test(maas): update subscription tests with new API key changes (#1177)

* test(maas): update subscription tests with new API key changes

* test(maas): remove temporary comment from conftest

* test(maas): addressed coderabit review

* fix: address review comments

* fix: address coderabit comment

* fix: address coderabit comment

* address review comments

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------

Co-authored-by: Thomas Recchiuto <34453570+threcc@users.noreply.github.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Author: 3 people

tests/model_serving/model_server/maas_billing/maas_subscription/conftest.py

@@ -2,6 +2,7 @@
 from typing import Any
 
 import pytest
+import requests
 from kubernetes.dynamic import DynamicClient
 from ocp_resources.llm_inference_service import LLMInferenceService
 from ocp_resources.namespace import Namespace
@@ -10,9 +11,11 @@
 from simple_logger.logger import get_logger
 
 from tests.model_serving.model_server.maas_billing.maas_subscription.utils import (
+    create_api_key,
     patch_llmisvc_with_maas_router_and_tiers,
 )
 from tests.model_serving.model_server.maas_billing.utils import build_maas_headers
+from utilities.general import generate_random_name
 from utilities.infra import create_inference_token, login_with_user_password
 from utilities.llmd_constants import ContainerImages, ModelStorage
 from utilities.llmd_utils import create_llmisvc
@@ -255,6 +258,43 @@ def model_url_tinyllama_premium(
     return url
 
 
+@pytest.fixture(scope="class")
+def maas_api_key_for_actor(
+    request_session_http: requests.Session,
+    base_url: str,
+    ocp_token_for_actor: str,
+    maas_controller_enabled_latest: None,
+    maas_gateway_api: None,
+    maas_api_gateway_reachable: None,
+) -> str:
+    """
+    Create an API key for the current actor (admin/free/premium).
+
+    Flow:
+    - Use OpenShift token (ocp_token_for_actor) to create an API key via MaaS API.
+    - Use the plaintext API key for gateway inference: Authorization: Bearer <sk-...>.
+    """
+    api_key_name = f"odh-sub-tests-{generate_random_name()}"
+
+    _, body = create_api_key(
+        base_url=base_url,
+        ocp_user_token=ocp_token_for_actor,
+        request_session_http=request_session_http,
+        api_key_name=api_key_name,
+        request_timeout_seconds=60,
+    )
+
+    return body["key"]
+
+
+@pytest.fixture(scope="class")
+def maas_headers_for_actor_api_key(maas_api_key_for_actor: str) -> dict[str, str]:
+    """
+    Headers for gateway inference using API key (new implementation).
+    """
+    return build_maas_headers(token=maas_api_key_for_actor)
+
+
 @pytest.fixture(scope="class")
 def maas_wrong_group_service_account_token(
     maas_api_server_url: str,

tests/model_serving/model_server/maas_billing/maas_subscription/test_multiple_subscriptions_per_model.py

@@ -35,7 +35,7 @@ class TestMultipleSubscriptionsPerModel:
     Validates behavior when multiple subscriptions exist for the same model.
     """
 
-    @pytest.mark.sanity
+    @pytest.mark.smoke
     @pytest.mark.parametrize("ocp_token_for_actor", [{"type": "free"}], indirect=True)
     def test_user_in_one_of_two_subscriptions_can_access_model(
         self,
@@ -44,8 +44,8 @@ def test_user_in_one_of_two_subscriptions_can_access_model(
         maas_free_group: str,
         maas_model_tinyllama_free,
         model_url_tinyllama_free: str,
-        ocp_token_for_actor: str,
         maas_subscription_tinyllama_free,
+        maas_headers_for_actor_api_key: dict[str, str],
     ) -> None:
         """
         Create a second subscription for a different group the user is NOT in.
@@ -66,10 +66,8 @@ def test_user_in_one_of_two_subscriptions_can_access_model(
         ) as extra_subscription:
             extra_subscription.wait_for_condition(condition="Ready", status="True", timeout=300)
 
-            headers = build_maas_headers(token=ocp_token_for_actor)
             payload = chat_payload_for_url(model_url=model_url_tinyllama_free)
-
-            explicit_headers = dict(headers)
+            explicit_headers = dict(maas_headers_for_actor_api_key)
             explicit_headers[MAAS_SUBSCRIPTION_HEADER] = maas_subscription_tinyllama_free.name
 
