apiVersion: v1
items:
- apiVersion: kuadrant.io/v1
  kind: AuthPolicy
  metadata:
    creationTimestamp: "2026-11-02T18:08:26Z"
    generation: 1
    labels:
      app.kubernetes.io/component: llminferenceservice-policies
      app.kubernetes.io/managed-by: odh-model-controller
      app.kubernetes.io/name: llminferenceservice-auth
      app.kubernetes.io/part-of: llminferenceservice
    name: openshift-ai-inference-authn
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: gateway.networking.k8s.io/v1
      blockOwnerDeletion: true
      controller: true
      kind: Gateway
      name: openshift-ai-inference
      uid: d7d70680-8250-4e3f-b171-d33d507304cd
    resourceVersion: "16718"
    uid: 55e2c3ad-4bfe-43be-ae88-2c398bd72f07
  spec:
    patterns:
      has-ns-and-name:
        allOf:
        - operator: matches
          selector: context.request.http.path
          value: ^/[^/]+/[^/]+
      is-publisher-path:
        allOf:
        - operator: matches
          selector: context.request.http.path
          value: ^/publishers/[^/]+/models/
    rules:
      authentication:
        kubernetes-user:
          credentials: ****REDACTED****
          kubernetesTokenReview:
            audiences:
            - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/4d44f
          metrics: false
          overrides:
            fairness:
              value: https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/4d44f
            objective:
              expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'')
                ? auth.identity.user.username.split('':'')[2] : ''authenticated'''
            resolvedGroups:
              expression: |-
                'x-maas-user' in request.headers ? ('x-maas-groups' in request.headers
                  ? request.headers['x-maas-groups'].split(',')
                  : [])
                : auth.identity.user.groups
            resolvedUser:
              expression: '''x-maas-user'' in request.headers ? request.headers[''x-maas-user'']
                : auth.identity.user.username'
          priority: 0
      authorization:
        deny-misrouted-model-header:
          metrics: false
          patternMatching:
            patterns:
            - predicate: "false"
          priority: 0
          when:
          - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
          - predicate: '!(request.path == ''/v1/files'' || request.path.startsWith(''/v1/files/'')
              || request.path == ''/v1/batches'' || request.path.startsWith(''/v1/batches/''))'
          - predicate: '''x-gateway-model-name'' in request.headers && request.headers[''x-gateway-model-name''].matches(''^publishers/[^/]+/models/.+$'')'
        inference-access:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.resolvedGroups
            resourceAttributes:
              group:
                value: serving.kserve.io
              name:
                expression: request.path.split("/")[2]
              namespace:
                expression: request.path.split("/")[1]
              resource:
                value: llminferenceservices
              subresource: {}
              verb:
                value: get
            user:
              expression: auth.identity.resolvedUser
          metrics: false
          priority: 1
          when:
          - patternRef: has-ns-and-name
          - predicate: '!request.path.startsWith(''/v1/'')'
          - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
        inference-access-delegate:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.user.groups
            resourceAttributes:
              group:
                value: serving.kserve.io
              name:
                expression: request.path.split("/")[2]
              namespace:
                expression: request.path.split("/")[1]
              resource:
                value: llminferenceservices/delegate
              subresource: {}
              verb:
                value: post-delegate
            user:
              expression: auth.identity.user.username
          metrics: false
          priority: 1
          when:
          - patternRef: has-ns-and-name
          - predicate: '!request.path.startsWith(''/v1/'')'
          - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
          - predicate: '''x-maas-user'' in request.headers'
        model-access-path:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.resolvedGroups
            resourceAttributes:
              group:
                value: serving.opendatahub.io
              name:
                expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/''
                  + request.path.split(''/models/'')[1].split(''/v1/'')[0]'
              namespace:
                expression: request.path.split('/')[2]
              resource:
                value: models
              subresource: {}
              verb:
                value: post
            user:
              expression: auth.identity.resolvedUser
          metrics: false
          priority: 1
          when:
          - patternRef: is-publisher-path
        model-access-path-delegate:
          kubernetesSubjectAccessReview:
            authorizationGroups:
              expression: auth.identity.user.groups
            resourceAttributes:
              group:
                value: serving.opendatahub.io
              name:
                expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/''
                  + request.path.split(''/models/'')[1].split(''/v1/'')[0]'
              namespace:
                expression: request.path.split('/')[2]
              resource:
                value: models/delegate
              subresource: {}
              verb:
                value: post-delegate
            user:
              expression: auth.identity.user.username
          metrics: false
          priority: 1
          when:
          - patternRef: is-publisher-path
          - predicate: '''x-maas-user'' in request.headers'
      response:
        success:
          headers:
            x-gateway-inference-fairness-id:
              metrics: false
              plain:
                expression: auth.identity.fairness
              priority: 0
            x-gateway-inference-objective:
              metrics: false
              plain:
                expression: auth.identity.objective
              priority: 0
            x-maas-groups:
              metrics: false
              plain:
                expression: auth.identity.user.groups.join(',')
              priority: 0
              when:
              - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/')
                  || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/')
            x-maas-user:
              metrics: false
              plain:
                expression: auth.identity.user.username
              priority: 0
              when:
              - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/')
                  || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/')
            x-tenant-id:
              metrics: false
              plain:
                expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'')
                  ? auth.identity.user.username.split('':'')[2] : ''default'''
              priority: 0
              when:
              - predicate: request.path.startsWith('/v1/')
            x-user-id:
              metrics: false
              plain:
                expression: auth.identity.user.username
              priority: 0
              when:
              - predicate: request.path.startsWith('/v1/')
    targetRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: openshift-ai-inference
  status:
    conditions:
    - lastTransitionTime: "2026-11-02T18:08:26Z"
      message: '[Authorino Operator] is not installed, please restart Kuadrant Operator
        pod once dependency has been installed'
      reason: MissingDependency
      status: "False"
      type: Accepted
    observedGeneration: 1
kind: List
metadata:
  resourceVersion: ""