apiVersion: v1 items: - apiVersion: kuadrant.io/v1 kind: AuthPolicy metadata: creationTimestamp: "2026-11-01T05:10:24Z" generation: 88 labels: app.kubernetes.io/component: gateway-auth app.kubernetes.io/managed-by: maas-controller app.kubernetes.io/part-of: maas-gateway-auth name: maas-gateway-auth namespace: openshift-ingress ownerReferences: - apiVersion: gateway.networking.k8s.io/v1 controller: true kind: Gateway name: maas-default-gateway uid: 045a7f35-10db-4ea3-898e-123e91747245 resourceVersion: "134068" uid: d0b04f76-1fe2-44f1-85f8-ccce85feaf6c spec: defaults: rules: authentication: api-keys: metrics: false plain: selector: request.headers.authorization priority: 0 when: - operator: matches selector: request.headers.authorization value: ^Bearer **** openshift-identities: kubernetesTokenReview: audiences: - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/50ce7 metrics: false priority: 2 authorization: auth-valid: cache: key: selector: '"api-key|" + (request.headers.authorization.replace("Bearer ", "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 metrics: false opa: allValues: false rego: |- allow { object.get(input.auth.metadata, "apiKeyValidation", {}) input.auth.metadata.apiKeyValidation.valid == true } allow { not input.auth.metadata.apiKeyValidation } priority: 0 deny-api-key-management: metrics: false patternMatching: patterns: - predicate: "false" priority: 0 when: - predicate: (request.headers.authorization.matches("^Bearer ****")) && (request.path == "/maas-api/v1/api-keys" || request.path.startsWith("/maas-api/v1/api-keys/")) deny-client-identity-headers: metrics: false patternMatching: patterns: - predicate: '!("x-maas-username" in request.headers)' - predicate: '!("x-maas-group" in request.headers)' - predicate: '!("x-maas-keyname" in request.headers)' - predicate: '!("x-maas-subscription-rate-limit-id" in request.headers)' - predicate: '!("x-maas-organization-id" in request.headers)' - predicate: '!("x-maas-cost-center" in request.headers)' - predicate: '!("x-maas-identity" in request.headers)' - predicate: '!("x-maas-admin-scope" in request.headers)' - predicate: request.headers.all(name, !name.startsWith("x-aigateway-guardrail-")) - predicate: request.headers.all(name, !name.startsWith("x-grid-")) priority: 0 guardrail-checks-known: metrics: false opa: allValues: false rego: | import future.keywords.every allow { selected := object.get(input.auth.metadata["subscription-info"], "selectedGuardrailChecks", null) selected != null every id, value in selected { id in [] value == true } } priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) require-group-membership: cache: key: selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 metrics: false opa: allValues: false rego: |- allow { object.get(input.auth.metadata["subscription-info"], "accessAllowed", false) == true } priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) subscription-valid: cache: key: selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 metrics: false opa: allValues: false rego: "allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}" priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) metadata: apiKeyValidation: cache: key: selector: auth.identity.replace("Bearer ", "") ttl: 60 http: body: expression: '{"key": auth.identity.replace("Bearer ", "")}' contentType: application/json method: POST url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate metrics: false priority: 0 when: - predicate: auth.identity.matches("^(Bearer ****") subscription-info: cache: key: selector: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",") + "|" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")) + "|" + (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))' ttl: 60 http: body: expression: |- { "groups": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])), "username": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)), "requestedSubscription": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : ""), "requestedModel": (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : "")) } contentType: application/json method: POST url: https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select metrics: false priority: 1 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) response: success: filters: identity: json: properties: groups: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))' groups_str: expression: '((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? auth.identity.user.groups : []))).join(",")' keyId: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : ""' keyName: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : ""' selected_subscription: expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"].name : ""' selected_subscription_id: expression: 'has(auth.metadata["subscription-info"].rateLimitId) ? auth.metadata["subscription-info"].rateLimitId : ""' selected_subscription_key: expression: '(has(auth.metadata["subscription-info"].namespace) && has(auth.metadata["subscription-info"].name)) ? auth.metadata["subscription-info"].namespace + "/" + auth.metadata["subscription-info"].name + "@" + (has(auth.metadata["subscription-info"].resolvedModel) && auth.metadata["subscription-info"].resolvedModel != "" ? auth.metadata["subscription-info"].resolvedModel : (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" ? request.path.split("/").filter(x, x != "")[0] + "/" + request.path.split("/").filter(x, x != "")[1] : ("x-gateway-model-name" in request.headers ? request.headers["x-gateway-model-name"] : ""))) : ""' subscription_error: expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error : ""' subscription_error_message: expression: 'has(auth.metadata["subscription-info"].message) ? auth.metadata["subscription-info"].message : ""' subscription_info: expression: 'has(auth.metadata["subscription-info"].name) ? auth.metadata["subscription-info"] : {}' userid: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))' metrics: true priority: 0 when: - predicate: (size(request.path.split("/").filter(x, x != "")) >= 2 && request.path.split("/").filter(x, x != "")[0] != "v1" && request.path.split("/").filter(x, x != "")[0] != "maas-api" || "x-gateway-model-name" in request.headers) headers: X-MaaS-Cost-Center: metrics: false plain: expression: auth.metadata["subscription-info"].costCenter priority: 0 when: - predicate: has(auth.metadata["subscription-info"].costCenter) && auth.metadata["subscription-info"].costCenter != "" X-MaaS-Group: metrics: false plain: expression: 'size(auth.metadata.apiKeyValidation.groups) > 0 ? ''["'' + auth.metadata.apiKeyValidation.groups.join(''","'') + ''"]'' : ''[]''' priority: 0 when: - predicate: request.headers.authorization.matches("^Bearer ****") X-MaaS-Group-Token: key: X-MaaS-Group metrics: false plain: expression: 'has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","'' + auth.identity.