "name": f"test-{label}-{uuid.uuid4().hex[:8]}", "description": f"Expiration boundary case: {label}", } E NameError: name 'uuid' is not defined test/e2e/tests/test_api_keys.py:785: NameError/workspace/source/test/e2e/tests/test_api_keys.py:1405: Cannot find maas-api pod in odh-ai-gateway-infra: error: error executing jsonpath "{.items[0].metadata.name}": Error executing template: array index out of bounds: index 0, length 0. Printing more information for debugging the template: template was: {.items[0].metadata.name} object given to jsonpath engine was: map[string]interface {}{"apiVersion":"v1", "items":[]interface {}{}, "kind":"List", "metadata":map[string]interface {}{"resourceVersion":""}}/workspace/source/test/e2e/tests/test_subscription.py:1181: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:355: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:93: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:141: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:228: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.self = <test_subscription.TestDegradedSubscriptionFiltering object at 0x7f80d5508b20> def test_failed_subscription_blocks_inference(self): """ Test: Failed subscription blocks inference via OPA rule. Setup: 1. Create subscription with valid model (starts Active) 2. Create API key 3. Manually patch subscription to Failed phase 4. Verify inference is rejected by OPA (403) Note: We use manual patching because naturally creating a Failed subscription requires only invalid models, which don't have routes (404 before OPA runs). """ ns = _ns() subscription_name = "e2e-failed-sub-inf" auth_name = "e2e-failed-sub-inf-auth" sa_name = "e2e-failed-sub-inf-sa" try: oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) # Create auth policy for valid model _create_test_auth_policy(auth_name, MODEL_REF, users=[sa_user]) # Create subscription with valid model (will be Active) _create_test_subscription(subscription_name, MODEL_REF, users=[sa_user]) cr = _wait_for_maas_subscription_phase(subscription_name, "Active", timeout=60) # Verify it starts as Active phase = cr.get("status", {}).get("phase") log.info(f"Initial phase: {phase}") assert phase == "Active", f"Expected Active initially, got {phase}" # Create API key while Active api_key = _create_api_key( oc_token, name="failed-sub-test", subscription=subscription_name ) # Verify inference works while Active log.info("Testing inference while Active...") r = _inference(api_key, path=MODEL_PATH, model_name=MODEL_NAME) assert r.status_code == 200, f"Expected 200 while Active, got {r.status_code}: {r.text[:200]}" log.info("✅ Inference works with Active subscription") # Manually patch subscription to Failed phase import subprocess import json from datetime import datetime log.info("Manually patching subscription to Failed phase...") patch_data = { "status": { "phase": "Failed", "conditions": [ { "type": "Ready", "status": "False", "reason": "Failed", "message": "Subscription failed", "lastTransitionTime": datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ") } ], "modelRefStatuses": [ { "name": MODEL_REF, "namespace": MODEL_NAMESPACE, "ready": False, "reason": "ReconcileFailed", "message": "Model failed" } ] } } cmd = [ "kubectl", "patch", "maassubscription", subscription_name, "-n", ns, "--type=merge", "--subresource=status", "-p", json.dumps(patch_data) ] result = subprocess.run(cmd, capture_output=True, text=True) assert result.returncode == 0, f"Failed to patch to Failed phase: {result.stderr}" # Verify phase is Failed cr = _get_cr("maassubscription", subscription_name, namespace=ns) phase = cr.get("status", {}).get("phase") > assert phase == "Failed", f"Expected Failed phase after patch, got {phase}" E AssertionError: Expected Failed phase after patch, got Active E assert 'Active' == 'Failed' E E - Failed E + Active test/e2e/tests/test_subscription.py:2523: AssertionError/workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:215: Per-tenant OIDC tokens unavailable — set OIDC_TOKEN_URL (tenant-a) and OIDC_TOKEN_URL_TENANT_B (tenant-b), or OIDC_TOKEN_TENANT_A / OIDC_TOKEN_TENANT_B