apiVersion: v1 items: - apiVersion: kuadrant.io/v1 kind: AuthPolicy metadata: creationTimestamp: "2026-10-30T00:40:15Z" generation: 1 labels: app.kubernetes.io/component: gateway-auth app.kubernetes.io/managed-by: maas-controller app.kubernetes.io/part-of: maas-gateway-auth name: maas-gateway-auth namespace: openshift-ingress ownerReferences: - apiVersion: gateway.networking.k8s.io/v1 controller: true kind: Gateway name: maas-default-gateway uid: c7574b35-b560-492f-84f7-72fcf8d08bf2 resourceVersion: "148753" uid: 3b98d43c-01f5-47cb-8599-ae5f1fcf5e4d spec: defaults: rules: authentication: api-keys: metrics: false plain: selector: request.headers.authorization priority: 0 when: - operator: matches selector: request.headers.authorization value: ^Bearer **** openshift-identities: kubernetesTokenReview: audiences: - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/1070e metrics: false priority: 2 authorization: auth-valid: cache: key: selector: '"api-key|" + (request.headers.authorization.replace("Bearer ", "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 metrics: false opa: allValues: false rego: |- allow { object.get(input.auth.metadata, "apiKeyValidation", {}) input.auth.metadata.apiKeyValidation.valid == true } allow { not input.auth.metadata.apiKeyValidation } priority: 0 deny-api-key-management: metrics: false patternMatching: patterns: - predicate: "false" priority: 0 when: - predicate: (request.headers.authorization.matches("^Bearer ****")) && (request.path == "/maas-api/v1/api-keys" || request.path.startsWith("/maas-api/v1/api-keys/")) deny-client-identity-headers: metrics: false patternMatching: patterns: - predicate: '!("x-maas-username" in request.headers)' - predicate: '!("x-maas-group" in request.headers)' - predicate: '!("x-maas-keyname" in request.headers)' - predicate: '!("x-maas-subscription-rate-limit-id" in request.headers)' - predicate: '!("x-maas-organization-id" in request.headers)' - predicate: '!("x-maas-cost-center" in request.headers)' - predicate: '!("x-maas-identity" in request.headers)' - predicate: '!("x-maas-admin-scope" in request.headers)' priority: 0 require-group-membership: cache: key: selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 metrics: false opa: allValues: false rego: |- allow { object.get(input.auth.metadata["subscription-info"], "accessAllowed", false) == true } priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) subscription-valid: cache: key: selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 metrics: false opa: allValues: false rego: "allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}" priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) metadata: apiKeyValidation: cache: key: selector: auth.identity.replace("Bearer ", "") ttl: 60 http: body: expression: '{"key": auth.identity.replace("Bearer ", "")}' contentType: application/json method: POST url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate metrics: false priority: 0 when: - predicate: auth.identity.matches("^(Bearer ****") subscription-info: cache: key: selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 http: body: expression: |- { "groups": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])), "username": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)), "requestedSubscription": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : ""), "requestedModel": (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : "")) } contentType: application/json method: POST url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select metrics: false priority: 1 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) response: success: filters: identity: json: properties: groups: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))' groups_str: expression: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",")' keyId: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : ""' keyName: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : ""' selected_subscription: expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"].name : ""' selected_subscription_id: expression: 'has(auth.metadata["subscription-info"].rateLimitId) ? auth.metadata["subscription-info"].rateLimitId : ""' selected_subscription_key: expression: '(has(auth.metadata["subscription-info"].namespace) && has(auth.metadata["subscription-info"].name)) ? auth.metadata["subscription-info"].namespace + "/" + auth.metadata["subscription-info"].name + "@" + (has(auth.metadata["subscription-info"].resolvedModel) && auth.metadata["subscription-info"].resolvedModel != "" ? auth.metadata["subscription-info"].resolvedModel : (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))) : ""' subscription_error: expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error : ""' subscription_error_message: expression: 'has(auth.metadata["subscription-info"].message) ? auth.metadata["subscription-info"].message : ""' subscription_info: expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"] : {}' userid: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))' metrics: true priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) headers: X-MaaS-Cost-Center: metrics: false plain: expression: auth.metadata["subscription-info"].costCenter priority: 0 when: - predicate: has(auth.metadata["subscription-info"].costCenter) && auth.metadata["subscription-info"].costCenter != "" X-MaaS-Group: metrics: false plain: expression: 'size(auth.metadata.apiKeyValidation.groups) > 0 ? ''["'' + auth.metadata.apiKeyValidation.groups.join(''","'') + ''"]'' : ''[]''' priority: 0 when: - predicate: request.headers.authorization.matches("^Bearer ****") X-MaaS-Group-Token: key: X-MaaS-Group metrics: false plain: expression: 'has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","'' + auth.identity.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","'' + auth.identity.user.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'')' priority: 1 when: - predicate: '!request.headers.authorization.startsWith("Bearer ****")' X-MaaS-Identity: json: properties: claims: {} source: value: oidc metrics: false priority: 0 when: - predicate: "false" X-MaaS-KeyName: key: x-maas-keyname metrics: false plain: expression: auth.metadata.apiKeyValidation.keyName priority: 0 when: - predicate: request.headers.authorization.matches("^Bearer ****") X-MaaS-Organization-Id: metrics: false plain: expression: auth.metadata["subscription-info"].organizationId priority: 0 when: - predicate: has(auth.metadata["subscription-info"].organizationId) && auth.metadata["subscription-info"].organizationId != "" X-MaaS-Subscription: metrics: false plain: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")' priority: 0 when: - predicate: has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != "" X-MaaS-Subscription-Rate-Limit-Id: metrics: false plain: expression: auth.metadata["subscription-info"].rateLimitId priority: 0 when: - predicate: has(auth.metadata["subscription-info"].rateLimitId) && auth.metadata["subscription-info"].rateLimitId != "" X-MaaS-Username: metrics: false plain: selector: auth.metadata.apiKeyValidation.username priority: 0 when: - predicate: request.headers.authorization.matches("^Bearer ****") X-MaaS-Username-Token: key: X-MaaS-Username metrics: false plain: expression: 'has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)' priority: 1 when: - predicate: '!request.headers.authorization.startsWith("Bearer ****")' x-gateway-inference-fairness-id: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId : ""' priority: 0 x-gateway-inference-objective: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective : ""' priority: 0 x-llm-d-inference-fairness-id: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId : ""' priority: 0 x-llm-d-inference-objective: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective : ""' priority: 0 unauthenticated: body: value: '{"error":{"message":"Authentication required","type":"authentication_error","code":401}}' code: 401 headers: content-type: value: application/json message: value: Authentication required unauthorized: body: expression: '''{"error":{"message":"'' + (has(auth.metadata["subscription-info"].message) ? auth.metadata["subscription-info"].message.replace(''\\'', ''\\\\'').replace(''"'', ''\\"'').replace(''\n'', ''\\n'').replace(''\r'', ''\\r'').replace(''\t'', ''\\t'') : "Access denied") + ''","type":"authorization_error","code":403}}''' code: 403 headers: content-type: value: application/json x-ext-auth-reason: expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error : "unauthorized"' strategy: atomic when: - predicate: request.path != "/maas-api/health" || request.method != "GET" targetRef: group: gateway.networking.k8s.io kind: Gateway name: maas-default-gateway status: conditions: - lastTransitionTime: "2026-10-30T00:40:16Z" message: AuthPolicy has been accepted reason: Accepted status: "True" type: Accepted - lastTransitionTime: "2026-10-30T01:35:03Z" message: AuthPolicy has been successfully enforced reason: Enforced status: "True" type: Enforced observedGeneration: 1 kind: List metadata: resourceVersion: ""