fix: teardown issue where unprivileged user cannot delete namespace

tests/conftest.py

@@ -110,7 +110,7 @@ def model_namespace(
         ns.clean_up()
     else:
         with create_ns(
-            client=admin_client,
+            admin_client=admin_client,
             pytest_request=request,
             teardown=teardown_resources,
         ) as ns:
@@ -407,12 +407,12 @@ def cluster_monitoring_config(
 
 @pytest.fixture(scope="class")
 def unprivileged_model_namespace(
-    request: FixtureRequest, unprivileged_client: DynamicClient
+    request: FixtureRequest, admin_client: DynamicClient, unprivileged_client: DynamicClient
 ) -> Generator[Namespace, Any, Any]:
     if request.param.get("modelmesh-enabled"):
         request.getfixturevalue(argname="enabled_modelmesh_in_dsc")
 
-    with create_ns(unprivileged_client=unprivileged_client, pytest_request=request) as ns:
+    with create_ns(admin_client=admin_client, unprivileged_client=unprivileged_client, pytest_request=request) as ns:
         yield ns
 
 
@@ -421,7 +421,7 @@ def unprivileged_model_namespace(
 def minio_namespace(admin_client: DynamicClient) -> Generator[Namespace, Any, Any]:
     with create_ns(
         name=f"{MinIo.Metadata.NAME}-{shortuuid.uuid().lower()}",
-        client=admin_client,
+        admin_client=admin_client,
     ) as ns:
         yield ns
 

tests/model_explainability/trustyai_service/service/conftest.py

@@ -75,7 +75,7 @@ def model_namespace_2(
         ns.clean_up()
     else:
         with create_ns(
-            client=admin_client,
+            admin_client=admin_client,
             pytest_request=request,
             teardown=teardown_resources,
         ) as ns:

tests/model_registry/negative_tests/conftest.py

@@ -27,7 +27,7 @@ def model_registry_namespace_for_negative_tests(
 ) -> Generator[Namespace, Any, Any]:
     with create_ns(
         name=request.param.get("namespace_name", CUSTOM_NEGATIVE_NS),
-        client=admin_client,
+        admin_client=admin_client,
     ) as ns:
         yield ns
 

tests/model_serving/model_server/private_endpoint/conftest.py

@@ -18,8 +18,8 @@
 
 
 @pytest.fixture(scope="class")
-def diff_namespace(unprivileged_client: DynamicClient) -> Generator[Namespace, Any, Any]:
-    with create_ns(unprivileged_client=unprivileged_client, name="diff-namespace") as ns:
+def diff_namespace(admin_client: DynamicClient, unprivileged_client: DynamicClient) -> Generator[Namespace, Any, Any]:
+    with create_ns(admin_client=admin_client, unprivileged_client=unprivileged_client, name="diff-namespace") as ns:
         yield ns
 
 

tests/model_serving/model_server/upgrade/conftest.py

@@ -43,7 +43,7 @@ def model_namespace_scope_session(
 
     else:
         with create_ns(
-            client=admin_client,
+            admin_client=admin_client,
             name=name,
             model_mesh_enabled=True,
             add_dashboard_label=True,

tests/rag/conftest.py

@@ -6,6 +6,7 @@
 from ocp_resources.deployment import Deployment
 from _pytest.fixtures import FixtureRequest
 from ocp_resources.namespace import Namespace
+
 from utilities.infra import create_ns
 from simple_logger.logger import get_logger
 from utilities.rag_utils import create_llama_stack_distribution, LlamaStackDistribution
@@ -55,9 +56,11 @@ def enabled_llama_stack_operator(dsc_resource: DataScienceCluster) -> Generator[
 
 
 @pytest.fixture(scope="function")
-def rag_test_namespace(unprivileged_client: DynamicClient) -> Generator[Namespace, Any, Any]:
+def rag_test_namespace(
+    admin_client: DynamicClient, unprivileged_client: DynamicClient
+) -> Generator[Namespace, Any, Any]:
     namespace_name = generate_random_name(prefix="rag-test-")
-    with create_ns(namespace_name, unprivileged_client=unprivileged_client) as ns:
+    with create_ns(namespace_name, admin_client=admin_client, unprivileged_client=unprivileged_client) as ns:
         yield ns
 
 

utilities/infra.py

@@ -71,8 +71,8 @@
 
 @contextmanager
 def create_ns(
+    admin_client: DynamicClient,
     name: str | None = None,
-    client: DynamicClient | None = None,
     unprivileged_client: DynamicClient | None = None,
     teardown: bool = True,
     delete_timeout: int = Timeout.TIMEOUT_4MIN,
@@ -94,7 +94,7 @@ def create_ns(
     Args:
         name (str): namespace name.
             Can be overwritten by `request.param["name"]`
-        client (DynamicClient): admin client.
+        admin_client (DynamicClient): admin client.
         unprivileged_client (UnprivilegedClient): unprivileged client.
         teardown (bool): should run resource teardown
         delete_timeout (int): delete timeout.
@@ -120,7 +120,6 @@ def create_ns(
 
     namespace_kwargs = {
         "name": name,
-        "client": client or unprivileged_client,
         "teardown": teardown,
         "delete_timeout": delete_timeout,
         "label": labels or {},
@@ -138,32 +137,32 @@ def create_ns(
     if add_kueue_label:
         namespace_kwargs["label"][Labels.Kueue.MANAGED] = "true"  # type: ignore
 
-    if unprivileged_client:
-        with ProjectRequest(name=name, client=unprivileged_client, teardown=teardown):
-            project = Project(**namespace_kwargs)
-            project.wait_for_status(status=project.Status.ACTIVE, timeout=Timeout.TIMEOUT_2MIN)
-            if _labels := namespace_kwargs.get("label", {}):
-                # To patch the namespace, admin client is required
-                ns = Namespace(client=get_client(), name=name)
-                ResourceEditor({
-                    ns: {
-                        "metadata": {
-                            "labels": _labels,
-                        }
-                    }
-                }).update()
-            yield project
-
-            if teardown:
-                wait_for_serverless_pods_deletion(resource=project, admin_client=client)
-
-    else:
+    if not unprivileged_client:
+        namespace_kwargs["client"] = admin_client
         with Namespace(**namespace_kwargs) as ns:
             ns.wait_for_status(status=Namespace.Status.ACTIVE, timeout=Timeout.TIMEOUT_2MIN)
             yield ns
-
             if teardown:
-                wait_for_serverless_pods_deletion(resource=ns, admin_client=client)
+                wait_for_serverless_pods_deletion(resource=ns, admin_client=admin_client)
+    else:
+        namespace_kwargs["client"] = unprivileged_client
+        project = ProjectRequest(**namespace_kwargs).deploy()
+        if _labels := namespace_kwargs.get("label", {}):
+            # To patch the namespace, admin client is required
+            ns = Namespace(client=admin_client, name=name)
+            ResourceEditor({
+                ns: {
+                    "metadata": {
+                        "labels": _labels,
+                    }
+                }
+            }).update()
+        yield project
+        if teardown:
+            wait_for_serverless_pods_deletion(resource=project, admin_client=admin_client)
+            # cleanup must be done with admin admin_client
+            project.client = admin_client
+            project.clean_up()
 
 
 def wait_for_replicas_in_deployment(deployment: Deployment, replicas: int, timeout: int = Timeout.TIMEOUT_2MIN) -> None: