self = <test_api_keys.TestAPIKeySubscriptionFilter object at 0x7f83b1e2ffd0> api_keys_base_url = 'https://maas.apps.0426ad84-99e1-4579-8eab-979f34b492e9.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6InlVNklSbXpmanhpTnVodGUyNnFKcHE4Sm92ZHliOFNIM1UyeFZxNmxWUlkifQ.e...cibPZ92UA-TUiJouFPXK-yJO2w4W9F50cKIBnvEpN3jq0I1Blm0mf_vjBaZSSIm36T8K5WMf7XST3_dkA', 'Content-Type': 'application/json'} def test_search_without_subscription_returns_all(self, api_keys_base_url: str, headers: dict): """Search without subscription filter returns keys across all subscriptions.""" key_ids = [] try: # Create keys with explicit subscription binding for i in range(2): r = requests.post( api_keys_base_url, headers=headers, json={"name": f"e2e-nofilter-{i}", "subscription": SIMULATOR_SUBSCRIPTION}, timeout=TIMEOUT, verify=TLS_VERIFY, ) > assert r.status_code in (200, 201), f"Failed to create key: {r.text}" E AssertionError: Failed to create key: E assert 403 in (200, 201) E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:1576: AssertionError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_negative_security.TestHeaderSpoofing object at 0x7f83b1f45790> def test_injected_identity_headers_ignored(self): """Client injects X-MaaS-Username/Group/Key-Id — platform ignores them. Validates that Authorino strips attacker-controlled identity headers. The request should succeed (200) using the real key-derived identity, proving the spoofed headers had no effect on authorization. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:83: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InlVNklSbXpmanhpTnVodGUyNnFKcHE4Sm92ZHliOFNIM1UyeFZxNmxWUlkifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...HAlm5FOqwNvl28WFGzUXsCSyLYnMscnAxm8BVcibPZ92UA-TUiJouFPXK-yJO2w4W9F50cKIBnvEpN3jq0I1Blm0mf_vjBaZSSIm36T8K5WMf7XST3_dkA' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:290: RuntimeErrorself = <test_negative_security.TestHeaderSpoofing object at 0x7f83b1f45eb0> def test_duplicate_subscription_headers_ignored(self): """Client sends multiple X-MaaS-Subscription headers — API key binding wins. For API key requests, the subscription is fixed at mint time. Duplicate or conflicting X-MaaS-Subscription headers must not override the key-derived subscription. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:110: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InlVNklSbXpmanhpTnVodGUyNnFKcHE4Sm92ZHliOFNIM1UyeFZxNmxWUlkifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...HAlm5FOqwNvl28WFGzUXsCSyLYnMscnAxm8BVcibPZ92UA-TUiJouFPXK-yJO2w4W9F50cKIBnvEpN3jq0I1Blm0mf_vjBaZSSIm36T8K5WMf7XST3_dkA' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:290: RuntimeError/workspace/source/test/e2e/tests/test_negative_security.py:200: Could not create short-lived key: 403self = <test_negative_security.TestCrossModelAccess object at 0x7f83b1f45490> def test_key_cannot_access_model_outside_subscription(self): """Key for model A cannot infer on model B outside its subscription. Uses the pre-deployed unconfigured model (a model with no subscription granting access to it) to test cross-model access denial. """ > api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) test/e2e/tests/test_negative_security.py:234: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ oc_token = 'eyJhbGciOiJSUzI1NiIsImtpZCI6InlVNklSbXpmanhpTnVodGUyNnFKcHE4Sm92ZHliOFNIM1UyeFZxNmxWUlkifQ.eyJhdWQiOlsiaHR0cHM6Ly9wcm...HAlm5FOqwNvl28WFGzUXsCSyLYnMscnAxm8BVcibPZ92UA-TUiJouFPXK-yJO2w4W9F50cKIBnvEpN3jq0I1Blm0mf_vjBaZSSIm36T8K5WMf7XST3_dkA' name = None, subscription = 'simulator-subscription' def _create_api_key(oc_token: str, name: str = None, subscription: str = None) -> str: """Create an API key using the MaaS API and return the plaintext key. Args: oc_token: OC token for authentication with maas-api name: Optional name for the key (auto-generated if not provided) subscription: Optional MaaSSubscription name to bind (highest-priority auto-bind if omitted) Returns: The plaintext API key (sk-oai-xxx format) """ r = _create_api_key_raw(oc_token, name, subscription) if r.status_code not in (200, 201): > raise RuntimeError(f"Failed to create API key: {r.status_code} {r.text}") E RuntimeError: Failed to create API key: 403 test/e2e/tests/test_helper.py:290: RuntimeError/workspace/source/test/e2e/tests/test_subscription.py:1054: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:186: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:353: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=trueself = <test_gateway_scoped_authpolicy.TestGatewayAuthPolicyStructure object at 0x7f83b1941670> def test_target_ref_points_to_gateway(self): """6.1: maas-gateway-auth targetRef must be Gateway, not HTTPRoute.""" ap = get_gateway_authpolicy() assert ap is not None, ( f"{GATEWAY_AUTH_POLICY_NAME} must exist in {GATEWAY_NAMESPACE} after prow fixtures reconcile" ) target = get_gateway_authpolicy_target_ref() assert target.get("kind") == "Gateway", f"expected Gateway targetRef, got {target!r}" assert target.get("group") == "gateway.networking.k8s.io" assert target.get("name") == DEFAULT_GATEWAY_NAME target_ns = target.get("namespace") or GATEWAY_NAMESPACE assert target_ns == GATEWAY_NAMESPACE, f"expected gateway namespace {GATEWAY_NAMESPACE}, got {target_ns!r}" conditions = (ap.get("status") or {}).get("conditions") or [] accepted = [c for c in conditions if c.get("type") == "Accepted"] > assert accepted and accepted[0].get("status") == "True", ( f"{GATEWAY_AUTH_POLICY_NAME} must be Accepted, got {conditions!r}" ) E AssertionError: maas-gateway-auth must be Accepted, got [] E assert ([]) test/e2e/tests/test_gateway_scoped_authpolicy.py:67: AssertionError