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches(''^[A-Za-z0-9:#._/ -]+$'')) ? ''["system:authenticated","'' + auth.identity.user.groups.join(''","'') + ''"]'' : ''["system:authenticated"]'')' priority: 1 when: - predicate: '!request.headers.authorization.startsWith("Bearer ****")' X-MaaS-Identity: json: properties: claims: expression: '{"iss": auth.identity.iss, "sub": auth.identity.sub, "aud": auth.identity.aud, "azp": auth.identity.azp, "name": has(auth.identity.name) ? auth.identity.name : "", "given_name": has(auth.identity.given_name) ? auth.identity.given_name : "", "family_name": has(auth.identity.family_name) ? auth.identity.family_name : "", "preferred_username": has(auth.identity.preferred_username) ? auth.identity.preferred_username : "", "email": has(auth.identity.email) ? auth.identity.email : "", "groups": has(auth.identity.groups) ? auth.identity.groups : [], "https://redhat.com/maas/orgs": "https://redhat.com/maas/orgs" in auth.identity ? auth.identity["https://redhat.com/maas/orgs"] : []}' source: value: oidc metrics: false priority: 0 when: - predicate: "false" X-MaaS-KeyName: key: x-maas-keyname metrics: false plain: expression: auth.metadata.apiKeyValidation.keyName priority: 0 when: - predicate: request.headers.authorization.matches("^Bearer ****") X-MaaS-Subscription: metrics: false plain: expression: '(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : ("x-maas-subscription" in request.headers ? request.headers["x-maas-subscription"] : "")' priority: 0 when: - predicate: has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != "" X-MaaS-Subscription-Rate-Limit-Id: metrics: false plain: expression: auth.metadata["subscription-info"].rateLimitId priority: 0 when: - predicate: has(auth.metadata["subscription-info"].rateLimitId) && auth.metadata["subscription-info"].rateLimitId != "" X-MaaS-Username: metrics: false plain: selector: auth.metadata.apiKeyValidation.username priority: 0 when: - predicate: request.headers.authorization.matches("^Bearer ****") X-MaaS-Username-Token: key: X-MaaS-Username metrics: false plain: expression: 'has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)' priority: 1 when: - predicate: '!request.headers.authorization.startsWith("Bearer ****")' x-gateway-inference-fairness-id: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId : ""' priority: 0 x-gateway-inference-objective: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective : ""' priority: 0 x-llm-d-inference-fairness-id: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].fairnessId) ? auth.metadata["subscription-info"].fairnessId : ""' priority: 0 x-llm-d-inference-objective: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].objective) ? auth.metadata["subscription-info"].objective : ""' priority: 0 x-maas-organization-id: metrics: false plain: expression: 'has(auth.metadata) && "subscription-info" in auth.metadata && has(auth.metadata["subscription-info"].organizationId) ? auth.metadata["subscription-info"].organizationId : ""' priority: 0 unauthenticated: body: value: '{"error":{"message":"Authentication required","type":"authentication_error","code":401}}' code: 401 headers: content-type: value: application/json message: value: Authentication required unauthorized: body: expression: '''{"error":{"message":"'' + (has(auth.metadata["subscription-info"].message) ? auth.metadata["subscription-info"].message.replace(''\\'', ''\\\\'').replace(''"'', ''\\"'').replace(''\n'', ''\\n'').replace(''\r'', ''\\r'').replace(''\t'', ''\\t'') : "Access denied") + ''","type":"authorization_error","code":403}}''' code: 403 headers: content-type: value: application/json x-ext-auth-reason: expression: 'has(auth.metadata["subscription-info"].error) ? auth.metadata["subscription-info"].error : "unauthorized"' strategy: atomic when: - predicate: request.path != "/maas-api/health" || request.method != "GET" targetRef: group: gateway.networking.k8s.io kind: Gateway name: maas-default-gateway status: conditions: - lastTransitionTime: "2026-11-01T05:10:27Z" message: AuthPolicy has been accepted reason: Accepted status: "True" type: Accepted - lastTransitionTime: "2026-11-01T06:35:44Z" message: 'AuthPolicy waiting for the following components to sync: [AuthConfig (ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b) AuthConfig (2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630) AuthConfig (68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74) AuthConfig (2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7) AuthConfig (a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5) AuthConfig (54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd) AuthConfig (f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa) AuthConfig (fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933) AuthConfig (98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57) AuthConfig (e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07) AuthConfig (c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e) AuthConfig (efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce) AuthConfig (010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a) AuthConfig (a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796) AuthConfig (a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce) AuthConfig (2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71) AuthConfig (319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea) AuthConfig (de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb) AuthConfig (0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb) AuthConfig (8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061) AuthConfig (0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a) AuthConfig (99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de) AuthConfig (ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0) AuthConfig (3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c) AuthConfig (a9800464506c58f005016df354e160757732171ff4d19747202524955329b998) AuthConfig (50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7) AuthConfig (134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5) AuthConfig (b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668) AuthConfig (17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf) AuthConfig (3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857) AuthConfig (2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad) AuthConfig (5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e) AuthConfig (1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95) AuthConfig (5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f) AuthConfig (bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381) AuthConfig (94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b) AuthConfig (5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff) AuthConfig (75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c) AuthConfig (6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e) AuthConfig (4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84) AuthConfig (8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045) AuthConfig (dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714) AuthConfig (135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a) AuthConfig (100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0) AuthConfig (d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1) AuthConfig (74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72) AuthConfig (d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688) AuthConfig (a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe) AuthConfig (810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df) AuthConfig (2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194) AuthConfig (f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40) AuthConfig (726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f) AuthConfig (f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13) AuthConfig (5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02) AuthConfig (80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949) AuthConfig (67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c) AuthConfig (eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5) AuthConfig (cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0) AuthConfig (75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0) AuthConfig (e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed) AuthConfig (bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002) AuthConfig (9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef) AuthConfig (3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a) AuthConfig (06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3) AuthConfig (362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec) AuthConfig (a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b) AuthConfig (0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f) AuthConfig (486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724) AuthConfig (ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3) AuthConfig (dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5) AuthConfig (f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6) AuthConfig (a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb) AuthConfig (0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340) AuthConfig (aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04) AuthConfig (4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33) AuthConfig (d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455) AuthConfig (d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9) AuthConfig (b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e) AuthConfig (cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40) AuthConfig (c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac) AuthConfig (54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0) AuthConfig (c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58) AuthConfig (8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984) AuthConfig (7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f) AuthConfig (4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96) AuthConfig (1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4) AuthConfig (05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c) AuthConfig (6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3) AuthConfig (06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc) AuthConfig (d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b) AuthConfig (23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25) AuthConfig (3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c) AuthConfig (028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3) AuthConfig (669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2) AuthConfig (7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff) AuthConfig (596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398) AuthConfig (92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600) AuthConfig (0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6) AuthConfig (105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6) AuthConfig (8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264) AuthConfig (a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269) AuthConfig (a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14)]' reason: Unknown status: "False" type: Enforced observedGeneration: 88 - apiVersion: kuadrant.io/v1 kind: AuthPolicy metadata: creationTimestamp: "2026-11-01T05:10:50Z" generation: 1 labels: app.kubernetes.io/component: llminferenceservice-policies app.kubernetes.io/managed-by: odh-model-controller app.kubernetes.io/name: llminferenceservice-auth app.kubernetes.io/part-of: llminferenceservice name: openshift-ai-inference-authn namespace: openshift-ingress ownerReferences: - apiVersion: gateway.networking.k8s.io/v1 blockOwnerDeletion: true controller: true kind: Gateway name: openshift-ai-inference uid: f44f486b-4ff4-4938-8fda-329a61a365dc resourceVersion: "18238" uid: 8df0c7f6-a03d-4b1d-96ce-57607e528a87 spec: patterns: has-ns-and-name: allOf: - operator: matches selector: context.request.http.path value: ^/[^/]+/[^/]+ is-publisher-path: allOf: - operator: matches selector: context.request.http.path value: ^/publishers/[^/]+/models/ rules: authentication: kubernetes-user: credentials: ****REDACTED**** kubernetesTokenReview: audiences: - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/50ce7 metrics: false overrides: fairness: value: https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/50ce7 objective: expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'') ? auth.identity.user.username.split('':'')[2] : ''authenticated''' resolvedGroups: expression: |- 'x-maas-user' in request.headers ? ('x-maas-groups' in request.headers ? request.headers['x-maas-groups'].split(',') : []) : auth.identity.user.groups resolvedUser: expression: '''x-maas-user'' in request.headers ? request.headers[''x-maas-user''] : auth.identity.user.username' priority: 0 authorization: deny-misrouted-model-header: metrics: false patternMatching: patterns: - predicate: "false" priority: 0 when: - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')' - predicate: '!(request.path == ''/v1/files'' || request.path.startsWith(''/v1/files/'') || request.path == ''/v1/batches'' || request.path.startsWith(''/v1/batches/''))' - predicate: '''x-gateway-model-name'' in request.headers && request.headers[''x-gateway-model-name''].matches(''^publishers/[^/]+/models/.+$'')' inference-access: kubernetesSubjectAccessReview: authorizationGroups: expression: auth.identity.resolvedGroups resourceAttributes: group: value: serving.kserve.io name: expression: request.path.split("/")[2] namespace: expression: request.path.split("/")[1] resource: value: llminferenceservices subresource: {} verb: value: get user: expression: auth.identity.resolvedUser metrics: false priority: 1 when: - patternRef: has-ns-and-name - predicate: '!request.path.startsWith(''/v1/'')' - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')' inference-access-delegate: kubernetesSubjectAccessReview: authorizationGroups: expression: auth.identity.user.groups resourceAttributes: group: value: serving.kserve.io name: expression: request.path.split("/")[2] namespace: expression: request.path.split("/")[1] resource: value: llminferenceservices/delegate subresource: {} verb: value: post-delegate user: expression: auth.identity.user.username metrics: false priority: 1 when: - patternRef: has-ns-and-name - predicate: '!request.path.startsWith(''/v1/'')' - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')' - predicate: '''x-maas-user'' in request.headers' model-access-path: kubernetesSubjectAccessReview: authorizationGroups: expression: auth.identity.resolvedGroups resourceAttributes: group: value: serving.opendatahub.io name: expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/'' + request.path.split(''/models/'')[1].split(''/v1/'')[0]' namespace: expression: request.path.split('/')[2] resource: value: models subresource: {} verb: value: post user: expression: auth.identity.resolvedUser metrics: false priority: 1 when: - patternRef: is-publisher-path model-access-path-delegate: kubernetesSubjectAccessReview: authorizationGroups: expression: auth.identity.user.groups resourceAttributes: group: value: serving.opendatahub.io name: expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/'' + request.path.split(''/models/'')[1].split(''/v1/'')[0]' namespace: expression: request.path.split('/')[2] resource: value: models/delegate subresource: {} verb: value: post-delegate user: expression: auth.identity.user.username metrics: false priority: 1 when: - patternRef: is-publisher-path - predicate: '''x-maas-user'' in request.headers' response: success: headers: x-gateway-inference-fairness-id: metrics: false plain: expression: auth.identity.fairness priority: 0 x-gateway-inference-objective: metrics: false plain: expression: auth.identity.objective priority: 0 x-maas-groups: metrics: false plain: expression: auth.identity.user.groups.join(',') priority: 0 when: - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/') || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/') x-maas-user: metrics: false plain: expression: auth.identity.user.username priority: 0 when: - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/') || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/') x-tenant-id: metrics: false plain: expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'') ? auth.identity.user.username.split('':'')[2] : ''default''' priority: 0 when: - predicate: request.path.startsWith('/v1/') x-user-id: metrics: false plain: expression: auth.identity.user.username priority: 0 when: - predicate: request.path.startsWith('/v1/') targetRef: group: gateway.networking.k8s.io kind: Gateway name: openshift-ai-inference status: conditions: - lastTransitionTime: "2026-11-01T05:10:52Z" message: AuthPolicy has been accepted reason: Accepted status: "True" type: Accepted - lastTransitionTime: "2026-11-01T05:10:52Z" message: AuthPolicy is not in the path to any existing routes reason: Unknown status: "False" type: Enforced observedGeneration: 1 kind: List metadata: resourceVersion: ""