             LOGGER.info(
@@ -90,7 +88,7 @@ def test_user_in_one_of_two_subscriptions_can_access_model(
                 f"{(response.text or '')[:200]}"
             )
 
-    @pytest.mark.sanity
+    @pytest.mark.smoke
     @pytest.mark.parametrize("ocp_token_for_actor", [{"type": "free"}], indirect=True)
     def test_high_priority_subscription_allows_access_when_explicitly_selected(
         self,
@@ -99,8 +97,8 @@ def test_high_priority_subscription_allows_access_when_explicitly_selected(
         maas_free_group: str,
         maas_model_tinyllama_free,
         model_url_tinyllama_free: str,
-        ocp_token_for_actor: str,
         maas_subscription_tinyllama_free,
+        maas_headers_for_actor_api_key: dict[str, str],
     ) -> None:
         """
         Create a second (higher priority) subscription for the same group + model.
@@ -122,10 +120,9 @@ def test_high_priority_subscription_allows_access_when_explicitly_selected(
         ) as high_tier_subscription:
             high_tier_subscription.wait_for_condition(condition="Ready", status="True", timeout=300)
 
-            headers = build_maas_headers(token=ocp_token_for_actor)
             payload = chat_payload_for_url(model_url=model_url_tinyllama_free)
 
-            explicit_headers = dict(headers)
+            explicit_headers = dict(maas_headers_for_actor_api_key)
             explicit_headers[MAAS_SUBSCRIPTION_HEADER] = high_tier_subscription.name
 
             response = poll_expected_status(
@@ -141,7 +138,7 @@ def test_high_priority_subscription_allows_access_when_explicitly_selected(
                 f"got {response.status_code}: {(response.text or '')[:200]}"
             )
 
-    @pytest.mark.sanity
+    @pytest.mark.smoke
     def test_service_account_cannot_use_subscription_it_does_not_belong_to(
         self,
         request_session_http: requests.Session,

tests/model_serving/model_server/maas_billing/maas_subscription/utils.py

@@ -12,6 +12,7 @@
 from ocp_resources.llm_inference_service import LLMInferenceService
 from ocp_resources.resource import ResourceEditor
 from pytest_testconfig import config as py_config
+from requests import Response
 from simple_logger.logger import get_logger
 from timeout_sampler import TimeoutSampler
 
@@ -168,3 +169,45 @@ def create_maas_subscription(
         teardown=teardown,
         wait_for_resource=wait_for_resource,
     )
+
+
+def create_api_key(
+    base_url: str,
+    ocp_user_token: str,
+    request_session_http: requests.Session,
+    api_key_name: str,
+    request_timeout_seconds: int = 60,
+) -> tuple[Response, dict[str, Any]]:
+    """
+    Create an API key via MaaS API and return (response, parsed_body).
+
+    Uses ocp_user_token for auth against maas-api.
+    Expects plaintext key in body["key"] (sk-...).
+    """
+    api_keys_url = f"{base_url}/v1/api-keys"
+
+    response = request_session_http.post(
+        url=api_keys_url,
+        headers={
+            "Authorization": f"Bearer {ocp_user_token}",
+            "Content-Type": "application/json",
+        },
+        json={"name": api_key_name},
+        timeout=request_timeout_seconds,
+    )
+
+    LOGGER.info(f"create_api_key: url={api_keys_url} status={response.status_code}")
+    if response.status_code not in (200, 201):
+        raise AssertionError(f"api-key create failed: status={response.status_code}")
+
+    try:
+        parsed_body: dict[str, Any] = json.loads(response.text)
+    except json.JSONDecodeError as error:
+        LOGGER.error(f"Unable to parse API key response from {api_keys_url}; status={response.status_code}")
+        raise AssertionError("API key creation returned non-JSON response") from error
+
+    api_key = parsed_body.get("key", "")
+    if not isinstance(api_key, str) or not api_key.startswith("sk-"):
+        raise AssertionError("No plaintext api key returned in MaaS API response")
+
+    return response, parsed_body