<?xml version="1.0" encoding="utf-8"?><testsuites name="pytest tests"><testsuite name="pytest" errors="1" failures="0" skipped="3" tests="85" time="1195.948" timestamp="2026-11-04T03:30:44.957346+00:00" hostname="maas-group-test-xdbn4-e2e-maas-openshift-pod"><testcase classname="tests.test_aitenant_lifecycle.TestAITenantLifecycle" name="test_default_aitenant_bootstraps_maas_tenant_config_without_gateway_mutation" time="12.168" /><testcase classname="tests.test_aitenant_lifecycle.TestAITenantLifecycle" name="test_aitenant_rejected_outside_ai_tenants_namespace" time="7.861" /><testcase classname="tests.test_api_keys.TestAPIKeyCRUD" name="test_list_api_keys" time="157.930" /><testcase classname="tests.test_api_keys.TestAPIKeyModelInference" name="test_invalid_api_key_rejected" time="0.252" /><testcase classname="tests.test_authpolicy_generation_stability.TestAuthPolicyGenerationStability" name="test_generation_does_not_increase_during_quiet_window" time="72.423" /><testcase classname="tests.test_api_keys.TestAPIKeyCRUD" name="test_create_api_key" time="229.924" /><testcase classname="tests.test_api_keys.TestAPIKeyModelInference" name="test_api_key_model_access_success" time="0.628" /><testcase classname="tests.test_authpolicy_generation_stability.TestAuthPolicyGenerationStability" name="test_no_rapid_resource_version_changes" time="60.489" /><testcase classname="tests.test_config_tenant.TestConfigAnchorPresence" name="test_cluster_config_default_exists" time="10.569" /><testcase classname="tests.test_config_tenant.TestConfigAnchorPresence" name="test_cluster_config_not_terminating" time="0.209" /><testcase classname="tests.test_config_tenant.TestConfigTenantOwnership" name="test_tenant_config_lists_config_owner_reference" time="0.149" /><testcase classname="tests.test_config_tenant.TestConfigTenantOwnership" name="test_maas_controller_deployment_does_not_list_config_owner_reference" time="0.150" /><testcase classname="tests.test_gateway_filter_chain_praxis.TestGatewayFilterChainPraxis" name="test_no_listener_rejected" time="5.339" /><testcase classname="tests.test_gateway_filter_chain_praxis.TestGatewayFilterChainPraxis" name="test_payload_processing_precedes_router" time="0.001" /><testcase classname="tests.test_gateway_scoped_authpolicy.TestGatewayAuthPolicyStructure" name="test_gateway_auth_policy_contract" time="0.537" /><testcase classname="tests.test_api_keys.TestAPIKeyCRUD" name="test_revoke_api_key" time="250.807" /><testcase classname="tests.test_api_keys.TestAPIKeyModelInference" name="test_no_auth_header_rejected" time="0.251" /><testcase classname="tests.test_negative_security.TestAPIKeyManagementIsolation" name="test_api_key_cannot_mint_another_api_key" time="1.085" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[username-only]" time="1.693" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[group-only]" time="1.736" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[keyname-only]" time="1.757" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[identity-envelope]" time="1.788" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_forged_identity_headers_rejected_on_key_mint[admin-scope]" time="1.732" /><testcase classname="tests.test_api_keys.TestAPIKeyAuthorization" name="test_non_admin_cannot_access_other_users_keys" time="252.598" /><testcase classname="tests.test_api_keys.TestAPIKeyModelInference" name="test_revoked_api_key_rejected" time="3.505" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_injected_identity_headers_rejected_on_inference" time="0.693" /><testcase classname="tests.test_negative_security.TestExpiredKeyRejection" name="test_expired_key_rejected_at_gateway" time="5.578" /><testcase classname="tests.test_negative_security.TestHeaderSpoofing" name="test_duplicate_subscription_headers_ignored" time="9.014" /><testcase classname="tests.test_negative_security.TestCrossModelAccess" name="test_key_cannot_access_model_outside_subscription" time="0.730" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_internal_endpoint_not_routable[subscriptions-select]" time="0.370" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_internal_endpoint_not_routable[api-keys-cleanup]" time="0.372" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_internal_endpoint_not_routable[api-keys-validate]" time="0.384" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_health_endpoint_accessible" time="0.220" /><testcase classname="tests.test_negative_security.TestInternalEndpointIsolation" name="test_v1_models_via_maas_api_prefix" time="0.483" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_networkpolicy_exists" time="0.165" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_pod_selector_covers_both_processors" time="0.142" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_ingress_uses_istio_managed_label" time="0.141" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_egress_allows_otlp_to_monitoring_namespace" time="0.298"><skipped type="pytest.skip" message="AIGC praxis NetworkPolicy does not include OTLP 4317 egress (MaaS Go IPP bundle only)">/workspace/source/test/e2e/tests/test_networkpolicy.py:119: AIGC praxis NetworkPolicy does not include OTLP 4317 egress (MaaS Go IPP bundle only)</skipped></testcase><testcase classname="tests.test_networkpolicy.TestPayloadProcessingNetworkPolicyExists" name="test_ingress_does_not_hardcode_single_gateway" time="0.142" /><testcase classname="tests.test_networkpolicy.TestMaaSAuthorinoNetworkPolicy" name="test_rhcl_authorino_namespace_is_allowed" time="0.144" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingConnectivity" name="test_maas_gateway_pod_exists" time="10.177" /><testcase classname="tests.test_api_keys.TestAPIKeyAuthorization" name="test_admin_manage_other_users_keys" time="260.353" /><testcase classname="tests.test_api_keys.TestEphemeralKeyCleanup" name="test_cronjob_exists_and_configured" time="0.471" /><testcase classname="tests.test_negative_security.TestHeaderAbuse" name="test_special_characters_in_subscription_header" time="1.550" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingConnectivity" name="test_payload_processing_pods_running" time="10.178" /><testcase classname="tests.test_networkpolicy.TestMaaSGatewayFunctional" name="test_maas_api_health" time="0.213" /><testcase classname="tests.test_smoke" name="test_healthz_or_404" time="0.215" /><testcase classname="tests.test_smoke" name="test_tokens_endpoint_replaced_by_api_keys" time="0.241" /><testcase classname="tests.test_smoke" name="test_models_catalog" time="0.307" /><testcase classname="tests.test_smoke" name="test_chat_completions_gateway_alive" time="0.602" /><testcase classname="tests.test_smoke" name="test_chat_completions_streaming_sse" time="0.275" /><testcase classname="tests.test_smoke" name="test_legacy_completions_optionally" time="0.262" /><testcase classname="tests.test_networkpolicy.TestPayloadProcessingConnectivity" name="test_maas_gateway_has_istio_managed_label" time="0.192" /><testcase classname="tests.test_networkpolicy.TestMaaSGatewayFunctional" name="test_maas_api_models_reachable" time="0.310" /><testcase classname="tests.test_subscription.TestAuthEnforcement" name="test_authorized_user_gets_200" time="7.480" /><testcase classname="tests.test_subscription.TestAuthEnforcement" name="test_no_auth_gets_401" time="0.269" /><testcase classname="tests.test_subscription.TestAuthEnforcement" name="test_invalid_token_gets_403" time="7.407" /><testcase classname="tests.test_subscription.TestAuthEnforcement" name="test_wrong_group_gets_403" time="0.567" /><testcase classname="tests.test_tenant.TestTenantLifecycle" name="test_tenant_ready_and_phase_healthy" time="0.445" /><testcase classname="tests.test_tenant.TestTenantContract" name="test_status_has_phase_and_conditions" time="0.141" /><testcase classname="tests.test_tenant.TestTenantContract" name="test_spec_is_well_formed" time="0.139" /><testcase classname="tests.test_tenant.TestTenantContract" name="test_conditions_use_kubernetes_metav1_shape" time="0.154" /><testcase classname="tests.test_tenant.TestTenantNoFalseOwnership" name="test_maas_user_crs_not_owned_by_tenant" time="0.486" /><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_requires_auth" time="6.956" /><testcase classname="tests.test_subscription.TestSubscriptionEnforcement" name="test_subscribed_user_gets_200" time="7.830" /><testcase classname="tests.test_config_tenant.TestConfigTenantOwnership" name="test_default_aitenant_lists_config_owner_reference" time="0.507" /><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_authenticated" time="0.001"><skipped type="pytest.skip" message="Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.">/workspace/source/test/e2e/tests/test_tenant_discovery.py:79: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.</skipped></testcase><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_not_exposed_through_gateway" time="0.202" /><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_with_invalid_token" time="3.130" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_response_schema_and_metadata" time="140.766" /><testcase classname="tests.test_models_endpoint.TestModelsEndpoint" name="test_unauthenticated_request_401" time="0.287" /><testcase classname="tests.test_subscription_list_endpoints.TestListSubscriptions" name="test_unauthenticated_returns_401[all-subscriptions]" time="161.934" /><testcase classname="tests.test_subscription_list_endpoints.TestListSubscriptions" name="test_unauthenticated_returns_401[subscriptions-for-model]" time="0.245" /><testcase classname="tests.test_subscription_list_endpoints.TestListSubscriptions" name="test_returns_accessible_subscriptions" time="167.203" /><testcase classname="tests.test_tenant_discovery" name="test_tenant_discovery_gateway_matches_deployment" time="0.001"><skipped type="pytest.skip" message="Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.">/workspace/source/test/e2e/tests/test_tenant_discovery.py:155: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.</skipped></testcase><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_provider_reports_ready" time="54.001" /><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_served_through_default_gateway" time="73.788" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_credential_copy_delivered_to_tenant" time="301.306" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_unselected_gateway_not_serving" time="178.180" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_attachment_status_ready" time="335.949" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_one_httproute_in_model_namespace" time="167.715" /><testcase classname="tests.test_tenant_external_model_attachment.TestUserNamespaceAttachmentServing" name="test_inference_serves_with_user_namespace_credential" time="345.865" /><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_unknown_key_rejected" time="307.758" /><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_subscription_header_reaches_provider_and_replaces_client_value" time="73.036" /><testcase classname="tests.test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs" name="test_attached_to_default_gateway" time="459.529"><error message="failed on setup with &quot;AssertionError: Gateway never applied x-grid-geo-fencing header injection within 300s; last: expected 200 through maas-default-gateway, got 503: &#10;assert 503 == 200&#10; +  where 503 = &lt;Response [503]&gt;.status_code&quot;">self = &lt;test_tenant_external_model_default_tenant.TestDefaultTenantServesModelWithoutGatewayRefs object at 0x7f95ef8db310&gt;
gateway_url = 'https://maas.apps.bf3fd78ef25f0bfc1ac7.prod.konflux-ocp-ci.dev'

    @pytest.fixture(scope="class")
    def implicit_model(self, gateway_url):
        tracked: list[tuple[str, str, str]] = []
        try:
            model = _provision_model(tracked, "e2e-dft")
            attachment = _wait_implicitly_attached(model)
&gt;           api_key = _serve_in_default_tenant(tracked, model, gateway_url)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

test/e2e/tests/test_tenant_external_model_default_tenant.py:405: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test/e2e/tests/test_tenant_external_model_default_tenant.py:317: in _serve_in_default_tenant
    _wait_for_subscription_header(gateway_url, model, api_key)
test/e2e/tests/test_tenant_external_model_default_tenant.py:369: in _wait_for_subscription_header
    wait_until(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

check = &lt;function _wait_for_subscription_header.&lt;locals&gt;._check at 0x7f95ef7b0180&gt;
timeout = 300
what = 'Gateway never applied x-grid-geo-fencing header injection', interval = 5

    def wait_until(check, timeout: int, what: str, interval: int = 5):
        """Poll check() until it returns a truthy value. Assertion failures and transient
        cluster or HTTP errors count as "not yet"; the last one ends up in the timeout message."""
        deadline = time.time() + timeout
        while True:
            try:
                result = check()
                if result:
                    return result
                last = result
            except (AssertionError, subprocess.TimeoutExpired, requests.RequestException) as exc:
                last = exc
&gt;           assert time.time() &lt; deadline, f"{what} within {timeout}s; last: {last}"
                   ^^^^^^^^^^^^^^^^^^^^^^
E           AssertionError: Gateway never applied x-grid-geo-fencing header injection within 300s; last: expected 200 through maas-default-gateway, got 503: 
E           assert 503 == 200
E            +  where 503 = &lt;Response [503]&gt;.status_code

test/e2e/tests/multitenancy_helpers.py:279: AssertionError</error></testcase></testsuite></testsuites>